{ "Event": { "published": true, "date": "2026-05-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-21", "timestamp": 1779408182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d037f324-6ffd-4ec6-8c90-d50e3febe375", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c5de0d-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779371983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371983, "uuid": "464e8293-b475-47aa-963b-6260539077df", "comment": "Malware payload (AgentTesla)", "value": "6dbb55ad41b3fa7a5316abe08d8b9480", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371983, "uuid": "38cdfa20-c13b-478c-bd49-8ebe7c9b7a90", "comment": "Malware payload (AgentTesla)", "value": "000d931f8f76a4fc9ba255cbc972e03f58d3e49bcdd6008094ac0dc2e4fe25a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371983, "uuid": "ddeb4f2b-3891-4177-9aa2-e15a3dd18f38", "comment": "Malware payload (AgentTesla)", "value": "53a5bea8b8b20dd305410679fb8aa47e83948328", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371983, "uuid": "2bb1a9e3-1f49-4da9-b28b-609cfda39940", "comment": "Malware payload (AgentTesla)", "value": "57576690880fd3d100c33c75b42e4dc3a5c32fab836aa09d3e70f0bf7a7c4675ddd01a47be9b7a53fd88fb1c25a53153", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371983, "uuid": "59820e28-b2d5-4eeb-85a0-7e012b0cf63f", "value": "T14FF4233131796EBBDCB5C7F5A0766001037AF06D70A1D6E6AC9091F898F1B089792F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371983, "uuid": "07f8b258-d534-4e65-bb73-b727edc812fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371983, "uuid": "dbfeb223-98d6-4b71-a5bd-d063d38abbc0", "value": "12288:ZQlH2aJzrnZZ1JQMOKFAJvCRUqE76Nir5bepToBrhcgFR2dZUdfx5DiA7Gs0lc:ZCHtJXNJQqaJ+GCir5STP4R2jUdZ97Gu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371983, "uuid": "561ad030-47f7-4fa8-994d-576c5d293dfe", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371983, "uuid": "a1c1f3e9-0178-482a-add1-99162f4ed625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371983, "uuid": "68427ea7-e2fe-403d-81c2-39e176822775", "value": "PO#86637_copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53bc0204-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779371987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371987, "uuid": "e0e2dbe2-08cb-4021-bfc0-c2b9bc4aac77", "comment": "Malware payload", "value": "9e867c18d3580189bc83e475f6f92e3c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371987, "uuid": "89cd4759-65d0-4598-a955-b0cf92d4a6e5", "comment": "Malware payload", "value": "008561365e723d88a8f4d3cdae34f7a8229623ef1d4813c392970291f1cd269d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371987, "uuid": "b7029930-4059-4fef-8162-da25b01343fa", "comment": "Malware payload", "value": "143652fe083bd980c470245e23d7000287e20654", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371987, "uuid": "245eb719-1929-4a96-a99d-1ce5f0192334", "comment": "Malware payload", "value": "815ab3dde75383f91ee0660ee029d61ab040450207269ebbe56a111523229cbb3435452d113a065a8edd385ad7629db8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371987, "uuid": "2fb60838-f9f2-4c5d-8354-2901d87c93ec", "value": "T1A302C053335448BDC1E5DCF3F6C89311416EA2B482C8B9466E80414F76978D346FD6DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371987, "uuid": "56afed44-ff77-4284-8487-2f6d97d40084", "value": "192:GyCLp5OnDaA/yP7WJpqf/pFKvT5Mz+li5vj5mjyO2oBv3kx0ILTRv9WdLHPhLzWw:GyCLpsOA/MWj82e7BtG12o50x0IPWdLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371987, "uuid": "f231f235-66fe-4107-8e8f-a2f86fa42070", "value": 8907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371987, "uuid": "75c8f774-d1dd-4a92-a8a8-c4e1b083bf1c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371987, "uuid": "6067b0b5-661f-4146-9d59-a0796a05500f", "value": "Beitragsrechnung_2024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a4d6b5-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779371990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371990, "uuid": "1b293ece-0c80-422f-bc0c-c7c8b77ad115", "comment": "Malware payload", "value": "91b2875551cb09212858e6775b41abd5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371990, "uuid": "8f459de5-cc6b-4724-99b8-4b9013572e70", "comment": "Malware payload", "value": "00a5ec55396df98f6c58fcfd43e4d565eb776dfc7019dc4a11789593113e20bb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371990, "uuid": "1542e818-8f00-4363-952f-cee9ff850473", "comment": "Malware payload", "value": "a6d2de8c723dbd32f3f590ea63d02cd088f0ae02", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371990, "uuid": "2b715443-0d8f-47b7-bdda-11f12519b3bd", "comment": "Malware payload", "value": "91ab8ccb30126146e57e03bb74819807584684bb14b2ee311f295e6a3b025465dfa29221fe6ef4a8288817031d7810dd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371990, "uuid": "a0299496-1008-45bb-922c-d5a062ee4c4e", "value": "T15C322A60B3D0726E09A781FEB4073250E8B8546457697299C2CED35DBD0EDBCC73E82A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371990, "uuid": "459f6520-780d-4dbf-9b94-5b9e41f868d8", "value": "192:KD5Bhq2/nye6DcetuQAL/RvJytDoECet9whdVaQR/g6HY3VZf6:KNBhT8JArRvJM7xt9EfaE/BHYlZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371990, "uuid": "7fe32923-fcbb-4424-9acd-d24a1075acf3", "value": 11911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371990, "uuid": "c6b5f511-9c1a-4a4d-826c-c9f4c10d9e1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371990, "uuid": "6215e249-bdff-4200-b0d1-cae4479d11f5", "value": "2650423314881710765.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8338ba9e-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370348, "uuid": "63cb5cab-541a-4516-926d-80f77fd80640", "comment": "Malware payload (StrelaStealer)", "value": "63210f6810d12fe8bfd2e9c47c301078", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370348, "uuid": "92ce5dce-fb92-4822-bebf-863ef05d3eb6", "comment": "Malware payload (StrelaStealer)", "value": "00ed44d875486173d0bae39368b7b14a9f17e93e423b85bf6639585654e8d2c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370348, "uuid": "bc29e49a-479c-4194-9dd0-0d6d50b56346", "comment": "Malware payload (StrelaStealer)", "value": "6cb6f261acca7232e22081fd2d54a52151d227ae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370348, "uuid": "af4bf613-b449-4211-9ed7-cd11acb9017f", "comment": "Malware payload (StrelaStealer)", "value": "59c35ca16ba86ff36473125dfe839597c25355e546b708b327423f84a7500fa78f78c10a5577d2dc9814bb580b9a132c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370348, "uuid": "0d58020b-20ff-4893-9eee-51a76dd7c956", "value": "T1BD25BFFDC310259F345F9F8C84557C460E48A9333636B1B683B72B478F8D891A66AE1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370348, "uuid": "0df54f02-d669-4c0d-808a-80fe2d197f38", "value": "12288:BSDLOmOhkcV/mxR1e9VFZgJVsagvO6O6OmZQFagvO6O6OmZEqHF:BUOFhexR1wZH9WBBR9WBBDQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370348, "uuid": "6b0294a9-2689-449e-aa65-6999e3988451", "value": 1025730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370348, "uuid": "3f76b5a9-49b4-4f37-8f26-1266703c4806", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370348, "uuid": "82a95f18-75cf-4dd3-b868-b3a6ca680370", "value": "14042176341941212051.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579c52cc-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371993, "uuid": "82299454-ed7d-4e0d-8d47-af74ee3ac4a9", "comment": "Malware payload (StrelaStealer)", "value": "db33d7e480ae0a9a87ccfb18a4835eb6", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371993, "uuid": "30f99a05-7580-4373-8263-d2497b9a1112", "comment": "Malware payload (StrelaStealer)", "value": "011802f455c32962a6ec5fb5ff1e57708e270d9c052762c6aba975272e477929", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371993, "uuid": "271e5710-ea93-4951-afa3-61a6390015d1", "comment": "Malware payload (StrelaStealer)", "value": "2f5e23e8d32d3db2381d722d05179436cfde3ce1", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371993, "uuid": "63f699ec-a576-4840-bb76-207dcb386f04", "comment": "Malware payload (StrelaStealer)", "value": "95f801803001d96c96b81d9d6c640a99e3ebccc773463aa74bfdba0b86ab582152d8969ada4f57a8270526f97e3539ef", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371993, "uuid": "3790436a-631f-4e4c-b07c-e2918d670c2a", "value": "T1A3A18DE6AD100A5FCD5773BE6E466588A83953675F027B29F04234FCD701C9A68F0E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371993, "uuid": "a146d437-5814-4274-98a7-da6cae01f852", "value": "96:kulrPrR6JIb6D5OvGbxHkDnxLBMj3fov+YziuOv6IzmmJ2K8Nh/3vcEp+VZ:TNPoib4cvwhknugWuo9meWcEpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371993, "uuid": "03456e3e-4a3e-48c4-b10e-655cc8628860", "value": 5032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371993, "uuid": "1912980b-5faa-4054-b273-9cf1cf96dcf6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371993, "uuid": "96ec1c69-1d88-49ea-b5a9-66222fab63f1", "value": "Verkauf_-_Rechnung.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85423708-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370352, "uuid": "57cab027-b5d5-4191-b824-73f2991f401c", "comment": "Malware payload (StrelaStealer)", "value": "625104c62789a278d6bd33df4e659846", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370352, "uuid": "a28a8723-68ae-4e44-959e-068c534662a5", "comment": "Malware payload (StrelaStealer)", "value": "015e05fe5ebe48dcf54cbc1ad73afb6bc68fe067c77ffb7afff5577663e5da56", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370352, "uuid": "1b62b90c-8c62-4fe5-a600-fb5a89ed70b6", "comment": "Malware payload (StrelaStealer)", "value": "40295bb9a384829859f399365fe05fd7355890e5", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370352, "uuid": "b3b56edb-c715-4aff-ab87-b966625f444a", "comment": "Malware payload (StrelaStealer)", "value": "c1254bc5c017e16d35ad68d23fd94e0e4321586d4a063178925cf0a6854d264d2ac3fea15c13ea8e9ce5ddca08fffde6", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370352, "uuid": "ea14b48a-a50d-4287-8349-3b4c1d62c819", "value": "T1A854223165DA0EE54C9AD8125E5F60D22083BCD7052A90B1AF23B9FF617FF26742DE06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370352, "uuid": "e976688f-eeb6-4f97-be0e-9e4214a0c35e", "value": "6144:bYpUGuiZwRrwqmqKJiaMuzqUhvjwKKCxrcJ0wKAKiBrq4RFJYEYe:bxGuKQrFmq1aMuLMuoK9+rqcLSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370352, "uuid": "23f0a65d-5cca-475b-b2f6-5a4081ea7407", "value": 303449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370352, "uuid": "69e264e4-8d7a-4ea7-b6dd-04120a58579e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370352, "uuid": "f2ee38df-9648-4767-9185-8c0bf63daac1", "value": "Retoureneingang739291780.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87503b3d-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370355, "uuid": "fe2d0dbe-2641-4edf-bac0-7ded12c82f1c", "comment": "Malware payload (StrelaStealer)", "value": "bf172011eb2b67b213562824d73d4bac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370355, "uuid": "5fdf89b3-8c3a-4f3b-b454-a8f3c90de124", "comment": "Malware payload (StrelaStealer)", "value": "01729f77d40dd957927709f346df0d5509bb2f4a59c6f16eda0638b6f273e309", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370355, "uuid": "a45123a2-7595-45c2-8122-13aeadc9f2d3", "comment": "Malware payload (StrelaStealer)", "value": "58e03a8b0df85dcc62b62ec65f545bbb4f8469c7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370355, "uuid": "8ec2c72a-c68f-4923-81d3-6e5fa96c42ba", "comment": "Malware payload (StrelaStealer)", "value": "696e2a7565af91e83ff7f77c3f0cbd312c6af1674e0542650a8162b104f576562f736fc0142125e96df26a0d4cfd30f4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370355, "uuid": "ddca3598-c5cc-4694-bc11-11c8ef399bf4", "value": "T1AC838EF68F5C67C8A267CF8B134DC9327C44B8156A33869E43CF67494F196235DB9A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370355, "uuid": "f72d628b-dcd1-43a2-9478-4135da743a85", "value": "1536:Fb3gaD6wu9fh1660IdFdIbYA+wBDz0F0G2lD:Fb3g+6wu9jTj/O+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370355, "uuid": "41ef1678-59b5-4336-bc7e-0616fdc3c734", "value": 82675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370355, "uuid": "c440f898-f330-454f-801a-0e15103a2229", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370355, "uuid": "1784b207-2fa0-4594-8a20-2841854a0c57", "value": "1614729858695832147.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5993b5e3-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371997, "uuid": "2d43416f-f52d-4f89-a379-a5d9e57b4618", "comment": "Malware payload (StrelaStealer)", "value": "891052842c1ec4d0df388f183adbeb96", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371997, "uuid": "9e68e4ae-97b1-401b-92bd-94c603cf5fd5", "comment": "Malware payload (StrelaStealer)", "value": "019d2f45acc4244e7fa8a5cb8e0897858b9884a15eb68162c8ea95778dd71b3a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371997, "uuid": "4e5328d7-f50f-4114-9747-17ad4d36bf47", "comment": "Malware payload (StrelaStealer)", "value": "e0b1bf476d69324a109135eedd201a6e0e803bfe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371997, "uuid": "04ffcd90-9866-4462-a2d6-ddf04d585efb", "comment": "Malware payload (StrelaStealer)", "value": "1ed401f12b135ea8f7f12d0b5cdd982fb325fb0fba4b96f197f153c2b5f5467a1e86d62a4341af6ec8a1329ae824b93c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371997, "uuid": "32eba8c8-5141-49da-b948-97f69d4b9d6f", "value": "T1D2C11579F2916410C120D9F612B713C127ADDF272B53C5AA9253E2A1ABF4FC3ED9285C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371997, "uuid": "3525c729-4694-42be-adb2-8eea2a5baf3b", "value": "96:nqHLnfFz731drapZZ0xxx7DN/VZ0xxx7DU+23Zk05rvmb8kPALPmmlQ60abTEGCW:nqr5Jd+HZ0xxx7D9VZ0xxx7Dd05bmAku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371997, "uuid": "dd59fbce-0866-4f8a-a3ec-0b601fcfb50b", "value": 5910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371997, "uuid": "ba6031cb-52da-47ca-8612-d14c1f569efd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371997, "uuid": "0e5154b3-7ffd-46e7-b580-541aff161243", "value": "1073918301984921800.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba5cb44-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372000, "uuid": "91a8f599-41df-4618-b8c1-6a0cff8fa3ec", "comment": "Malware payload", "value": "60fbf150749ed91c40c1389c2ab7d8ef", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372000, "uuid": "3e8404e0-0f61-4bcc-8051-505845d2a087", "comment": "Malware payload", "value": "02201a0abb1c0fce2f67b649db61e5b3f909ee4f234d7d596a7d3a201665d9f0", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372000, "uuid": "2a4437c3-1794-408b-8442-d703b2c56731", "comment": "Malware payload", "value": "ef182746193ed1ba118f380494d3aa3f947becbe", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372000, "uuid": "612325f5-adcc-4f1e-835f-86ef06316df8", "comment": "Malware payload", "value": "bfa00f5b552473b32ccd19ac197f09253d22661a85c4a62a1c94aa143c1d78bb7832e9484ec5ba01da25c1b733437e7b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372000, "uuid": "50c7e488-e9c6-49bf-9cfe-f9f4476b50fb", "value": "T192853395442DEE7C50C828B30133F78DDAB16AC2781255C15F1F2B9BCA5EC1BE17AAB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372000, "uuid": "d81aa28b-0296-41de-9fac-619dd1abb4cf", "value": "49152:JkOP7rjcNkVP8bl1x5S8QHWpQ9ViVva0X:q8ANkeZ5S8QP9ViY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372000, "uuid": "6736fb9d-2115-49ab-b202-1826c5e05599", "value": 1837306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372000, "uuid": "0c366740-a391-40e3-aa75-8f0fe7d728e8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372000, "uuid": "1b76df74-c4fa-450e-9f92-8c6eb3468c7f", "value": "Quotation_r.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6f304c-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372006, "uuid": "b712c6ef-a6d9-4cbd-af23-86498bdfac81", "comment": "Malware payload (Formbook)", "value": "7afef1ca515fa3acf16209e7ece8f1f3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372006, "uuid": "75302cf8-8b51-4aec-90e6-25ac98c6b52f", "comment": "Malware payload (Formbook)", "value": "0234c597f0d87290a11ad681849fc97f00f27693711cc856f092df7a637c1451", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372006, "uuid": "e2ff46c0-bee6-498f-a3b5-0ea9a04a810d", "comment": "Malware payload (Formbook)", "value": "f84729094d5b69dad65f7644ae5a8072c14f9e83", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372006, "uuid": "f68b8131-3a87-4b91-836f-9eb72d3130db", "comment": "Malware payload (Formbook)", "value": "68d516566ef449efba14a6518cae82a97de5b3b225d16a8e82c6252575740e8a533efa93caeb28d7f97232858bdbbb41", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372006, "uuid": "e3a9701e-0928-47b7-a0b7-d89d890cd45b", "value": "T120F433C2E040BFB480DF0975424A585BCB3D60B1A25010919F7F44BB1FB7AB6DA19BEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372006, "uuid": "47285e1d-c0f5-4bac-a840-ded99e65c2c6", "value": "24576:ydJts+nMeMVBxe4V/yuPnLtitSZNlMr+e4EGuA:yd7nnMeUTe4V/yuPtnyrV4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372006, "uuid": "4e1f12fd-717a-4084-a2e4-2337f969f14c", "value": 789572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372006, "uuid": "44123abf-32e9-4fc6-b7c9-8afad0561328", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372006, "uuid": "4fa2d4bc-0e70-49a8-a2eb-49ebc7b8bc3e", "value": "Invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6194c8af-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372010, "uuid": "74c54059-e4ef-4c32-9a32-7360abeb2a1c", "comment": "Malware payload (Formbook)", "value": "0cd8c0654fd780bf5c0d48541627bc24", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372010, "uuid": "0ded518c-4134-470d-81cd-9c27fe194a6c", "comment": "Malware payload (Formbook)", "value": "0258971e7663cc278c796ab97e266ff8a5f56b239dc2714b2d68d860d88de7e9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372010, "uuid": "75d13ed2-48ec-4476-be0f-cd4defb4fea1", "comment": "Malware payload (Formbook)", "value": "b421fe1f9aba87e08da250c094a015fa76af87f9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372010, "uuid": "c0f4e26b-9e64-4e37-8c46-fac0c108d4d6", "comment": "Malware payload (Formbook)", "value": "cd4be584a6093704c49c69dfea22af90f823dc63a13a0465670f96dcaff83913238baaab029bc79036d456877bb65f83", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372010, "uuid": "7c10a121-38fa-4238-85cd-12e57d16f295", "value": "T192F4237AC486D63AC9AE10E46FA8330BCFEF486D1154B42D7B8EDB056630FE554E6206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372010, "uuid": "09721c33-c60c-4215-ad95-b3ea8a30825e", "value": "12288:iYXlp7DNsOJUiMO6N4KZNCeaKmNzLgNVnt5rK76hja2kBM3YqnhpQD4ej0qP:iKp7DyOhMbZMYqHEn7K7Aa2km3roQqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372010, "uuid": "16146ab8-0061-4e45-8c0c-8bb695701825", "value": 734587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372010, "uuid": "115608ca-9eaf-4b69-abf5-3b94881bbde4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372010, "uuid": "c8fb7f65-0c88-4066-8a86-5667c5d00c68", "value": "BankXadvice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b50be3-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372014, "uuid": "13f7a2bb-227b-4b8a-ad9e-1a91cb16f698", "comment": "Malware payload (AgentTesla)", "value": "36f6afde5296339a5bec4ada12a3f89d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372014, "uuid": "ed66722b-f6ca-4cfa-bfa9-88c16f7cb210", "comment": "Malware payload (AgentTesla)", "value": "02780d21d7d29d53c044d3ee8e721bf04f8ec20e963bdbef7e893c2f4cd8c0aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372014, "uuid": "df82e1da-f6d0-4216-a819-ada79152df3a", "comment": "Malware payload (AgentTesla)", "value": "6e815a84737aeafebdcc3f380fe5d17f1bca3a91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372014, "uuid": "222f85a0-5d15-42c5-a5b5-42e402003767", "comment": "Malware payload (AgentTesla)", "value": "38f601bf1410e1e0700e647ae3335b1546a8ca8e17d52a3ac0c69ec85de9d273666e8178c9d366140b05f0a86d3b0ed1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372014, "uuid": "dfae6f5d-90d4-4271-b6b8-f170bc1c9f3e", "value": "T133E42352CD37B6223E0EB698FBB6224271661588C4F3B5561E92C13747B214A63BF5C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372014, "uuid": "2e55a8b2-bd77-41db-b8a0-4bb36ec392bb", "value": "12288:oWdlafI7f5D3QTPxATiz7F6QM1oggH9jwu5LtwT:JdJ75maiz7c1ov9j1xtwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372014, "uuid": "5ba3ef38-de07-4122-8b8a-11e57f0c9f12", "value": 663033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372014, "uuid": "ab964ea2-6e4b-4a1d-81f4-a4cfe080b114", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372014, "uuid": "9c20f39c-d9f5-46e0-a1c2-a6572974ae47", "value": "Invoice_and_parking_list.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91ff9c8-556d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779406624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779406624, "uuid": "13b5890b-0724-4bd9-9d22-080a54cc6d3e", "comment": "Malware payload", "value": "d1725b5a74217afc54506d9dc91cb4b8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779406624, "uuid": "97db6f87-6dcd-4f58-a3fa-423a4c2f281b", "comment": "Malware payload", "value": "028301d695ca8918d856cacd951ae7fa54c6a9ab77edf975e1259fa243cc5b71", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779406624, "uuid": "0bb3854c-f3aa-49a1-9e2e-84a7f7f7f5cb", "comment": "Malware payload", "value": "bf7bc21f94432a74f43ae30a6f999225c78a066e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779406624, "uuid": "c6254172-173f-43b2-ae0c-5df4c32d359e", "comment": "Malware payload", "value": "48a9d639c2a6e52aec5fa93ff564d8209f80134653f81e2b6d9cffe7a31cb74d56040b6c2e3a102aec852b5b6f1d14b9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779406624, "uuid": "7ce7e41d-d091-4f98-93b8-ca2b91cfad2a", "value": "T17C8249ABFACC19A86EB643344E9FD0937186A39795C03972D0131A735C3DB86329C587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779406624, "uuid": "0cd9bb95-23fe-4c18-8d84-bd911808765f", "value": "384:swV2QoWn1G8UxsbW+32SI8LHW13T11PzVY/+okjM:doW166W+suW135FVY/+o/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779406624, "uuid": "2737be5b-08b6-43e9-9360-370d7e37855a", "value": 18385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779406624, "uuid": "e2174c8d-0593-4789-9cd6-116c81a86fd2", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779406624, "uuid": "2b72c794-b4a6-45fa-875b-64cd886b7658", "value": "Update.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aed5856-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779370361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370361, "uuid": "6916d4b5-3e4a-4568-9514-2b4943523c75", "comment": "Malware payload (RemcosRAT)", "value": "b512e18b16d177ac2a7b3bf64482e433", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370361, "uuid": "3f8076ec-1bbe-49ae-b697-6486ebba3da2", "comment": "Malware payload (RemcosRAT)", "value": "02e55f5c56a03b72d66e5c886a303c6c6b5b399a6231255a43c02b7efdfbebd4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370361, "uuid": "a3f3c36f-1cd6-4f61-8b3e-15805ba12439", "comment": "Malware payload (RemcosRAT)", "value": "3e8c471f4acce6e9ce27c8ac692fd835b9968533", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370361, "uuid": "02e910df-6d34-46ff-b95c-8a733c814b5b", "comment": "Malware payload (RemcosRAT)", "value": "8e0d9d51ff2b7df101d67d569ccc563821030647d2d5d1a17450c8774fd03d753e19e777bf5827314dc9958587ea43da", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370361, "uuid": "79f2fa84-fa3d-4b01-89b5-d1241887cec5", "value": "T1CD1533084832B0A594ED00DF10357BA6BE6C152E6D9F6FE39285B4A5111F6EF0E4DAF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370361, "uuid": "3320ef92-2bbe-4cc2-9c9b-f614aca85b10", "value": "12288:YoIqVOAD/zPWLszUZEV0thfYaQwGWmoQHOufAtqj6z6V3Vf1aZP9OZDpFc:JI6byIyQaQBNj6z6bdJpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370361, "uuid": "bc9b6bf8-9a9a-4815-95b5-a82a96d5973f", "value": 936114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370361, "uuid": "618d00fb-a81a-47a4-93b8-9a65c443194c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370361, "uuid": "f30a06f7-6b3a-4dbd-9307-bfd2fce8a156", "value": "COMMECIAL_INVOICE_AND_DHL_AWB_TRACKING_DETAILS.PDF.GZ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd55a62-5519-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779370365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370365, "uuid": "4dc9279a-f3be-49d5-afa3-93f2f1d7c8b6", "comment": "Malware payload", "value": "afee982f27396f6d2d65e6ad9ad7c88b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370365, "uuid": "c917ee43-bfab-45e7-a836-67cdd21f35c8", "comment": "Malware payload", "value": "0300aa23d62003766c3b5bed4d8ba8f1c55d88f4892e05cb64e504fbcba001e1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370365, "uuid": "e49fd4a7-2589-448d-9a81-9ae2984d3384", "comment": "Malware payload", "value": "c152198af31c91ef2705838d63404632bb9c9aa5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370365, "uuid": "4251846c-08ee-43b9-95fd-c0e6ebc63ac9", "comment": "Malware payload", "value": "a6ad0055a11cac30071f7ca3a46e7f5f6bcbd755453d3f9b1586b7624f7aaee8deeeb08aecd6705cefafbec58cd28f76", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370365, "uuid": "a09f5d77-91c5-439d-9df9-3f05f9e6ada7", "value": "T16E42B0F0C1118D67F320E0B9225F44B0690E1141EE7E918ED5ACE47AFF405D36AB7ADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370365, "uuid": "02e8691c-7826-4132-8fd9-ff002ffeef5b", "value": "192:aWjwpR9qbEwGwitQAlJuBKxUkTmGXfTV49GOl+oe5cUZHYs4GVcAXdhN9ioXRn7n:9jcnpwxe/yGbVch8TZ4OSmhN9bXRn7TL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370365, "uuid": "7205c001-a528-4413-aac1-cf8757fef94f", "value": 12239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370365, "uuid": "3d659916-6cb4-4082-8632-88dbfc243443", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370365, "uuid": "6edb8925-4039-4b96-bc32-42913bb1b86b", "value": "RXEXCXHXNXUXNXG_819384922.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea1658d-5512-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779367549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367549, "uuid": "f6b0c071-e857-425d-ad3d-d3232df6c4d7", "comment": "Malware payload (AgentTesla)", "value": "9f55d2cce500b4a76393e05d3593e1dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367549, "uuid": "2ba5dec7-15e8-4730-9e92-51fac9cd4548", "comment": "Malware payload (AgentTesla)", "value": "031287b694c9d71b24f7f654fc793372db71a6e02ca8b90e40ecfcc497f247e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367549, "uuid": "c4143565-0212-4fcb-a1c3-7169c764fb96", "comment": "Malware payload (AgentTesla)", "value": "99142c85091032528c180d91009baa1b7e79150a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367549, "uuid": "fbdf910f-d61d-4c9a-8a4f-ad5f45d1b531", "comment": "Malware payload (AgentTesla)", "value": "53bdb516aa5e8c8461661c672fee5220051a4de5206daff712d366762740eff8e3b7bfbe77e348d79500af832e92ac0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367549, "uuid": "fbea8316-e68e-4720-a403-40ac235baed0", "value": "T188153312FF97F34F766A42B81CC12892F7E4BC59CAF858DA8EDD52679CE44E8505A300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367549, "uuid": "cacfed87-f032-4072-aba0-3736e45a6d16", "value": "24576:mc5GQc7DYO4C7VjhlfLH9qsfF+HRsVZS1IEcys:j/W3JhVH9MRsVAOEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367549, "uuid": "a2f740fb-7310-4273-a809-631e5da0fb40", "value": 894454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367549, "uuid": "fbe26480-3668-48bc-abe3-d1cee4366518", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367549, "uuid": "f6156457-9ab0-409d-b88f-a4f5311c8637", "value": "031287b694c9d71b24f7f654fc793372db71a6e02ca8b90e40ecfcc497f247e2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edad513-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370368, "uuid": "99cd7b2c-c5ce-49f6-bfc2-99478fbf8c46", "comment": "Malware payload (Formbook)", "value": "f036bf3eb448279204214c3a8356ebc1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370368, "uuid": "693d06eb-8688-4023-ac5f-df5908310e10", "comment": "Malware payload (Formbook)", "value": "03285ad63d4fab7692f54c8d0d1f9d3c4022e1fee0b2878a0b412a714f412ff1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370368, "uuid": "4d9de563-b6d5-489d-96c1-b1003012dad8", "comment": "Malware payload (Formbook)", "value": "2daaca15936d88ce550c2b42f7577e640e99bd69", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370368, "uuid": "01df39fd-81bb-4cb0-bf3a-e20320e89948", "comment": "Malware payload (Formbook)", "value": "4158a7d4757ad9b233ee4f154d8785f934883ed7ffed0c954d67d2bd7c2158a2c8faf7e2b1cb5527d093007ab0136910", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370368, "uuid": "407b1957-c5b7-4e91-8529-1785c2d7e4b8", "value": "T168F423AE005ACF0A36EB6CAEA6F5CEF15403B284A9368B174514B2E7F7F55C9203F415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370368, "uuid": "80662a55-e1bf-466d-8b42-c8d24f4faae8", "value": "12288:sgWQbSRD+Lmn/fdcon/dw52ZPD7RnYSZdJOkpYJRyGw76pZQs1Z/fB2oeGmX7V6T:2QbY+Gxi0f5pYaHaQs7BLeGmXoUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370368, "uuid": "d11cdf23-98e4-4150-a687-200904db9570", "value": 734512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370368, "uuid": "9d41c378-8bdf-4bf5-b257-5a6782ee2010", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370368, "uuid": "b6fbbc72-7af7-43d2-8153-ee4331060fbe", "value": "CJE003889.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e47549-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779370371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370371, "uuid": "640e988d-6c50-4b20-8cfb-3a9815f12b2c", "comment": "Malware payload (MassLogger)", "value": "5a238471b8d181a765cfc6fff48d3938", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370371, "uuid": "2705ddbd-cae0-4a23-8511-32020bd773ba", "comment": "Malware payload (MassLogger)", "value": "0395d68f630504f3ed9a54bf720cda71b5d77a63cbe9a8fcdba45fb3f8e0925f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370371, "uuid": "87275736-026c-47fa-a5dc-ca9559044fff", "comment": "Malware payload (MassLogger)", "value": "9c7ba1aeea089db00aa1649a2a48b56610c7be8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370371, "uuid": "c1d2b453-6c5f-4fd9-ad53-d5b212ba401d", "comment": "Malware payload (MassLogger)", "value": "7ff6e8747c55319bd0668aff49c593d5f067b8434d42712441b2248749659ab1394078c25d1cc2bfc3490216ac9b8b37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370371, "uuid": "8fecf024-ddb4-4c12-bd67-432eb19ad429", "value": "T13C44761A2BE8A410E2FF8573D2B25125C6FBB5A346158D3E17D2E80A3E3E540DE16F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370371, "uuid": "ed516925-92de-4a1f-8a31-26b88407a63f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370371, "uuid": "28433497-2e75-4f4c-9503-79813649f986", "value": "3072:qUiUMI3VME4t2uzYsRXlbi/GN/q4eQ6YrsSL6nU10dKQnVb2QfDs0mZY/Vgaifb0:OFQf3aswy1nVb2z9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370371, "uuid": "0afe68c2-1b99-4cc4-9229-e24c747113f7", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370371, "uuid": "80e1345b-52e8-4592-b8b2-fbb56a2420f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370371, "uuid": "355e4190-3239-4e21-bdb2-112449a4c288", "value": "pub-4c182737706e41d29aee6cc5517f834d.r2.dev_aec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fb7f95-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370375, "uuid": "966df253-912c-49c7-8e4f-ebe17d195788", "comment": "Malware payload (StrelaStealer)", "value": "e216a55f794df5a6323c199dc39cf91b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370375, "uuid": "871c70a9-b232-414e-a300-b441cb0b3ea5", "comment": "Malware payload (StrelaStealer)", "value": "03bcb93a9baee8a220f441a38f67a3d1b3216fbd3238af15e0e0a25d94540331", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370375, "uuid": "d4ce38af-73e8-44a0-997e-48db7c5b3a28", "comment": "Malware payload (StrelaStealer)", "value": "7d4b0aff62c66fc3a18f68a63a05e964c8a99170", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370375, "uuid": "f5d6dfc3-8ad2-4e5e-a495-0c878bf88759", "comment": "Malware payload (StrelaStealer)", "value": "83d735fc33a131e2deae694f253fd51197039e18cf863ef66969c03180dce913ad63c441a778cc15749b7282d9ac192d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370375, "uuid": "1506f3c0-1433-48fd-95e1-11afacb40130", "value": "T18D45B0C0E9377FBB0D350ED102AF371A0679AA790F655C469ADE9E0F484AA88C4D1D1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370375, "uuid": "398509b7-25c7-49c9-8bf9-d97cc67dcff5", "value": "12288:aRT1ysRxY3hwMd8lJ/Gy0Gl4gMTOiQmb47rQT535aIq/4cR:kysAwm8ldongB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370375, "uuid": "4639fe25-9f91-44da-9177-6e6aff2606e4", "value": 1188398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370375, "uuid": "85bb7fe8-d707-48fd-a3ae-ebea78dd1fc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370375, "uuid": "c294ba6f-5ca0-4e97-bb8f-36dd23bd4702", "value": "1480711074957927617.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c5d863-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372017, "uuid": "1fdf06b4-a8a5-48c3-ad78-ce15e25248c9", "comment": "Malware payload (SnakeKeylogger)", "value": "886796e9a45a5079b454cd3e89b2bfdd", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372017, "uuid": "8e962aa7-23ac-468d-b0c5-0218fd671148", "comment": "Malware payload (SnakeKeylogger)", "value": "03f21dff2c90596c673278bf13b8242651dfa8239726f8a7fd2877159211c6c1", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372017, "uuid": "aea70d11-30c9-4b16-a298-94a374b06b71", "comment": "Malware payload (SnakeKeylogger)", "value": "b227d1ffc620a97e433e0c57248a07d16277391a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372017, "uuid": "848d853d-63d0-4e8a-bec5-bee0b1e308b6", "comment": "Malware payload (SnakeKeylogger)", "value": "220642a2e202b18ba6907991597a2384c6c434ccaf717cab7db95b1d50fb5ccae7c96fe4fb4d6296801979d1d9331b67", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372017, "uuid": "238599c7-3521-485f-a02d-e7f4c9ccd780", "value": "T1A3D42353ACE571C0CFF849D58ABA820B71E8F26676D12393E689361336F07A48797871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372017, "uuid": "7208e504-ee30-4624-a804-db7368bad626", "value": "12288:jp/j8LpokIfRT6hqE0cfhKGC/nS2kRS9fr0sszk/vxroIjk:NjdTvqKG3Cfr0Pzcv9o5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372017, "uuid": "04a61b6d-9ba8-4a88-a834-25680f6de808", "value": 604023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372017, "uuid": "eb732e6b-d79f-448a-b170-c380179c8435", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372017, "uuid": "dd7df673-f0cb-43ea-adc5-6f460c139bfe", "value": "XRFQ-11345X.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd15dda-54f6-11f1-a769-42010a9c0008", "comment": "Malware payload (SideWinder)", "timestamp": 1779355332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779355332, "uuid": "d57a9349-1ee5-466a-9d3d-bb2a1b3566c4", "comment": "Malware payload (SideWinder)", "value": "4a83420375c564b987d3dfbc073aa963", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779355332, "uuid": "6b6076b3-ac21-48b5-b2c4-0d35b136366b", "comment": "Malware payload (SideWinder)", "value": "04016d3ac1b30375de773a8fd63a4d7f60aa36ab5679b1714e2d98ac88979505", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779355332, "uuid": "485a0f5d-f6c2-4b2e-80d1-91955cac36ce", "comment": "Malware payload (SideWinder)", "value": "87e1c0a041f27a9c9faf85a915d67970de3f0661", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779355332, "uuid": "03d23538-ce78-496a-ba2f-be4e1186f6ad", "comment": "Malware payload (SideWinder)", "value": "2226eaac1ac63ab0e3c350d9834f8873ef406292b6887c3156bfc7c98b3c4ca80ca8f3aa3b318d8bcef7a3247d92dd61", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779355332, "uuid": "92dc72e2-c75f-4cb4-b19e-8d7c2bd192c8", "value": "T1D4A54A07E2A350ECC56BC1748767A772FA30B4694134BE7F5A94CB312E21E605B6EB34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779355332, "uuid": "24e8906d-f44b-4ef1-82ad-9c5b7d4d69ed", "value": "491eaa913c9a327e9a1b6edd586bcf0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779355332, "uuid": "d29740a4-654d-4ddd-8887-93b36c727bd0", "value": "24576:Pb2ubYfqSQvjcI4tgiFj11JlDnnccE4kh4qgAdw3CTj5+JNFR+jIIRf:Pb2ukfqSQvjc4iFfHTnccJkhc32N+NI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779355332, "uuid": "27dd284c-846b-44b3-af78-c965fb3a8a18", "value": 2084352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779355332, "uuid": "a25455ec-f34b-4c97-adf3-02f1696c62a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779355332, "uuid": "49d90d27-7a16-4519-b97f-a062ac2d6d05", "value": "RuntimeBroker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f3b0d4-54dc-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779344105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344105, "uuid": "917f836a-03b4-45e7-800e-5d35f967695b", "comment": "Malware payload (WannaCry)", "value": "5239d509cb289898b70780bfc4539d21", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344105, "uuid": "19a4b5f1-f88a-4122-95a5-29d675de4056", "comment": "Malware payload (WannaCry)", "value": "0412123233d9f2305c64612ff41fcf584416df6fa99a20939519591fad9ed8d4", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344105, "uuid": "dd148b38-c99b-4b87-bd4c-addc1488e9d1", "comment": "Malware payload (WannaCry)", "value": "c2105acb0e5cac1a086e9c19276a3fd5ce123ce8", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344105, "uuid": "6a9efaec-1c66-4c4f-a0b3-96a29219d151", "comment": "Malware payload (WannaCry)", "value": "c3c9690cf7c2e4212c83df04bb26d85934de667d932208959fd96b015c296fe7337eabe4066e6f6c712b4b239b4af5c9", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344105, "uuid": "b6c4bdb8-a769-49f3-a781-e2306b2370bd", "value": "T1AA368D167A404936C75DE6328DEF4B3D2FB9E642EE3243039A01931CAF5B7197D1D2A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344105, "uuid": "94791936-11df-4d31-8412-e101312156a8", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344105, "uuid": "962a9deb-d44e-45a4-a82e-dd49f0c5e16d", "value": "98304:DXDqPoBhz1aRxcSUDk36SQ+ReTwPZTQw:DXDqPe1Cxcxk3Zx1ZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779344105, "uuid": "0194aca0-5903-4efb-b814-c18fb574a669", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779344105, "uuid": "dc1c83ba-97b6-4280-8d11-6847b6fbf933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344105, "uuid": "06daecd5-b2fe-4724-b074-ba5e627d05ac", "value": "0412123233d9f2305c64612ff41fcf584416df6fa99a20939519591fad9ed8d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d5c074-552b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779377872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377872, "uuid": "4d7cee09-7b3b-46ec-a4cf-e96df8e8a599", "comment": "Malware payload (Mirai)", "value": "36223a3d8b6fe3087c79d25a2fd34ff4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377872, "uuid": "4de1d47c-8771-49a3-a6bc-e3457f2e2c94", "comment": "Malware payload (Mirai)", "value": "04e5685159715f5ce3a58681274423f997f06700549d4f236fab135dd3e4c880", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377872, "uuid": "f5cbfb9e-7bae-48f8-a740-c6271d8b31e4", "comment": "Malware payload (Mirai)", "value": "c7543f491a4b5b0b252ef5f975ab4eba5018de3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377872, "uuid": "f2dce75a-889c-44ab-92a1-c54a76c139f3", "comment": "Malware payload (Mirai)", "value": "33e5314243d80864ce445e31ed0ef970e58ef3417a4fe3a7e754b724707d19eaa5ee3e002d74dffa57746913238d082d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377872, "uuid": "9c8d2d97-bc54-4024-9cd5-c7891d88686d", "value": "T1F4F34BD7F801DDFDF81AE77748430819B130BB9250824A376267786BFC3A1E90967E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377872, "uuid": "cb60274a-2a00-417f-b8da-61ac29f7510f", "value": "3072:nIdOEESiVcB712fsSWQLDzzmZOVOjbiRLr1sBFykFg0:BEYnfsSVLLmZEL0ykG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779377872, "uuid": "e22464bc-8ae5-4ac1-b53e-3df5d7fba949", "value": 163724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779377872, "uuid": "45422f28-fa17-4dbe-8e4d-f26e4e59caf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377872, "uuid": "75733238-61d5-40c9-bd88-429f67beb6da", "value": "micro.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1c7842-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372026, "uuid": "a01f027e-98d8-4692-af90-1fe929e4731e", "comment": "Malware payload (Formbook)", "value": "5b62459fad5a8b79787d2c513dc1563f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372026, "uuid": "682c1d1e-98ed-4fa9-af4b-f0554bb2d13e", "comment": "Malware payload (Formbook)", "value": "05477291ff562218bc45db8f8a949a5f773f44ab3c3078dd15734f8dc8ae1891", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372026, "uuid": "dff6def5-0531-4166-b457-f9eb8842582e", "comment": "Malware payload (Formbook)", "value": "332682c53da97adff451d5b85432e69668572e73", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372026, "uuid": "58b15d7a-392b-4bc8-8341-57c552142565", "comment": "Malware payload (Formbook)", "value": "8f3600d0b66e0caeb969cd5916d8fc143c34894fe5d8155eaa4ac849e45976aca9b4b826355fb9aec7337cb043decf37", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372026, "uuid": "c6e730b9-190f-413e-8e00-25beae6df18b", "value": "T1A885F6D89E957252F513B23C2F278688975D0C33EA2B4AD91D8B80D7FA7EB4E8C445C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372026, "uuid": "32d0cc44-39b1-4ef3-94c1-c7d3f2a511a0", "value": "12288:XDD2DU6YasBZbnT9pf0K+Dg0I6d3oxsocunUt4IdkRIfYq8aYrmKx:X/BZbnJFx+Dp2UunUthdOsYrPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372026, "uuid": "cf1081c7-750d-4b04-bc28-3a60ecf39626", "value": 1769472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372026, "uuid": "823606f1-9074-47e5-9278-4380fc1a1d90", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372026, "uuid": "fd3dfa67-c7d4-45f9-9ddc-536777bdb687", "value": "Revised_Order.img.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d27b54a-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372029, "uuid": "956968be-9538-4d71-ba40-2c5129b04afb", "comment": "Malware payload (AgentTesla)", "value": "7e607a2d7a2d69326973c0ea3bdfb138", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372029, "uuid": "86688ae4-6483-4041-bddc-9df850196496", "comment": "Malware payload (AgentTesla)", "value": "05575771a33878dd35e54bfbecadc79b6780cbdd8dd4ab4738e255f8ac6b64a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372029, "uuid": "593ef189-d148-454c-87c3-2cc1237ce874", "comment": "Malware payload (AgentTesla)", "value": "401b4c78ec4b8ef5c99ab62e517540543d7df60c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372029, "uuid": "7112c53f-0135-4c58-b861-b7c71c590111", "comment": "Malware payload (AgentTesla)", "value": "dd5ac64861b6b15875f80ae86ec5b41e2f41c33a95e916165e603fd97dc23f1459b7ecc5c7917f4778afffe0a7b2d919", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372029, "uuid": "1470c066-4788-42c2-9317-d947d48e8cb5", "value": "T16A72E1A05F2889EF4F58A24E23277764CCB7D471319F8A5445994C0B245CDEB3A0F98E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372029, "uuid": "082c5fa6-b5c0-4ddf-8f6a-beb2094dfd27", "value": "384:L22eETT+Jzx4Tn+AcDgxUJ0tz5Ij1O/zpI1wve1cOt20:kETT+Jzx8SDPUz5ZpI1wve1cOo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372029, "uuid": "a813247d-c064-4c76-84f0-83526c2f617d", "value": 17403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372029, "uuid": "79f58944-87b4-4518-840c-39ac59db52f4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372029, "uuid": "b489e9e6-ef2d-4b4b-9419-4b88d2af07d2", "value": "SITHIPHORN_Doc2709202400000.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3503c0-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372033, "uuid": "f3ba28dc-802a-41e4-bca6-61ec2ac46e9f", "comment": "Malware payload", "value": "3c350832e09efc5640cb3daa359d0afb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372033, "uuid": "f22b20ea-4d96-4d97-9609-585b444860d6", "comment": "Malware payload", "value": "05680c0dccbbb0669fa66fb238626a68d52f1f48da8b298d0ad2b04ed0cbc6e2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372033, "uuid": "7d7473ed-e420-4ce1-b0a7-ffc25313bffd", "comment": "Malware payload", "value": "fa4eb3c5a5c13627a61f086bf71bb654b99d958e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372033, "uuid": "4764afd3-4de8-44be-94c0-b620bd72f92c", "comment": "Malware payload", "value": "7e8ceadb96d00c01072396696beca2f5d658898cf7b78fb7a058017afd943a2e5e927f4e8c632be1aa91b5878168b50d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372033, "uuid": "17293da2-071d-4ee0-8218-fa979cf57d47", "value": "T1CAB17E3B304642A1DB5BDFF893364C90884E5A4D3750FF0EA44B26774D186B79A40CBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372033, "uuid": "8bb59a3b-a892-44b2-83d9-4e6db5c43142", "value": "96:WtlGqGAZlk/zfay5yuiyMnVjYxE2r/RVMr/2Gs/lzjrVUViYL4bxNsx4Z:WtlJrZlTLBVEzjtjlzfVIt0xNseZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372033, "uuid": "f4e8582e-f0f2-4638-a9ba-c47bf9d7b591", "value": 5517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372033, "uuid": "e50df576-ec58-4288-817c-5468a9e172ca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372033, "uuid": "78e1d32d-410d-48d8-987f-a75f5af88ad1", "value": "KBRE2617390.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7735b3-5507-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779362583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362583, "uuid": "5764441c-b203-4eec-9de6-dc9edfae0927", "comment": "Malware payload", "value": "d5436bfea04ed8f6c62de1fed30213c6", "object_relation": "md5", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362583, "uuid": "26c84e60-1479-4085-8fb2-38b498fcaf72", "comment": "Malware payload", "value": "05b61b6cfd5408ef027d2729308e067616ee85e4295c2b2d251f33e49bfbb496", "object_relation": "sha256", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362583, "uuid": "38ad6fe6-f556-4a8e-82eb-0c10e3acf61c", "comment": "Malware payload", "value": "8cb225cfb4258cd195b2b9cba48025afedac2f86", "object_relation": "sha1", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362583, "uuid": "54e53500-bff6-4a25-b70b-e85ed35cd286", "comment": "Malware payload", "value": "4b6452922de51675e0be6928f3419657ea2f19117a32a64402a9f02f4e0a001dfa61ffaa798ba626a3e5da0456e37ea6", "object_relation": "sha3-384", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779362583, "uuid": "409de7ba-adae-4eef-a9a1-5e1d99faa077", "value": "T1A531E978C2EFA2B35284AD28FDFBA1691D9051DB507069C4B4013EC563EC33BF485519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779362583, "uuid": "97deb7c5-a182-40f3-87ae-5c2713557639", "value": "24:wYG0o5ExwHsYgkRDJgtQ4wgV+zhovq7cIKm3PrRqnRUhrnEb3preDI6As/06v:wYG0o5DTfd43+FS5cruQgbZre4sRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779362583, "uuid": "c1d1e07d-74b0-4fc0-bbd6-8f4682f7ee81", "value": 1754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779362583, "uuid": "2f5c08e8-99cc-4258-b1d8-23a91fbf4001", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779362583, "uuid": "36c92e71-6e9a-4564-94bd-b0ca142bbf28", "value": "2026-05-11-part-01-initial-download-from-suzke_com.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2f2f5e-550d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779365018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779365018, "uuid": "caf6031d-ca76-4c64-9757-aa83623bf06b", "comment": "Malware payload", "value": "1d0a20a97d284f4fdf9f4bc329148b11", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779365018, "uuid": "1841eef3-e791-42cf-a171-3f2f22cef13a", "comment": "Malware payload", "value": "05f1323a133dca5d02b4cc5ad0633ce95748db083bb61006cb171b07084e4206", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779365018, "uuid": "d2096816-09d6-406c-be0f-8874f4ce7279", "comment": "Malware payload", "value": "7a94a7d29f71466e2e5a18ea58503349bb9dd3eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779365018, "uuid": "e4942353-791b-4976-ac49-60cba07507fc", "comment": "Malware payload", "value": "52465e272d68be03f4257cb1b9957f1882d1a93167fe093569f1fa51caac5b322355cbc8d2a63aeb61fdf49d33128277", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779365018, "uuid": "17c1f521-d96d-4fbb-b6ae-449eb266f6c4", "value": "T17153C7C87AF3B4A0161360BF3C3BB152E56E9C50700D4269EACD756CF814368F57AAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779365018, "uuid": "d13b78dc-0838-42d1-ac12-a38a05243db5", "value": "1536:IJmts1izzOmJejxvtJIKdq5x5QL0uBx6wvA+OfKG9ik2F:sL1Mybk5QLj/TA+OfF9Fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779365018, "uuid": "2298a00b-e03e-4313-acb3-eda52d8ef9f1", "value": 63328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779365018, "uuid": "d79fb179-51e4-44b7-bb8e-eec78a164518", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779365018, "uuid": "2452ccea-c45e-4e79-afc6-3e496bd2413a", "value": "INV12178290128971290004.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71563618-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372036, "uuid": "00e0f11f-efc9-4610-a306-8336d41bf437", "comment": "Malware payload (AgentTesla)", "value": "63139a96decbaaf9d80b84eb70aa41af", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372036, "uuid": "fc4f0e67-28a3-405f-99c9-9b0807cc44e4", "comment": "Malware payload (AgentTesla)", "value": "05f4604f0e4c08bf7f8433ce93ae6f62166b8a14332f9ca45473b8a9a6490d5a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372036, "uuid": "29212982-ec74-468d-93d5-2fe428cffc80", "comment": "Malware payload (AgentTesla)", "value": "610cff6a010afbe8d010d1a07a20870c0460232f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372036, "uuid": "526ed067-a12b-440a-b232-6b326b156f4f", "comment": "Malware payload (AgentTesla)", "value": "85c83100774d2d5947b41410f22ec78c0ff3949eb60cf54e4faa1d677f8e3635f5848e62c2dcca0ce689394c49b975c0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372036, "uuid": "d05a4227-843a-447b-9340-7cd5b7341671", "value": "T1E3D4231019E097FE2FE7801245682697C83D31D688DE8E77D78D5BE9FD64E78E8401AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372036, "uuid": "df599edd-4fce-42ed-826c-bc172131c105", "value": "12288:auLUy7FK39hzFG9K38RLkE4iaAtOEi/GP7WMClxWuzDfYVfDKfA5pz:auhI39hR6K3mn4HBa9DKfA/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372036, "uuid": "03c309ba-2f88-41c3-81d3-8c51e0f0a334", "value": 613764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372036, "uuid": "f37b17db-5c10-4ad8-b532-a9236e88a4ee", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372036, "uuid": "821c9458-0008-4715-83d6-bdbb53e4991a", "value": "SSLOS2024070909.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9697cb18-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370381, "uuid": "9c13ac84-357a-4592-ad23-169adc323a64", "comment": "Malware payload (StrelaStealer)", "value": "9b22d21788b2e0309e341ff13b60124d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370381, "uuid": "da2ceaa2-dd65-4b9e-9e2e-6c1315dcbbbc", "comment": "Malware payload (StrelaStealer)", "value": "065bbcf2c8dbb4a0d0f924d93c30660b480c4803719d74eb403e0d7033a8b9cd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370381, "uuid": "ff0ff671-8914-4dc0-87b3-b88bd43edcb5", "comment": "Malware payload (StrelaStealer)", "value": "f95f24b691951521acbe3e8bdaee352b026422b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370381, "uuid": "327df11a-07f1-47f2-b9c1-62baef2aa8eb", "comment": "Malware payload (StrelaStealer)", "value": "0e991c2774f1f6399dd4eda7d35d59d00bebbe6393427dfe281ffd19d15759ad4726f81f9c60622d019823ae41983180", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370381, "uuid": "4d0d6d7d-cc33-4399-9b9e-1f6195e2b126", "value": "T1ED951B90553EAB5E7D7E424E08D2B7326FC6952329118C3AF78E424966035B73DB0EBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370381, "uuid": "b5429933-dd10-4974-8dba-72a79dcccb91", "value": "12288:TasqGWZnIRxQIrQCFq31UFxPW1ATqnGlVRu1wJN/RKhWl9kEiSmc5wQgO//M58hc:vr8tQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370381, "uuid": "00fcb13d-3779-485f-a4aa-f34aceefadbf", "value": 1927664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370381, "uuid": "bcd13cf0-65e5-4223-b678-def618d8a786", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370381, "uuid": "4befe3f0-1c07-4172-8a33-94ad0dbb1a22", "value": "53453084618093317.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98abca89-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370384, "uuid": "c46106d8-62fe-4454-bb22-989725ea6f7c", "comment": "Malware payload (StrelaStealer)", "value": "8941513bc2fe3e862078787747185b9f", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370384, "uuid": "55b036b6-66f6-4ad4-bc50-a7a2a7696786", "comment": "Malware payload (StrelaStealer)", "value": "06cb4771b61cc7f4f91c3c4860e0785f129c556cfb1f8039bda2ab78a89081e2", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370384, "uuid": "8ec9e63f-f2b7-4a8b-930a-bc2283ee1299", "comment": "Malware payload (StrelaStealer)", "value": "57b095ade760782267f921c93ba3701ff31e7cc0", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370384, "uuid": "0577f533-9dbf-4a62-8902-c4c02e9ab0f6", "comment": "Malware payload (StrelaStealer)", "value": "917ec1139753700dffa0379d7532563c91a71351c9d71b3aba2466c6e75544ee9a5e2535477212c120ccc16156eac9c0", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370384, "uuid": "d087a918-bfa9-4ab4-91a5-1e267b736b92", "value": "T1885423CD167922BFECBCDF1302990E911EC5ED35C917F9A078A0405EA855BC67DB5E20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370384, "uuid": "bada0544-5103-44d6-aea9-2588d1c03e01", "value": "6144:BSC+9Fd6ZbaiWywbvoi4tzMpxuoPcb0RwwL+G+MFGbO6apc:W9Fdoaiwvg3uiGOa3pc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370384, "uuid": "f1974d17-722c-4844-a07b-3d81d4ae1374", "value": 300809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370384, "uuid": "1e9919f5-4b9f-4081-be01-a36499d882a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370384, "uuid": "656c45f9-55de-4999-85e1-e4fb47f60df7", "value": "Rechnung__57956.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750a664f-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372043, "uuid": "cdffc5c6-8004-4b2d-8b04-1eb883387f8e", "comment": "Malware payload (Formbook)", "value": "602fe84b324b9f92a46d95281aa1de9e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372043, "uuid": "c6d7f2d8-2cec-430a-8a13-c9166fb91fad", "comment": "Malware payload (Formbook)", "value": "06d8b23d99a621958670ec63e95de3a7e3d679e26d1defb820f0019d3508d3e7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372043, "uuid": "1dc68214-c70e-47d9-bfe1-f22036446160", "comment": "Malware payload (Formbook)", "value": "ad553aeca2eb12a5d026aa51a53b8eba7057baa5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372043, "uuid": "4eb318c7-754a-48ce-9119-8cacdb6d7a13", "comment": "Malware payload (Formbook)", "value": "89f4aff5a1209ae1a327c1e948e9983dd640a3b7462b0bb8c29c29e0cb6dc1906857c4cf497cd90f8fa19bb1b0e95549", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372043, "uuid": "900b0ed6-0e60-4015-9747-3af7f1cb856c", "value": "T1B50533AEBE211A9371E74087B65AA4713FA1C00CBCABFB869DE7C7143112C9538D5DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372043, "uuid": "1c5093a2-2953-42be-9542-e70099f6d0d4", "value": "12288:ezxQckSCIJI2PwxyDm+Y8gE5KOsiE7KwGF75e4ORulwGPrfQh0OPeClgjWny/Ogi:ezKs/w5f/EMiGtQX/mGjm0OPbyCyA0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372043, "uuid": "02d76a29-cd75-407d-b71e-307a6c7b838e", "value": 870179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372043, "uuid": "941209ec-a06b-44a1-ab6e-c6b390ac7de2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372043, "uuid": "34ee9cbe-3966-4ded-8f4d-eef4f045ac1d", "value": "QQ018252-1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946bc2fe-551c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779371666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371666, "uuid": "2987db14-0b98-40f3-932b-a72b382c8b6a", "comment": "Malware payload", "value": "b6f611c1b8bd0f2efb00eeac9c1d12f4", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371666, "uuid": "32b57970-6782-4ddb-a841-9e170f35c2c9", "comment": "Malware payload", "value": "06df96657e1f40339f0b9efd223f983976643f59ed61fa346b0a4f15f0bc3088", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371666, "uuid": "56251dbb-90e3-4d1b-9a36-1fc0585567c8", "comment": "Malware payload", "value": "cedf75154571187616d922a6a0f3154c2256b3f3", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371666, "uuid": "46a6d0cc-2dbe-4e9c-a986-1c8288d44aab", "comment": "Malware payload", "value": "7809448428044536be69508aa6f14e9779eaad3deb2ca069bebbda4753ff34464b5e027e452573501d3fe224ada00f8f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371666, "uuid": "d7e4081f-9fae-40a4-aa08-c1018bec9274", "value": "T13EA16E6906E6DBCD6C29401780EB524F8AF2238F72FCF5EC4C649248D51B7D48E01894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371666, "uuid": "6da4505b-3249-44b1-938b-f5886f164d94", "value": "96:wkhrI+rYYFce0FGDNDn4OLcjh/llJD/YvqpenZVlLlUVQRq/HBdG4j:lrgnecGxDdLwh/lzD/YypCVlhPyhsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371666, "uuid": "538f45d3-3d74-491a-8c09-7cbfac86fa83", "value": 5004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371666, "uuid": "492f07c0-a023-4c1c-a963-ef421372deca", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371666, "uuid": "5766c353-c92f-4fd0-aee5-8e90e15b5ad6", "value": "DHLXExpressXShippingXDocuments-pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770b821d-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1779372046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372046, "uuid": "a31628af-831c-4613-b252-abcc1c506db6", "comment": "Malware payload (RedLineStealer)", "value": "88e39ff5e4b99879ecba5e91dd6dbd98", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372046, "uuid": "e3a7eee9-0319-480d-a178-bee9dcbfad68", "comment": "Malware payload (RedLineStealer)", "value": "06f14d2253ef957c71afe7fe8a37ced7ac6c02fb51b15df6d646338efd2d29e7", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372046, "uuid": "b1fa5283-0eb0-42bf-9aae-4e0df9125be3", "comment": "Malware payload (RedLineStealer)", "value": "777a90b9eeaaf769dc0f901826f3e9e209773253", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372046, "uuid": "0be31567-61ed-4492-b59f-fb0fdbcbb587", "comment": "Malware payload (RedLineStealer)", "value": "037734642feb437f85f45f6265ce370b8993a823ebafd74e6b60c968b7b8f0047bef55357e4d727f357dc982855afeee", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372046, "uuid": "3dc7bb79-81d6-4c06-9e86-882b26ee1d1d", "value": "T1DFE42322160783B3B16830B0D7BB9B39B6D177124DF34893291F9A19DE7CCE909BD199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372046, "uuid": "b5032c8e-c8aa-4301-a479-cd56a52f8984", "value": "12288:swoRMfI6xHQMa3xZdz8DUqtI02bCIJgxHi+2W4NDlDQ3d1DXLpF6DvMdc+:swuMg13H54BoWI4HiTWI21DbpFfdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372046, "uuid": "004f7894-0945-4c3a-bb35-595b546ba610", "value": 706455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372046, "uuid": "6742f1c1-909d-4574-bd91-faa07a8de4b3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372046, "uuid": "dbdfa9fd-39f6-406b-85c6-625e9e7a11ec", "value": "ShipmentXNotification.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d33ebc-5511-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779366781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779366781, "uuid": "12746ba8-a434-4e03-9d5e-202eda3591f7", "comment": "Malware payload", "value": "60333261f40321ed28f324c5c193d13d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779366781, "uuid": "b2452318-5fa8-4fc0-8540-394092b265d2", "comment": "Malware payload", "value": "0712ed6098a176ec8cb29b7a4a31b0bda699210fd44772b7d5060535bd3ccaf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779366781, "uuid": "1c33b2c3-0232-40a4-b222-a1f941554e1e", "comment": "Malware payload", "value": "533f98ca551078c54d63076a8a8881a6985c13ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779366781, "uuid": "822d322f-ca58-4b5f-a7a7-85de7c206d5d", "comment": "Malware payload", "value": "e38beea3945e4f9219b547a4e3fdc6ad5aa2df6c02ee1ab6363f1c29f78154a8b30fdd41450d843449c81af0f004789d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779366781, "uuid": "a68a51bc-51bd-490d-be45-94869861c8ef", "value": "T11C364A13EC9549E9C0EAE23189669212BB71BC485B3223D72F90F7382F72BD06D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779366781, "uuid": "a3ff4c02-ce51-41b2-bf33-1687ce92bea3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779366781, "uuid": "0a0bcca4-3e85-4bfc-91ef-e74465400740", "value": "49152:bqoCqyeO0X+O3sajjBqmMuKHZ1t0/uQ8CMQPCjHI/rmAfK+K9KY3BpqF5E:bD4UStTtjoiAkrmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779366781, "uuid": "66ec02b2-e796-4bfe-99ce-5b9d4351e734", "value": 4943872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779366781, "uuid": "8df25276-5f47-46ab-a3f6-83833dc8e938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779366781, "uuid": "5faea6b0-385e-4597-a231-6c3c8588c798", "value": "land.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792bd39c-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372050, "uuid": "63687a51-f61e-49dd-899c-11678e346d5b", "comment": "Malware payload (Formbook)", "value": "d658c550efdd9d95db9f8f2499877799", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372050, "uuid": "347762c9-178f-4cba-baea-377849e221f9", "comment": "Malware payload (Formbook)", "value": "072ace4562b16921c5c2bae21e52d07fa4d59dfbbd6ff94a2f854622936e326d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372050, "uuid": "bbf142b1-741f-41e3-84dd-076df5e8efc8", "comment": "Malware payload (Formbook)", "value": "cbd77a8bb69fce151477445974db34081dceb931", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372050, "uuid": "af85da8b-3487-4565-85e3-353456d0bc87", "comment": "Malware payload (Formbook)", "value": "39c910c47d5154db2bf1cf3d0f561ba4473b413d5c2db0baf6995bd3f73d3d2bbec16102ec3d9822c609edf6e01683f3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372050, "uuid": "12038f24-5df7-4061-a399-4a498ffa2cc3", "value": "T1BD4533B3B209C0496CE1F07A355D9E0A9459F109A78E9863D3C78AF75C799DCA8FF420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372050, "uuid": "7634b693-5b74-4911-a144-a06b8bc404d6", "value": "24576:2GRPoBvkE8JMpd9xuFrEJ6C7G8KYnVARoyUtoUO0zenfcaEGNKb8dV9GEB:XF+v1sYd9J6C7rK4AOOjfhE8KU9lB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372050, "uuid": "83399aef-3677-4115-a5b8-a1726fe37c39", "value": 1208744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372050, "uuid": "0527e87d-34a6-4b84-9e41-71643850775b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372050, "uuid": "d6fb50d5-a553-47ff-8c88-f3142adda3b3", "value": "KonfirmimiXiXporosise.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd84acd-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372056, "uuid": "cdb7e31b-6407-4a22-bf8a-26ec56586e6f", "comment": "Malware payload", "value": "856c79d605d8a70ed840620faea41861", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372056, "uuid": "f489c859-b4bc-493e-bccf-af7cb3dde30e", "comment": "Malware payload", "value": "0798234f47d4cb15c7e936788d2f26a4f8e9bfb6f033c6122cbeac87dd411a58", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372056, "uuid": "6987cecd-48e7-4542-a5a0-a7daba2f609e", "comment": "Malware payload", "value": "aa587ea8e3a0365721ab3e6583a6334e15ab9b3c", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372056, "uuid": "42d40f51-c5a5-43aa-87f7-865dcfbece9a", "comment": "Malware payload", "value": "f7d186c7276ae68973ed6346bedda273afddb8ee739f64c54b1441ce5182ed18cece6d402292f73daf47d992ba024ed0", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372056, "uuid": "828a4f80-6996-435d-adec-834b39fef55c", "value": "T18372AF6DA4A440ADD30A50F8210D1054F7ECDABBB5A37D1FA224753C40756DECFA0F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372056, "uuid": "1a85dc50-fb57-4e78-9006-fe8c1cde10ef", "value": "384:tyXF4USWxs8PL8wi4OEwH8TIbE91r2fRjJY8vi3LD+ZFI:tcFsy5P3DOqnYJF9vCLD+Ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372056, "uuid": "a8fc21bb-b114-4e7a-b3b3-766a7e293df2", "value": 16421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372056, "uuid": "d550d979-62d0-4752-9a36-637a30ad5691", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372056, "uuid": "c2855bcd-799c-44bf-a9f4-c7fbe3789066", "value": "Quotation.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eec5725-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372059, "uuid": "762135b8-bf31-4366-8528-3ff12ebcea97", "comment": "Malware payload", "value": "c8fa9fc4b9b120a49c57529fec79ebaf", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372059, "uuid": "5684ceb2-2bf1-485c-ac18-dd7964361cfd", "comment": "Malware payload", "value": "07bbe591b1891c0def9ffd59ab56f60d1b8188b3645f976407085bccdaf334cf", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372059, "uuid": "2e8affc6-12bf-49e4-947b-39b72378c646", "comment": "Malware payload", "value": "9fa9e175acfa82928770d37577c320bc1708bd7f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372059, "uuid": "1360dac9-fefc-4d40-90f3-ca95b27a3c86", "comment": "Malware payload", "value": "92d7d1ce9d29cf5fd058b07b6d93b5ebf4a17e0d5b55cda2d90c532d2d91d2921c2b963fc5db988a782a989e3e4e3c64", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372059, "uuid": "316fd4d1-4933-49be-b069-4ec0c78e93c4", "value": "T191E433986E329DDE19B2286FF420121522810113551B1AF4BA32D2E277D89E0D7FBF5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372059, "uuid": "a8734a39-2b8b-45b8-bfad-c075ef57339d", "value": "12288:/ig1zqWOB4d4tRLXLoNJP7GVC/QvC6G3c5qVjnFTlfk5YZ/wQQYI+Zmc2:/x8CKob7GVmQSPVLllsQlbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372059, "uuid": "da3703d7-bf10-4759-a7ee-3ca5530d5a8b", "value": 657664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372059, "uuid": "4fb81f0c-99c9-47e8-abc3-c52ef44fb5b5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372059, "uuid": "bae1f231-1e3f-407e-af4c-0b38c033dc82", "value": "PURCHASEXORDER-6350.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fab873-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372063, "uuid": "4b91e122-b727-46ac-8849-ce122e0ebd05", "comment": "Malware payload (StrelaStealer)", "value": "13084cff9704f4597f6aa718a193edbc", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372063, "uuid": "19bf21dd-3cc1-4232-9deb-0d7960346db1", "comment": "Malware payload (StrelaStealer)", "value": "07e66e2a5547ebafe97f4e96027e66a3dc3455829ac088bf5f267df979ee1a9c", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372063, "uuid": "c4b65a5f-9916-4677-9d2f-3f122780927c", "comment": "Malware payload (StrelaStealer)", "value": "b207e73d27af32a0c42819ab5dab705f92caa5a4", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372063, "uuid": "35f1993f-074d-4590-be2a-3b7502c089c8", "comment": "Malware payload (StrelaStealer)", "value": "952f8e7b5b7cca7d1ee77d7d87099a258ac70b7329ff6bb7777ce13cd360d0ab91951b89e88957379d8b579a691de808", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372063, "uuid": "dedc91f3-2056-4404-9a56-0c4a49db9121", "value": "T100016827742EA46DE937F130C95706C3614504921B25DB3E831D3F548882B81EAC6E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372063, "uuid": "eb3acd34-65ff-4813-b371-a47fa8b7777c", "value": "12:5jHHifChUO1Swnko4uB0NKmq6D1Ub9bzMHo7tafnXn:9HHiKWOkwkoT8gJbIHo0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372063, "uuid": "59b677eb-26ad-4466-ab92-1695d2e87462", "value": 657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372063, "uuid": "e0526173-783e-408c-b90d-a9afd160e5af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372063, "uuid": "272c1c67-9745-4498-a571-390bec08aa20", "value": "Rechnung_03.07.2024_30001751422.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831011ab-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372066, "uuid": "8ccbc502-fb14-433a-ae29-3f317654de92", "comment": "Malware payload (AgentTesla)", "value": "38ddac7f3e985407a02ead0185194348", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372066, "uuid": "7775b06d-24af-42dc-9dd5-e703e589ee5c", "comment": "Malware payload (AgentTesla)", "value": "08017920bd6291cac6641931231a73a1412929adb4561c916e5d21b0afd5a086", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372066, "uuid": "28a4a754-4825-4bf4-afc2-3194c6eff0c8", "comment": "Malware payload (AgentTesla)", "value": "163f5f46151dc3dde893f52a77a51df49d802551", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372066, "uuid": "b5e33890-55a3-4a89-94d1-8f8e3582cd67", "comment": "Malware payload (AgentTesla)", "value": "a4bae2ec45f29676a9cdf776b398afa39a8d7e22a9d760d42b669290af61afec08c1ee4a1f15e3eea399be55feef1974", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372066, "uuid": "9f221b54-2992-4de8-8dee-5ee0edef0bb0", "value": "T1F2E4237302FE5F8D51C00E61C993CB1EC19F27219272DF9E2653BC9861ABD2217DB989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372066, "uuid": "4f0e2297-a1e6-402e-bf0d-160b4f9e1bb3", "value": "12288:kL1TroolsBbhrDK7IX3pCqKcNTIIeE5hH53Ketf0Npj+KE5fw4nvPkcY:kLZr1md8qpCLcNUQ5htFf0v+35Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372066, "uuid": "3b9dab8d-6c03-462a-9ab9-ce1323758056", "value": 662426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372066, "uuid": "f43b7218-5d6d-458f-a872-1e1e86e549d0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372066, "uuid": "ca75f7a4-3c27-44a7-a114-013f1f874872", "value": "SCSP24071586PI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850b8a21-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372069, "uuid": "12310500-8883-492a-aa18-2e1211fea219", "comment": "Malware payload", "value": "cd8289a86da3c2718166ea602c695c8f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372069, "uuid": "c027b599-1b93-462a-8762-6e245230c2ac", "comment": "Malware payload", "value": "0823ea188c45a75ab720ac271f51b5dee43997827dc452c1b8f5ae648f0fbd80", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372069, "uuid": "cb682c62-7d35-4c4c-8de1-187b528b821a", "comment": "Malware payload", "value": "33c882bd8bb643d4a1483849d61469dbb7b2f2ee", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372069, "uuid": "71138397-3d9c-4519-a8e3-12951d37b297", "comment": "Malware payload", "value": "e876733fc143c45970934c98603fa2bdd765318655f3d4fc57a2b8526b4a11422cf4a8c116cd4737feb46a596dac9536", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372069, "uuid": "84d60a4d-1d55-4683-b4cd-8aeb9825f37b", "value": "T1F0515D5FDEE9EB24C664073BF810C349F710F62656290212E01D7C9670980794CAE7E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372069, "uuid": "3090e258-85dd-4095-927d-367b4550839c", "value": "48:9WEzukxi1YbltjASXE7m//Gu9SdOH6XQy15/QilZaY5BlIRHiPkbg2sEr:HsMlZJ074X9SQOP5z95BlIJM05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372069, "uuid": "68efbe31-eb6d-4a72-800a-ead9aea31bce", "value": 2558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372069, "uuid": "3f5b7967-b4e0-433a-afbd-e070f0f3bdcc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372069, "uuid": "ee6eae7b-10f2-42e5-81f2-e34f0f2f980f", "value": "DHL-CARGO-7897_DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac36e1c-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370388, "uuid": "04d4069c-79ae-4c2b-9c63-7879eae11326", "comment": "Malware payload (StrelaStealer)", "value": "11a4d75d048bbf1d2d6db8f6368c1d18", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370388, "uuid": "6f7efebe-d42e-49ec-b74a-59f7a0f603e0", "comment": "Malware payload (StrelaStealer)", "value": "0831046d3a95c15f284a8bdcee3ab2f1b625e08e8c9748a13a5c5b8e8792e774", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370388, "uuid": "6097391a-be25-405d-b774-23b37b916280", "comment": "Malware payload (StrelaStealer)", "value": "cfecfb11bf4e71a356d990e8abf68178dde10354", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370388, "uuid": "9cfba278-1904-4e25-8590-39fa7b038190", "comment": "Malware payload (StrelaStealer)", "value": "3351c1606e870e7e9948b65741a612ed28d1f899a43631041ff314caae5f2f2ed94e565872fb691fe0e11d0ea45349fd", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370388, "uuid": "0f19c572-793b-4379-8bf0-f08ad1826a75", "value": "T1A054229C1D7A78A5FE45F8077CBBB9662EAD51933A048D4001B973F37026B305964FB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370388, "uuid": "a403a081-3bb5-4d5f-8eff-a282df4a0336", "value": "6144:rpF8A0nsLacoagmAjthfH/SnWp9fJhoTy+KM8:rpCrsLjoanq2rKM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370388, "uuid": "0408a8e0-abb3-4660-a52b-bcf754c8686c", "value": 282568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370388, "uuid": "28830d66-95af-445e-83d1-f060efa99395", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370388, "uuid": "432048a3-4eca-43e8-ac7b-d5ca214eb056", "value": "R41112609.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87257045-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372073, "uuid": "ed4e4ca3-e134-46e2-964f-af479737fd09", "comment": "Malware payload (Formbook)", "value": "e6c4c81dbde3b3bf07d9b50abfef4733", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372073, "uuid": "eeccdbd3-cdb4-48a4-a930-3448910e39f0", "comment": "Malware payload (Formbook)", "value": "0854c21ed7648b1d45e780c75bf6dc9e72858c93caf2828ff5af718c21f63f13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372073, "uuid": "57f9f344-985d-4631-95e7-d7c2e1cde3a3", "comment": "Malware payload (Formbook)", "value": "5a2ba3fec008c502f31ed345319c0099e260f080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372073, "uuid": "4933a055-de32-4196-b89a-1942681acc9b", "comment": "Malware payload (Formbook)", "value": "1c0ec13cd43b629db67803bee3319016b447dbb726366803fd80bbc363195fc6a21914a47b594dd397b47bcf60b1816f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372073, "uuid": "328054ca-94d6-4135-97c8-9c62b3309a04", "value": "T17C656A0323BDC0E2FE9E7D720A56A31146B86D560132E51FD25F3DE9E973163C22A6D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372073, "uuid": "3369ae2d-478d-41ef-b26f-06b605daa514", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372073, "uuid": "216faf41-b338-4ee9-861c-87a94af3828b", "value": "24576:lqDEvCTbMWu7rQYlBQcBiT6rprG8alYSJ6xsPfug/l5h:lTvC/MTQYxsWR7alYaPf/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372073, "uuid": "0667687f-2f5a-4851-afbc-d1717731f939", "value": 1468416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372073, "uuid": "796b43b1-38d9-4065-b20e-f298269d8610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372073, "uuid": "4b878f69-d667-4d7f-9bb7-b2cebc743d40", "value": "1012024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d00336b-5519-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779370392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370392, "uuid": "a0137ddf-1efa-4128-aeca-ca378cf5f159", "comment": "Malware payload", "value": "3f04bf41474da2df2b19df3044649f71", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370392, "uuid": "c93df399-bb07-4638-8501-2111e3c19657", "comment": "Malware payload", "value": "08b7499e8034931eef9e68586f70ec2ead315702668018762f2aed56ead31b06", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370392, "uuid": "09e260e7-c2bf-4658-beb8-565a3cc25b07", "comment": "Malware payload", "value": "2c56890ca87e3ad2bb52929de98c5047c5b9447b", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370392, "uuid": "bbb8259c-b66b-4f3c-af85-8eae7f848b38", "comment": "Malware payload", "value": "309b8a939ed9a045b85484b54ac4b4466cea98074def772bb3a4afced407ec468b96f4d59787ca7efad58b886567db19", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370392, "uuid": "ed96b756-ffab-4f30-996e-206bdfe18434", "value": "T16985D01373DD8361C3B25273BA25B701AEBF782506A1F96B2FD8093DE920161525EA73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370392, "uuid": "e8e1b418-c497-40de-aa2a-a57cf9005058", "value": "24576:vtb20pkaCqT5TBWgNQ7aMaIUw/3Lm4ODkQu8ofM6A:sVg5tQ7aM1Uk7XUvuo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370392, "uuid": "2859cba4-0c29-460c-8162-d5d2ab7f8c2d", "value": 1769472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370392, "uuid": "a07caeb8-7822-449d-a03a-4d55a14b8b1c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370392, "uuid": "7c657d58-3ce2-438d-ad4b-13b9b1e89988", "value": "PaymentXconfirmationXforXIN311197XIN3114590.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce4dfc2-54db-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779343736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779343736, "uuid": "934f187c-5d87-446c-b580-338464d75e64", "comment": "Malware payload (SnakeKeylogger)", "value": "ff50e75d92243494fcefdf1508e301cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779343736, "uuid": "d7c94e87-4f8a-48f6-9b0e-5b41f2e21ac8", "comment": "Malware payload (SnakeKeylogger)", "value": "08de477d3adf5b2f92db3b7b83398e122b3cf76eb4e9fffb1898563458d5b31a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779343736, "uuid": "3586dc22-b4d3-4fdb-9f13-38bc1fd99001", "comment": "Malware payload (SnakeKeylogger)", "value": "c52498c870cc599bc58b947bd74bbf0c05c6c6f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779343736, "uuid": "ca9eec9a-bfb3-4fbd-aa40-63a21ff739bd", "comment": "Malware payload (SnakeKeylogger)", "value": "bffe14c0edb4a60f31c8f964d22a8a1f521885aac686be9f4ede414dda45aa1f59d1faa68d7e28ba21b5be2c4cbd73f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779343736, "uuid": "8fdaa42f-59c8-4f24-bd8e-a415f9213bf9", "value": "T127051298A21AD823D6925FB45D31C3F41AB46F98DA21C30B9FEE3FDFB43A5A01156341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779343736, "uuid": "ee20861f-0dcc-4ad6-b0a5-ba682b28cd35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779343736, "uuid": "2c5af46f-9c33-48d5-956e-f429f682487d", "value": "24576:p7hwZt88k/OlhUKxsx0lYho0sM+LZL9aI7Rs8x:pVw78Ka0lYhoFMgZLgAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779343736, "uuid": "2d3bbd0a-d623-41a0-bd50-471974b51345", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779343736, "uuid": "e97f1198-a802-4388-9d1b-d9999d1e19b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779343736, "uuid": "e8dab9d4-d269-49ef-b53f-c214e42134a9", "value": "SWIFT \u00f6deme onay\u0131.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c76f369-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372082, "uuid": "e462924f-d9a2-485c-8aa8-5e3b017ee421", "comment": "Malware payload (StrelaStealer)", "value": "6bd73697acff5454234f3b4cf48f1a53", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372082, "uuid": "30e8942f-a5ce-4fc3-bbb7-fd8a1073c349", "comment": "Malware payload (StrelaStealer)", "value": "093a56f623c12c049ac23634c42b38f764c1768ba25e56304806f2ffb15b23bb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372082, "uuid": "b0ed579e-efa9-4cf7-9a2c-650713a6e750", "comment": "Malware payload (StrelaStealer)", "value": "c4d38903562b24217eb69fb7dceb89cefbb83d65", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372082, "uuid": "2cf50dd5-46d3-42a0-b122-9a1e552fb614", "comment": "Malware payload (StrelaStealer)", "value": "8c21cf5dcb67bf3fe67affb7bbba84afe278be35b9af3befefd02df00cb80e1d63fb456509e3a77aa6dd0b2b8d3e8a58", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372082, "uuid": "b6cdd87b-28eb-472f-888c-9ae60b0eb48c", "value": "T11512E33CD337AFB5EEF812B5AA713840890B1EC623C85418B1667188F4DC9D6159BF9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372082, "uuid": "bfdbfa4e-caf9-4dc4-a9a2-7684b4040900", "value": "192:roAIf7lhnUol7f7PWGO4s35nN8bFFsgWbJSbFsQ/gbp6AmmktAmnhJZEfk9gbqse:kAIDDnt7f7PWGO4s35nN8pFsgWdSpsQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372082, "uuid": "48598a82-21d5-4897-bbbf-d7878dbfc403", "value": 9325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372082, "uuid": "1af946aa-4104-4b68-9f0f-c617723e78cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372082, "uuid": "e5564593-b998-454c-bad4-811c740bbdfd", "value": "13977903287507854.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f236af78-54e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779346053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346053, "uuid": "6c8eea23-fff9-47b3-8f79-9878a0326ceb", "comment": "Malware payload", "value": "60a704aa760a5b95063d9746ee843939", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346053, "uuid": "8ab6a867-a7c8-4057-bd1c-44591e8a88bb", "comment": "Malware payload", "value": "09501335f99022b943cbb633eb1cb2df63518390c26408e260f7302b08f4a57d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346053, "uuid": "346af347-3bd9-49f3-89ff-46e72a19b626", "comment": "Malware payload", "value": "cb07406e4decd28a38e6bbdcdeacf5e40e9130ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346053, "uuid": "87c98b29-3e0c-41b7-a586-aeb23519f628", "comment": "Malware payload", "value": "2fdcb5822c5ffda54ed7a0a6bfbafabf1a8bf93e7b6bc340f21ae9599fb522492a628eb050f9005071d28284d3255cb7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346053, "uuid": "694aab90-0ef7-42c7-9af7-350d11594df1", "value": "T19E1712256FFC4B018E70160804B5DACB2F769DD588B1B5CAB2CBF5C22F36C9D166B648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346053, "uuid": "8ce156d1-f0db-4ed6-a0f9-e56da60ebf76", "value": "49152:oSD3xbHSD3xcSD3x3SD3xESD3xQSD3xmSD3xvSD3xCSD3xBSD3xBSD3xYSD3xQSZ:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779346053, "uuid": "8d72f569-6a01-45b6-9547-effe7c9953ff", "value": 19414189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779346053, "uuid": "f295691b-6076-46bb-9c9f-6746e8763552", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346053, "uuid": "61a38c6e-c273-480c-9591-2ccb01a47dab", "value": "transcript.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc19e01-54c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779333080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779333080, "uuid": "fe42d24d-4fd2-4d5d-b080-4a5ee1c6aa2f", "comment": "Malware payload (Prometei)", "value": "a809d71811691e124fc50cca8963869d", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779333080, "uuid": "59a107a4-909e-472c-ae27-36e4f3cc4919", "comment": "Malware payload (Prometei)", "value": "097dd2965d132f23b79ffef5a7647e9bf496e0ea1ac6bf25d9396b7b34d15c81", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779333080, "uuid": "5fd80b01-411c-4f91-b55e-19f1e6b6d3a3", "comment": "Malware payload (Prometei)", "value": "d228141e826df49e72881a7f0faea75ca84b0008", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779333080, "uuid": "9bca9030-b269-4254-a61a-05a17594a449", "comment": "Malware payload (Prometei)", "value": "0c3d593879c0b9a50c757ba319af9420f26dceea47b4b0345fe69150b8faada4b81d6f4d8f773c0f611b12ec3f91ee73", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779333080, "uuid": "b5bd0611-84c6-4a8d-8fd4-8c653075e713", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779333080, "uuid": "63646c89-82f3-4669-8822-df582134ed61", "value": "3:EHUgVUfzLen:E1IW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779333080, "uuid": "ede48065-c44c-4ce8-acb9-560d98c02934", "value": 17, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779333080, "uuid": "33d0776b-a21a-4f68-a39e-72873581c36e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779333080, "uuid": "7abb2783-af32-4823-9d20-0992428bfa05", "value": "097dd2965d132f23b79ffef5a7647e9bf496e0ea1ac6bf25d9396b7b34d15c81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902c97bd-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1779372088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372088, "uuid": "620080e2-5bf3-4672-baf4-7800f615d76b", "comment": "Malware payload (DarkTortilla)", "value": "c9982122f6d31af965ff66e9a09c1681", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372088, "uuid": "daf6bb83-5b09-434a-a9f6-c4b3b7fde1f5", "comment": "Malware payload (DarkTortilla)", "value": "098a799db562441f2f4c9ee159c7bd81467c6d86068169a121cae9e02ea27677", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372088, "uuid": "2314d1ec-f716-495a-a910-b0b46b7a3db4", "comment": "Malware payload (DarkTortilla)", "value": "646d52ba7e8c66aad5a3ecc727cb4b89615a7be6", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372088, "uuid": "2fc2d2ce-0c4e-4374-b6e1-affb8145af67", "comment": "Malware payload (DarkTortilla)", "value": "d5d5cf1b18d2f06f54c7ce874a56e5dcdd5f8563f144848da0cbc1faf82a9141b67bb95b75c957d3efe0052b47049429", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372088, "uuid": "5e196bd7-d082-4974-8e16-df94bee8a5b1", "value": "T1E5C4230ADB9407083A5136D762F9FD21EA5DB76B798752C7CFA81183EF838061C93978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372088, "uuid": "17087a1d-9319-479a-a9da-a6fde15476ca", "value": "12288:QgicsUqGcvANBcg5JYTCcLHM0Uzllt247OlPUZBalcU/wzx+oFKtyBgST:Qg5sDPayg5J+bbWG4yl8BDewl+oFmyBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372088, "uuid": "b7e33f68-d145-4cf7-8baa-5bc036859884", "value": 592379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372088, "uuid": "2c1f7b36-8fb8-49bb-876f-a8975e082a88", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372088, "uuid": "efcd2b3d-3e13-4b3b-bbdd-88ee25a8aa27", "value": "RFQ_New_Order_-_57m\u00b3_LPG_SEMI_TRAILER_7_NOS.gz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f259837-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1779370395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370395, "uuid": "5d31e0fe-b935-4af9-b386-108152f4ad09", "comment": "Malware payload (XWorm)", "value": "ef6443c55282668bfc73c97310c7ef4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370395, "uuid": "724a970f-bed6-4a7d-a620-8fe3c7cb81e3", "comment": "Malware payload (XWorm)", "value": "098aa9c93b84de6ea144df9b8d5f063adb1f317ef9389afcb0959679f312dfcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370395, "uuid": "078da98f-5bfc-4ec8-b837-cc66bf651c0c", "comment": "Malware payload (XWorm)", "value": "d8a3b7797a159aea83719b881c925530048107a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370395, "uuid": "f907ede8-7de3-49f8-b669-8a25cadec4cd", "comment": "Malware payload (XWorm)", "value": "9feb5c15b34e4aba9f72facfcefe88dbe18f4e5f7748c1980327496d54b3eeba2ed8a13e77f2e07bb57b8d0b4e91ea72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370395, "uuid": "74e2699c-40bb-403f-9377-bdc606acaad2", "value": "T189E56759B4931DA7FC9A01A1C4D238F922FE8EA774F2560FDF80BDA0A93707E4452179", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370395, "uuid": "3c2be2d9-7278-42ef-a5fe-962326470fb4", "value": "12288:4yJlrWbqqOoSaf5P5c3Y5nyn8YxRCBMG3:f/HoSaf5BEuyjxR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370395, "uuid": "f90876ed-bd0e-43eb-8ef3-990a396fe303", "value": 3264592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370395, "uuid": "c379df50-e872-4192-8056-f4af2af133e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370395, "uuid": "5c166533-5dac-4e99-9859-e7f48c29a98f", "value": "Purchase_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df90147-5514-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779368219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368219, "uuid": "064bcc9d-1f36-454a-be51-95b6b600312f", "comment": "Malware payload (AgentTesla)", "value": "11429b4e362b1fa80ceac37f63c89710", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368219, "uuid": "4afddb0c-68d4-44f2-aa62-9a2aff7c4dd2", "comment": "Malware payload (AgentTesla)", "value": "09ac2e72299490ad7e65014f450b249d1c0d6e0e1be570d596bcd6edcfd4e0d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368219, "uuid": "4d64ce8a-85d8-48e8-8396-fa5031ab7126", "comment": "Malware payload (AgentTesla)", "value": "51447fe023e62d19f227eccb154ec7f4046b2566", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368219, "uuid": "b2c25d71-5b68-4cec-9c46-62b7d7e25ec1", "comment": "Malware payload (AgentTesla)", "value": "fb45bd241dbfc52474054343e17db664b922ef943a2d485715cde19c6217ba05bc12c12875372f44d0c10988267a4a68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368219, "uuid": "678ee83e-18b0-4ab8-a511-fcae15a93910", "value": "T178D52376AF6A6F3907B86779102D8E5C96B003F78C76BC91B39C68572BD9B40801B43D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368219, "uuid": "65dfc273-8a8b-4bdf-a9b0-821fe9b99502", "value": "49152:/srupTIiiWqTu5srupTIiiWqTu5srupTIiiWqTu9:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779368219, "uuid": "7f19c361-0827-422d-8f60-dc79c5502719", "value": 2776440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779368219, "uuid": "07fc387a-9ebc-4c3a-ace7-999183775d83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368219, "uuid": "d07edb55-02a8-4915-b2e2-df64f0c9fe82", "value": "09ac2e72299490ad7e65014f450b249d1c0d6e0e1be570d596bcd6edcfd4e0d9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a157989d-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370399, "uuid": "37d6d041-a774-4576-b30b-2212b243c68d", "comment": "Malware payload (StrelaStealer)", "value": "ecbeacfb355fe5d3d344206fd10f3cd5", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370399, "uuid": "fd446ee4-6611-46d8-bab1-0ffe76981f7e", "comment": "Malware payload (StrelaStealer)", "value": "09c438333ff996d891c9cc59b962293fc0c54c0c5f97de57e8ebda6c872b5cfc", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370399, "uuid": "b0dc8a60-4903-47bf-9cb8-2f69c409eeaf", "comment": "Malware payload (StrelaStealer)", "value": "68faad82f0090e53445d5b279edf9b17b8c94ca1", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370399, "uuid": "5b366c7f-0ab0-42a5-8276-70ba7eb46983", "comment": "Malware payload (StrelaStealer)", "value": "1e686a2d42a5728bf63c3dd5cbc77d7b24571a96e0cb188831d3d6f2fc9c4a2cec75903f34d3669f900b536f5ac5f854", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370399, "uuid": "c4438b12-c368-47b7-8c31-2a5c9039ede7", "value": "T1370523C52A82C3867E1F47597CA6EA93292C5DA2CD9CFBF10D3253EC96B14D06C9D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370399, "uuid": "5e823484-3471-4713-b367-bc4dbc492810", "value": "24576:xHUBoG3IgqPIWEgN6hyh6KwuhkYeSB3s/JIiZHK+B/C:x0BoaINtE7as5N3xbHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370399, "uuid": "98d273d8-48ff-4592-8385-43f7b310639c", "value": 868309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370399, "uuid": "38750a15-6139-4ce0-a873-6b5a965aeca6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370399, "uuid": "b3721794-22f6-4954-853d-7dfc4368a9f0", "value": "RE_02112024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989dd54d-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372102, "uuid": "9d1b5a32-92de-4667-9a55-d2acb020de9b", "comment": "Malware payload (Formbook)", "value": "447fe65a31beb26ea154e925d350894e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372102, "uuid": "992e9878-4809-4e26-9f4e-67c94a65c9e7", "comment": "Malware payload (Formbook)", "value": "0a025bc97452f98b0f6de2814857de95a90238c59c9ae5753d6fc2e47ed453c0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372102, "uuid": "1e8281eb-f3b8-42c9-9595-dd4fac57a058", "comment": "Malware payload (Formbook)", "value": "3027253521d86ccba12321d473bf19fae6843548", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372102, "uuid": "371862a5-b680-43cd-a7fc-6027e980d847", "comment": "Malware payload (Formbook)", "value": "2ca9701bba229425096a0ef8f175c6daf55ed30ef9d8144c1392c18eb1118befe7fe8260e88ea4511295d63ec690b157", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372102, "uuid": "3c58cca0-cb02-425a-9e28-c76ee30b7ed4", "value": "T16FF433C2E440BFB480DF0975424A585BCB3D60B1A25010919F7F44BB1FB7AB6DA19BEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372102, "uuid": "e008f9dc-9cc6-40fe-95dd-dd0800347129", "value": "24576:gdJts+nMeMVBxe4V/yuPnLtitSZNlMr+e4EGuO:gd7nnMeUTe4V/yuPtnyrV47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372102, "uuid": "cc324ab5-9648-467e-a681-8bee0a7be945", "value": 789564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372102, "uuid": "183cfc5d-0ed1-49c4-9ec6-834019a66c93", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372102, "uuid": "beeef760-092f-4404-ace4-d650cbee2c94", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab5225f-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372106, "uuid": "790c4abf-2aba-4ff0-914d-b0fd9c4e8d75", "comment": "Malware payload (SnakeKeylogger)", "value": "d9552470fad1fab7d151e77efef7ed17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372106, "uuid": "48e708b1-30d7-4588-a45d-00c56280ad6c", "comment": "Malware payload (SnakeKeylogger)", "value": "0a0a24fc88ba87cd8c77b6a493547b2dc780f60df1838e7b0ddcc87bb1277680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372106, "uuid": "2569e624-6aca-492d-a6a6-74984a21823b", "comment": "Malware payload (SnakeKeylogger)", "value": "e93a38fb8c311cfcb234e2efe7b8389462783248", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372106, "uuid": "e93d88cf-1788-418b-abd5-3e3107d3de9c", "comment": "Malware payload (SnakeKeylogger)", "value": "710495c0854dd2c41ed54f40f33fda44a34bfff0d3a2f65660527ca995b40ff674b517e8a22dfcac4b59edd71a05cf14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372106, "uuid": "4a99048a-f8d3-402f-a285-a41ed1aeb509", "value": "T15CE412C16229DA03C4A31FF52964D2F923B05D9FA906D3075BDA2CFBB9D0B6409543AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372106, "uuid": "3ea60ff2-3f28-4fd8-bf7f-63c11ae5c50a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372106, "uuid": "16d86eec-6d3a-4069-8ad9-a3b39590a53f", "value": "12288:H/f++JdtTJqqt7R41Wmu9Ml7gAm4zqdJ9Lss4HbynpkRNvJm12d1vFT0ZlV1fDPT:H3++lg1WoSB9Lss4HenSRTRUH37oQEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372106, "uuid": "6d3a51b6-fdfd-4f37-8f5a-581977ef51d6", "value": 719880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372106, "uuid": "56167acd-7341-4488-8d4c-9524bb9c3199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372106, "uuid": "72c1d3cb-60e9-4823-8205-ed8cb4ca519d", "value": "payment_Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a372f480-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779370402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370402, "uuid": "b16b7860-8c4c-4692-bd58-17c546e465e5", "comment": "Malware payload (AgentTesla)", "value": "5cc09e1be5016ca7c7a1d801c94b5195", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370402, "uuid": "88267a2f-bf19-44c4-8769-c96da17ce475", "comment": "Malware payload (AgentTesla)", "value": "0a46f51ac645ef7cb5ea2f115e1a6a54e612024ae5f40e1477dcd519e13093fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370402, "uuid": "06a1478e-3dd4-4825-b087-f35c8b9c1ae6", "comment": "Malware payload (AgentTesla)", "value": "5987b0e7c80782d0ee152cf25a33579e8e68f646", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370402, "uuid": "c634ef22-f7d5-4359-875f-a4f7010019a6", "comment": "Malware payload (AgentTesla)", "value": "fb411e9e0f398661239fa0d61f08d25c67438b6a77f941388697d15e14be6d17ea4378e9f4e33e2519b24441ed9730d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370402, "uuid": "05dd2046-54a9-4ee4-a33d-0b2aafa2a50e", "value": "T1C2D423389BD0A75989DC3214501067A3F99A5D6A23C137128D3CF93EC578F1B1B97B8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370402, "uuid": "e81a8ca0-8ced-45cf-9c9b-72076da6be80", "value": "12288:9ay0rgMYTe2gA6oO8/bqLkNa55eVH4VsOX+u+:0P/YT1UmbXNUVsOXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370402, "uuid": "bf258ab3-c13d-48f5-a4a3-3345c6ad4122", "value": 627278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370402, "uuid": "7b48e168-378f-434c-8408-44f849359cc1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370402, "uuid": "4da3e156-784e-466a-aa96-c5d2723a7465", "value": "Order_PI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f433f6e-5513-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779367604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367604, "uuid": "c76dd2ee-aa59-4599-b4fe-c698316f8742", "comment": "Malware payload (AgentTesla)", "value": "11a7343598e21bd12c4f3a483822fc8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367604, "uuid": "0e27429d-3e05-4ce4-9456-b52c7704ced9", "comment": "Malware payload (AgentTesla)", "value": "0a6016dfae22cfa351df9c07eb2a4a9f69ccd990e726c6dd43bfc9ee38ec8938", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367604, "uuid": "01a3d6cf-ed04-4130-ae65-f4ce47b24b2b", "comment": "Malware payload (AgentTesla)", "value": "97616ed3c25bdae3a0fd2d6a722954e12b86652b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367604, "uuid": "4bce0ba6-f59f-43ea-8b0d-c3c90f4cdfb9", "comment": "Malware payload (AgentTesla)", "value": "33e73f7443e8c3f4c4963ccedae95d82495504512bf59e1fb2892980550be070f60a3f248d053fb512948410bc5551b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367604, "uuid": "c54b06cd-34a5-4ed9-a4db-e6c73cf87925", "value": "T1AF558E03C9BDCA08CFAD3635C1F7330947A015994D2259EAA8D4BC26F9DF586623B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367604, "uuid": "168b5d2e-ee57-4945-bd35-41f0b5a61677", "value": "12288:6oHglyPi9n48Mc2UaodMxMoApbmSZUvqYfJs/KrHeIW5XrDEKCc9ztz3dBLORffE:66oyOnWLSNc97KUU9xu/h2naD43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367604, "uuid": "16bc33bb-aea5-46f1-bbbb-2e6e719552cc", "value": 1380388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367604, "uuid": "1d97b376-fcfb-4928-8c7d-36c55263e57f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367604, "uuid": "fb0ef571-a330-4a39-857c-3bd1d0e2732e", "value": "0a6016dfae22cfa351df9c07eb2a4a9f69ccd990e726c6dd43bfc9ee38ec8938.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6a8800-54de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779344940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344940, "uuid": "e852492c-3cd4-4d5c-815a-f8ad1fe29db3", "comment": "Malware payload (Mirai)", "value": "ccec0cfb06531861d394b09ede401043", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344940, "uuid": "0d35711d-2798-4f52-9f2e-e14c3cc1199a", "comment": "Malware payload (Mirai)", "value": "0a671a878c392e35447275c55111164842bf9feb94ec7b2e51ecc09685ae4f88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344940, "uuid": "e2bb5955-9adc-4ec3-857a-d695c6346221", "comment": "Malware payload (Mirai)", "value": "a5d22cebde4f14cca75899f1203b48b169e7c4d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344940, "uuid": "e3667a38-0242-4073-8f46-7baaa684a31b", "comment": "Malware payload (Mirai)", "value": "8f3887916167d08d8045b3c2839808ff406775ab4a0e9c14275ed2d1d3656b5e5bd9b251f462e3c2b3f59778be523dc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344940, "uuid": "74a179e3-ad16-4522-a68c-010f6c9f3a8a", "value": "T186A35B8BB6078CA2C9910BF54BC79B8C5FB361408F57D7E23D0D2A384E656DE6D4A381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344940, "uuid": "2eca1231-5f21-4248-8e93-d40aed1eee0a", "value": "1536:DG1DGQbdAkClOuDFIMogp/LWHhYCqjQ45m89N:D0DGQbdFCVDFIMogpq6jx5m89N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779344940, "uuid": "d7c114d1-a162-4b7a-b443-0dde79e2819f", "value": 99484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779344940, "uuid": "73f99e80-557b-493f-9ff0-eb7ff422706f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344940, "uuid": "a7d7c611-3537-465b-b104-ffd3511c427a", "value": "dlr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f509ec-555f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779400470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400470, "uuid": "66615da3-04c8-425d-983c-68e41bb4186e", "comment": "Malware payload", "value": "fc6a011363defbb0cd9c248e2042bd68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400470, "uuid": "07d162ad-254d-4d23-bba2-94373f7be337", "comment": "Malware payload", "value": "0a6e477cb607b95b556b0547a9f3ee373cb4cffe45925d40030a2adf880012f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400470, "uuid": "cd341523-f741-4645-b358-98cdf060a86d", "comment": "Malware payload", "value": "ab53fa472eefefafd3fda2c8aee6df93ce5919d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400470, "uuid": "a2763273-249a-46e0-8ebd-fb6be6ae301c", "comment": "Malware payload", "value": "26633f69e204e22cc41a45e8ddde4c7fff78c853971058a6ebf16bc2476e9538365c72497bccfc145d00138c2d85def6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400470, "uuid": "52148df6-32a1-471f-9efb-7d294b56e0c2", "value": "T14125E066BC419A62C4D026BBFA6D8198330313BCC3DA7506ED15CB3976EF88E4D39B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400470, "uuid": "9aba5607-7f20-422d-b8c3-c8190f7c0271", "value": "24576:FUh5D8n0PXVaYd42qk7GKOxqUM5UBiITNpC5U:6r5LhUM5gjhpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779400470, "uuid": "cc2561d4-7fa5-4e43-acfc-76c93893a242", "value": 1021408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779400470, "uuid": "999f16ec-4859-42fe-b691-313558e06034", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400470, "uuid": "b448fe9e-4d0e-4b7d-a926-cc6b6dff9a12", "value": "iztsowy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e343207-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1779372112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372112, "uuid": "b1cb957d-2ce7-4625-9b79-7d8a54e556c8", "comment": "Malware payload (RedLineStealer)", "value": "7636280174cf3a7e8786f7cb163c3f44", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372112, "uuid": "9dea458f-2e79-4006-a7d9-214d2bb2b5d0", "comment": "Malware payload (RedLineStealer)", "value": "0a7f4f40ef3162ac80ae43794523e07095ddb6b26a539fe68897a44d6805598e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372112, "uuid": "35acf245-15bf-43c7-b5b3-3d7ea4ce497d", "comment": "Malware payload (RedLineStealer)", "value": "308b078ca63cb270d805e4b43bcca279cb637cb6", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372112, "uuid": "68365d82-1df7-42c9-8706-ae193b24ef09", "comment": "Malware payload (RedLineStealer)", "value": "d964d1c8e40b79c04c5593919feef3e8a9733dbc3f0d50d731fef1f8542bbd6a95df21914328f9dd8955561cf8123290", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372112, "uuid": "6caf112a-7547-4ed6-9b06-147715af248e", "value": "T1231523F70BFE5021B6B19554FF22CDCA481E19A8F38D90217CEF25E144F31D2966B6A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372112, "uuid": "9b61edcc-31f6-41c3-834c-eba16bcab380", "value": "24576:3SR0LD4tJiCNT/8zNNU3RF7bp+EYjzcCgygtLtl:3SR0LDcTND8z3U3RFOSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372112, "uuid": "a0585386-b261-436a-b6a2-60ff5ed37951", "value": 890600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372112, "uuid": "aaaefd15-7d89-47bd-ac44-21d3964cec74", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372112, "uuid": "de4c4034-a948-4fff-8743-4edb734c966f", "value": "24099762P2024091901KYRQA.r09.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03d2dd3-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372115, "uuid": "e78287aa-e821-48ae-89de-4a136f05cbe2", "comment": "Malware payload (Formbook)", "value": "79461545105cead1f0d51e370e029063", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372115, "uuid": "50500077-c567-428a-8520-a6af4d02b35b", "comment": "Malware payload (Formbook)", "value": "0aa67d8c077b6491f3434bc0ed77e013772bf4e8141ab1b75a5529629b0b284a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372115, "uuid": "aa2efc26-5430-4bab-b434-a39ef69ddbca", "comment": "Malware payload (Formbook)", "value": "8b12c424a05dc7392c9e4282410d8e62d8c2ef6c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372115, "uuid": "3af70950-eac5-4018-933b-5b521b0ca3c6", "comment": "Malware payload (Formbook)", "value": "77df4ec28afbf70fa1311510f41e6b295231483e4e3d5205e863f0259c504b5a116122d5e1b09cfb2b715a059a97d02d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372115, "uuid": "eaeb55dc-5621-430e-a028-1cd31ba0b0ff", "value": "T1402533731AD56C0B627A4FA0D5333E5658F6E3AB53C53128B8E54E47CAC3A75430B3A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372115, "uuid": "cd0d378b-895a-4082-8188-e154206ec0c9", "value": "24576:4ePxO3OEiap1s0KmiL8OR4nEravd3n3I3U:4eZO3wapC0KpYORvuvd3n3I3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372115, "uuid": "96f76c23-54bb-40b9-99e6-69916f93c817", "value": 1036715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372115, "uuid": "be818b14-5ec8-40a3-87b1-d66ac07b6a95", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372115, "uuid": "58df0e8c-1335-4602-84e2-e831aa228de6", "value": "ShippingXDocs.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3610c9b2-5528-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779376661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376661, "uuid": "231693f1-9c2d-4acd-b8a0-5224453878c1", "comment": "Malware payload (Mirai)", "value": "4ca38e604df895efe2a3d97138f7242b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376661, "uuid": "5beebcd6-30fe-44a2-b6ef-44a8b5e66995", "comment": "Malware payload (Mirai)", "value": "0acad826f2a52610580d7ce69ca8a632bb6f6bd19506a2a16d6f38adb4e803de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376661, "uuid": "a7171f2f-b12e-46e0-b4e4-7630cbbcb74b", "comment": "Malware payload (Mirai)", "value": "6eb9221b37353f426e531fc6bd9ffdc59786a750", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376661, "uuid": "adc2d752-5fec-4c5e-b710-6e3e622057df", "comment": "Malware payload (Mirai)", "value": "573b223e5d90e4872efdc45311abbf96fc025b3811d6bd406a3950a8cdcaeb76ddd4aa38087e417fcac568620dd4065d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779376661, "uuid": "bb084da5-3720-49dc-83c8-debd0307041b", "value": "T13814971E6E228F7DF6A8C77447B79E24976833D627D1D644E1ACC2101F2029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779376661, "uuid": "f398450c-7f03-4b66-a629-3abed6884433", "value": "3072:XeqApfQqL/k3VJLzhX5/RxvMBp0Bce40P865HIchg:XeqMQSwVJLzhX5Ju33e78yHIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779376661, "uuid": "d5e0d09b-775a-4b04-9f35-4aa7aa52996a", "value": 198184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779376661, "uuid": "61e564cf-c917-4b44-9dcc-f187fd3bac5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779376661, "uuid": "ee1cad95-2864-4546-8c33-3c7e9f55316c", "value": "micro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3cdfa8c-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372121, "uuid": "c4d38b3d-8ada-4abb-b929-e308f95e5f4c", "comment": "Malware payload (AgentTesla)", "value": "f282c642bf968330dc3183f91a3e8c38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372121, "uuid": "6e9eecfb-d8bb-46c1-ae8b-90906fd8fdf0", "comment": "Malware payload (AgentTesla)", "value": "0b3855cbcb84ba68664ddf22d0445e14cd4827ad21f8c3bd15703e902792e185", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372121, "uuid": "1ef98a4c-b86f-4c09-b087-f4381e1ec785", "comment": "Malware payload (AgentTesla)", "value": "e633a0742001986d15fa261e320e619435e3ef60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372121, "uuid": "33115550-de4c-466a-af65-d6a1230aafdb", "comment": "Malware payload (AgentTesla)", "value": "c809c48abb23086d9e7c7d8ee48bf4fda8d2552b8d540d426d9e051dbf288660ebf53148dab8b36ad7030fbe345aed14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372121, "uuid": "f1e0241f-5463-477c-84c0-4b97a8597284", "value": "T1BF3533B155F863EB9D282DB2552C5AF3D7FB46838F2B339796ED4D80121D785028809F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372121, "uuid": "cdb8377f-ab1d-4f24-a909-d11123ce294c", "value": "24576:zu/F/+vRmVqRoJDbDgV4I7K5gpbivhSTMSW5KzNSdr2SqmJR6:zudkRoJDikho+KS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372121, "uuid": "e5f3bd44-5805-4cbe-8e22-4643c3773201", "value": 1069587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372121, "uuid": "a35282c9-2df7-4af5-a1e0-ceb329c90294", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372121, "uuid": "42603667-4713-4454-a5cb-fa0969beebbd", "value": "e-dekont_html.z.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa6d557-54e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779346344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346344, "uuid": "a9bc653a-ea7e-4e0a-a2bd-a5bece62f9d8", "comment": "Malware payload", "value": "948a9785020fcaa6fea551d570326f9f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346344, "uuid": "126ee587-e09b-4704-bcb8-9ba5f92751da", "comment": "Malware payload", "value": "0b4e0d1f786198bde067dc8b98bddc62b7bca6120a607b259df12c586cb10a33", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346344, "uuid": "a65b6cdf-b7a7-4985-b636-4a4889bc3601", "comment": "Malware payload", "value": "4dd472eee201a08720ce810a3bcda7090f3c6571", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346344, "uuid": "96dc211f-90cd-4380-b1a2-f4c0b9f6da37", "comment": "Malware payload", "value": "3863ce329ff48230ef360803ac702728265ac1e5e7362859f81acc9a5da3a2824ce068142963aa3b2a1b8d758d5f8552", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346344, "uuid": "dfa40330-fcdc-45bd-a0d3-b4386faa0fbd", "value": "T1F41712120FDF7EEE9E9428197C974FCB2A050A900BC54558A6B5DBE70F88734637C93A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346344, "uuid": "1482beee-4a62-461c-99b9-828d140070cc", "value": "49152:WH8YHlH4H2HhHjHCHmH+HwHoHkHbHnHvHHHwHpH3HYH9H4HOH5HsHzHsHjHXHgHr:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779346344, "uuid": "a01da0fe-d3c7-4649-8e31-9b0b7ef3b29f", "value": 19614209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779346344, "uuid": "b7b05e42-eb29-46eb-a14a-7d3dddf5f429", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346344, "uuid": "008061ab-2e62-4ff6-abc2-5e81ab853cd2", "value": "transcript.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a772a504-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372127, "uuid": "aebbdd5b-8884-4d9c-8f90-24e6eebf2e1d", "comment": "Malware payload", "value": "eacb9a57150f19b6ec90d1b1b03ec845", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372127, "uuid": "b936d1ac-da49-4300-8bbf-ad6d78e4f89a", "comment": "Malware payload", "value": "0b7ae3cf757ba87aa716683f61110a8bcb1d49dae5af12d88af8667d897b4047", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372127, "uuid": "58a95a79-7076-4854-90bd-2d682b55a416", "comment": "Malware payload", "value": "e213a419369f61be22ee72da87b9a90ff8a22f96", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372127, "uuid": "63e21c75-97c5-4bc0-aaec-8d92f655619e", "comment": "Malware payload", "value": "b7c1d3b9322a40233767e7d57d48c6e5fb94109c750758caeae35d2e1b93597523d6dbfa28ea52381fdc9947e5c0c1d7", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372127, "uuid": "e1643e46-3d4c-400d-98cf-9d7759c82a36", "value": "T10EC42388D8D963069C2F90B6BDC24F382ED895E5ED66149E20E064D379CF625E360CF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372127, "uuid": "c33cd868-f399-4449-be86-f492f145c4c8", "value": "12288:gGXxaONUPdgyeuFguYccHJ1YRSW3JM5VEEChBbJXrZP:g6xaON0dgt2gumvYRL3J9EKprZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372127, "uuid": "c3fab751-e347-4c09-b7cd-7cba3b06ac18", "value": 579979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372127, "uuid": "4dcb7028-95f1-4ee6-85a7-4fa4346c6b89", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372127, "uuid": "17aef869-6a04-4758-8fdd-944688afe2fa", "value": "Quote_PBR0270824.z.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76c5cec-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779370409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370409, "uuid": "2c0775eb-f9bc-4a02-bb19-46090d6bd646", "comment": "Malware payload (MassLogger)", "value": "53cbc00709364c47cb099dc1ef25b62c", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370409, "uuid": "5f1f2bf8-7a63-4ba6-a0f4-098978ea6b48", "comment": "Malware payload (MassLogger)", "value": "0b874c7c4bae91e7eedc3e9f785acd38357c073fa3430ad9feebe2195e744a78", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370409, "uuid": "943d6f7b-870b-4216-9ac1-e06b8082675e", "comment": "Malware payload (MassLogger)", "value": "af5534f035ca42e3330d968843b1be60743e70a3", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370409, "uuid": "265763c2-2f3f-49e5-8c46-522e5bc22a69", "comment": "Malware payload (MassLogger)", "value": "5b3e7b11d2e2c87193419d0c476116b717de4dcd07db33546180af8e42f79032b15ed2dba56bdd9f57b4a22f9ecdd444", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370409, "uuid": "37b0c1e6-97b9-46c0-bc4d-65f43d6b3fb2", "value": "T194E4238802F3F852ED86D737C74ABA270AA7D54937208C1718580F927D2D6FCAF99865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370409, "uuid": "edde7af5-1aa6-4977-928b-b08952d8a7d9", "value": "12288:TyNU22S+AzxXvST8Hu0KsPDYyMCZnylD5Xo7se/Fcx0147MVEv:TyNU5A1Kku0PVMlD5XmMxH7ME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370409, "uuid": "f75e478d-ce8a-4bad-a721-f754355bfcc5", "value": 663544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370409, "uuid": "835fdf8c-9c01-4df7-9100-2ec5ebf0717c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370409, "uuid": "79c400f8-39f4-495f-b27b-d6da534fe85b", "value": "\u0130hale_14992_docx.z.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a994f12c-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372131, "uuid": "9256d6ce-f4b4-43d5-b27f-45b8963e545a", "comment": "Malware payload (Formbook)", "value": "6ea3517e07815c51f0167fe6e18b8b67", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372131, "uuid": "3fe1ea39-459b-47fd-bdba-006b960abf84", "comment": "Malware payload (Formbook)", "value": "0ba3ef1960da7d2603879fd62607e2c5418988bfe9009f1dfa22373a9994539c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372131, "uuid": "f58e107d-3ebb-4ad3-b595-33f21667a29a", "comment": "Malware payload (Formbook)", "value": "a7359b1355b4f3795bcae7d764acc1759a435d01", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372131, "uuid": "424d2e11-92b8-4dda-bf99-928fcdd4ff84", "comment": "Malware payload (Formbook)", "value": "0a91b2d338abaac9d6ba972418a3f6fdc1ce1395b05fbc18762b7c7e36c8ae84efecd45eecf63bb8557fc579c7e3ca31", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372131, "uuid": "09181ef1-edf1-4fcf-99eb-709a2c4265a9", "value": "T1BC25332428D24A96C24D9761596B55A4149F3FABF89E0FC7343AF3FE0802CF835C666C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372131, "uuid": "48c241b6-40d5-49b2-97eb-35607c8f5b26", "value": "24576:xys22QYK8f9cBqS038HKGUKje3X9JWNuy/XGEX8:fKYVf9ckMHKGUKiH9c3DX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372131, "uuid": "1264b5f8-d214-4203-9059-7195e0502488", "value": 998438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372131, "uuid": "c314c1d6-fa2e-444c-9947-08d9a25e89d5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372131, "uuid": "4b78bac5-c885-4e2f-834d-12366d0d2c93", "value": "PO-1272412662._PN2023-W101.7Z.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc366e1-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372134, "uuid": "deb45365-e8ec-43ba-951e-612a8cef75a6", "comment": "Malware payload (Formbook)", "value": "6d6560ef37ad63af10edf9b7f5827ed9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372134, "uuid": "c297d15f-2094-40b0-892d-be1a555c4753", "comment": "Malware payload (Formbook)", "value": "0bb90b4f22c566870e3b4e956d1fef6d4fd82661f845d9993402f1f88c86b7f2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372134, "uuid": "51e6d633-5498-4d43-82f0-0ed4bd4b37f7", "comment": "Malware payload (Formbook)", "value": "7318483e2ce57fbee4ecfeede80e18e6a3a3c432", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372134, "uuid": "f3e99e86-faaf-4f06-88e7-7e85116bee65", "comment": "Malware payload (Formbook)", "value": "e7e9561020dbd5dcefacae5209de8b8f749bd8417d4d4092e79285c67c0445e8f4a3a9369ed608860ec59bbb060517dd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372134, "uuid": "cca0bc9c-766a-4ea9-b5b4-135c971a724e", "value": "T17A0523FF890092569C7AE8918D31164C35963CDCDB8231FA6EC6AD8D8C9A517D1E0F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372134, "uuid": "a0b15968-cd9a-4ad4-8391-beb54471b955", "value": "24576:BnsTryQqUTY7xrWzZ/sc5qsjZLrca0SnUG1+:sryQg74sc5Sa0qU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372134, "uuid": "45c9edb9-e054-4ce3-814c-37f92787ce71", "value": 863536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372134, "uuid": "eca95fbe-0a64-4424-a153-b2e02937a572", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372134, "uuid": "5bd6df41-839b-4c92-8808-6f5cf3786bc4", "value": "DHL9407155789.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a985a1de-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370413, "uuid": "086ff0f0-5f40-441c-a205-8ac4f1669271", "comment": "Malware payload (StrelaStealer)", "value": "ff44bf91bb1f172ab38d83267ca69ab3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370413, "uuid": "e7d8dde3-9f25-47ec-a891-9c38d05d1fb6", "comment": "Malware payload (StrelaStealer)", "value": "0bbfa30840609dd7566e4d989d825df59a204546b7a7920adf1a80fec9ea13d2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370413, "uuid": "fd2ddf54-6a6c-4a94-8aad-cf42e7af4867", "comment": "Malware payload (StrelaStealer)", "value": "c91392ad690d9b046714cea967a90deecfa06f75", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370413, "uuid": "a5006b96-1d6f-43a5-84c4-76fa6864f144", "comment": "Malware payload (StrelaStealer)", "value": "684b0a7cb491a1f090cffdee84e81c5828d071eaa3e6eb2aee35c6ea6fc2f34d76a886df08151bcaaa0fb371490c5b70", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370413, "uuid": "2f73e015-ec43-4adb-98cc-32e1b575ed52", "value": "T1AC73D144A49B53831DEBC5CE8A1D9193D699F61192DE836ABE3F8E1350ADE3C85CC334", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370413, "uuid": "11dce1a5-4f66-4800-b066-2fa5ad097274", "value": "768:biUXiCExMyME+7Xtf8rbt1jHVUTICHpFRzREPEls2MvRzMo0ffVdkOx86RcDK6WI:1jFVcVIl37Xt+X5xd9fvbTmkgQV/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370413, "uuid": "7b085694-af2b-4efb-a48c-24e828ea42d4", "value": 75614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370413, "uuid": "78c81961-c132-4320-8135-b66db7f41fea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370413, "uuid": "2973a4e7-1b82-4a1a-b4b1-df7bbd0477ea", "value": "3151111110108886240.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abac7b4a-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370416, "uuid": "c522e05e-7d2d-40a6-b269-13fe9a6b2130", "comment": "Malware payload (Formbook)", "value": "0c47b93e3a78e9ddb7f594f71706d901", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370416, "uuid": "a2c90a3d-d05d-473b-84b3-259a06ee1900", "comment": "Malware payload (Formbook)", "value": "0bd8361b93cdf3aa3a91d6eab56fca0e784a414efea1fd5b323674a93cffc59b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370416, "uuid": "4a9e48a4-9c79-40f0-bb26-65fe8eef88b7", "comment": "Malware payload (Formbook)", "value": "48d8a9d8003c7a140b39af22af223f392a32d193", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370416, "uuid": "7995d8a9-13ed-4e4c-89a8-f8ce380d9d13", "comment": "Malware payload (Formbook)", "value": "4de2c4890e9f21cacf360f8e496af8281d842eeb4f2fae331313d78daa15b121f07c7789cd90de8eae002873706be13f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370416, "uuid": "7034a014-bf8a-43c0-a3d7-ad6a76d67601", "value": "T1F4F4330187CB75EE583B849E74CCB458FA508F2F18A1DF1182689076AD2E9FE193DE1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370416, "uuid": "ea5aa36f-e38d-4021-831b-75027d8e57cf", "value": "12288:H2kHz6Q7NvP6g2cWQtqE1I22CO5SNiQEGmOz2KgX9LcMJzRKf+UD8hzR6:H2q1qvAqE1I+O5SNizgxGLcMJVKffp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370416, "uuid": "e982215f-55d9-44ad-b260-f5ff7d23f8d2", "value": 764751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370416, "uuid": "944b444a-952f-4765-9a91-74da1917d9c6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370416, "uuid": "be2d4402-c77d-4c0e-b687-ac77e14937eb", "value": "ORDER_08757646566535857_95877465434-1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade7975c-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372138, "uuid": "0ae5e8ed-fafb-41c3-917e-2f5228a68487", "comment": "Malware payload (AgentTesla)", "value": "a78235c0b974b8fcc0cfdec48040962b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372138, "uuid": "fc9e1a6c-9183-4d66-bf9d-44e3b981c5ed", "comment": "Malware payload (AgentTesla)", "value": "0bf2e649cea88d4c52b3554f02fa3c22228242e6946601e5284a4fadc1101fdf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372138, "uuid": "8a68c1df-0235-40d0-b314-4e7b79270576", "comment": "Malware payload (AgentTesla)", "value": "0b731bf6aba71b88d545a1629b4255b485e18e59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372138, "uuid": "19e7e4f0-f709-4d48-b093-a4f72d5750b8", "comment": "Malware payload (AgentTesla)", "value": "b67157b3d3c8a44d2981500ff2d3fab266a8314edbf9b09886eac411920d1ef110f804c7d3a5b0e3ef881b969cb15d21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372138, "uuid": "ff28ca1c-0708-4f41-bedc-769e8b4fb2fc", "value": "T1A7F40191375C6E77CAB866FC0694108943B1CA339373F7EC4CC252FA06EAB5A0A14E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372138, "uuid": "1a0fd17f-d72f-4bfb-af90-4cd057b5420f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372138, "uuid": "d5fc0642-d6db-4994-8df0-d5d4b06dc0e6", "value": "12288:qrUYvsrIBuq55wtnWrCUWkv2NQrruT5w22FoRDnNQCFuG4qMmW2G7CWt:QNUrfAWUWkeIrC5w2TNQg94ZEGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372138, "uuid": "f814e3fa-2fe7-4dcb-8395-d6f1b93e5d1f", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372138, "uuid": "109c5aef-44fc-4b95-af85-6ecf69f80ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372138, "uuid": "da0bdf11-89c0-48d2-8a28-4f29e0e30d8e", "value": "PO_20248099-1 12,300PCS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa51760-5519-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779370423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370423, "uuid": "ea095f3f-151f-4259-a278-12256716efbb", "comment": "Malware payload", "value": "76d715b78122290df2a1ff7a29d00efd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370423, "uuid": "60c3d4f8-d8ef-4755-8a74-0fd551de5aa9", "comment": "Malware payload", "value": "0ca0b66f25f810933d8276e57e0d880d0cfa6e474d8154987a51048d1d81711e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370423, "uuid": "846159ef-3dc2-4d8a-b785-be01a1dec509", "comment": "Malware payload", "value": "0c6cbaefb094318248eb88a5ac653008484eade0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370423, "uuid": "c7718181-c127-4bd5-b606-e45f3620b3e1", "comment": "Malware payload", "value": "b6610e7eabb88a2a729144cab5f0dad0ca4b80ee8663cf24f83af5abf67344758861337e0bc65fae8c56b50b50487124", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370423, "uuid": "d4227aec-2b66-4ab4-a0b0-12ee6e1d4884", "value": "T11EA18FD4B9B55E68E2567A3975212043E0FE362066C540D04463FC4D385B7C15E751EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370423, "uuid": "10abe5a2-23c0-4c95-9d2f-e2e35dcf5073", "value": "96:LhldnBu1WoSHMyXYXEtvaTpP86pNrDOSv5csDh/p19m84a9:FnxoSHMcYXE1KpP86rr6SxcMhf91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370423, "uuid": "2307f785-98bc-408a-9c32-7c0be1f15644", "value": 4699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370423, "uuid": "f9481718-8054-466c-a533-c75123ec4d3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370423, "uuid": "95c12cd8-f2d5-4f49-9047-6606ad52a0a2", "value": "globe_product_order_eu_buy_20_11_2024_000000000000000000.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe00c5f-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372141, "uuid": "80c47493-1699-4b19-ad06-579ae0d4a424", "comment": "Malware payload (AgentTesla)", "value": "7d59e896f339181c425c02cda35ba403", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372141, "uuid": "17a563ca-4b02-4c53-ba93-78f25c420498", "comment": "Malware payload (AgentTesla)", "value": "0ce2a9bef251a42648a4ef198c4da7cb4c707b9635b13036d3d552fc87ac1566", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372141, "uuid": "c8e17bb3-c130-4eb3-8b81-03667944d30d", "comment": "Malware payload (AgentTesla)", "value": "4aa9a5f82ea49e7938748687281095d59786df3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372141, "uuid": "e0f98573-6db3-4154-a360-790e85e89393", "comment": "Malware payload (AgentTesla)", "value": "a0c7cb10443a500af9a9ec48139341ee82037c45740e89439f3de3c4909cc8254e1dc55bdec22d6a31d74950bfb3f9c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372141, "uuid": "eef467fa-b37c-44f7-b472-87936ae9349c", "value": "T1745442037E84EB25E1A93E3782EF6C2413B2B0C71633D60F6F49AE5518512926D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372141, "uuid": "24132e94-f833-4699-a448-00224ed87325", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372141, "uuid": "b9d16b1a-2416-4f27-afd6-ddad3c25655a", "value": "3072:zr8WDrC0Xfn/nWFxsFQ0eVbKc3JAWJ0GowhC40U5bi8BgHp3Eo0Hb:Pu0Xfn/nCxsZ2uaSWdowhC40r8mGHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372141, "uuid": "f6e0ce70-cc80-4677-bcde-9eb64a0f5762", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372141, "uuid": "509d0349-784f-4f7b-87e7-dd8c60ac7aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372141, "uuid": "ce78c62a-f70b-44e6-ba83-53db2ceb31ba", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37a8187-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370429, "uuid": "f8d1dbbc-42cd-41cf-8358-11d558a055e3", "comment": "Malware payload (StrelaStealer)", "value": "8909c47de0738405c0603f05c43ef142", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370429, "uuid": "5e58ad31-0103-4879-b6af-ddb09c174cf4", "comment": "Malware payload (StrelaStealer)", "value": "0d0014d151a23d7f8343ac27290dc147736f3bc9eb6d2fc476e4485147b1c1ab", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370429, "uuid": "514472f0-5607-40fa-882b-0f1d08efa1dc", "comment": "Malware payload (StrelaStealer)", "value": "562e1b618ad2f1314fa96e7683557c845b774a25", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370429, "uuid": "89ed2de7-3204-4996-aa46-5ba44ebbe03b", "comment": "Malware payload (StrelaStealer)", "value": "ac6296e4d2c25b61c4052f1d93145703a2d1baec3854d70aff944d1bf86debb76d62f940d8a7af53a0d22c08f3e54148", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370429, "uuid": "702a2342-3f61-4b83-97a5-63d47f7320dc", "value": "T1995423C8A876142F76B78506B70F0ADFAF2D05DE3BCE957FB224D4CA41A33A4421961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370429, "uuid": "05d6045a-cbc9-48b8-b3bb-2718f3567efd", "value": "6144:9iYPQNL3uvdVdGS2WQBDFvYfQFKY8fFQnQ8xkPQ2XauV3:9iYIx08Wke5Y8QnpzEV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370429, "uuid": "a5856148-aba0-4173-9264-9b952283f274", "value": 293400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370429, "uuid": "27b88b1b-ecdf-44f0-b566-51bbc2b0e049", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370429, "uuid": "9de618c5-9e40-4c50-b22c-ead18eac33ff", "value": "Rechnung16428.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b586ef55-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370433, "uuid": "6deba0aa-5e9c-4a80-ae84-ba81095d2b8b", "comment": "Malware payload (StrelaStealer)", "value": "1beaabaa90282df9accef1218d0ad7af", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370433, "uuid": "aba8cda1-4432-4b7c-8fd1-7f4e26203d71", "comment": "Malware payload (StrelaStealer)", "value": "0d1fc61928fa07852242598f4784b0a680ad5060dc59a59e5b38617525af8020", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370433, "uuid": "15b31961-83f8-4e69-865b-3737377af6bf", "comment": "Malware payload (StrelaStealer)", "value": "0b48e5b5492998b4a64a71d455c2c1492a93c9e2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370433, "uuid": "770afae5-976b-4443-be91-ac3713856c36", "comment": "Malware payload (StrelaStealer)", "value": "82c5842ff31f10c62590913c54e69db7e7b79f2145cbafe3b3dab7a0e5e25a2db7be51f4417a1e2b6f30bb898f601ee4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370433, "uuid": "5e3882fb-0d08-426c-9c16-78bf1f5806ce", "value": "T12D55C0625D6E0BCC4EACB44C0951E9CF06D52D32071289F5AFDFB98B823E28657E7835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370433, "uuid": "d3f275b1-67db-4615-9d76-518a73e6b08e", "value": "24576:yDtZyBdOdOMPFmAG0gb2crMDMIwjLIKZTWxClzZon6HC+kTDaDtHIIHpp9aAOA09:sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370433, "uuid": "9d1c9fd1-c889-4c1f-aaed-153f854755d9", "value": 1372137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370433, "uuid": "6fb96122-a2f1-4927-bcd9-dc31b54cb43b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370433, "uuid": "458573f6-1ec8-4075-9cdc-95c67e70dae7", "value": "318399264705332567.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1de13ee-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372145, "uuid": "2b602949-f246-4185-adb1-aac14718231e", "comment": "Malware payload (Formbook)", "value": "f161bb19a7e6d9d8d28f3ef4f6dacc19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372145, "uuid": "7f9821f6-14b2-4587-a501-f4318a42f51c", "comment": "Malware payload (Formbook)", "value": "0d3d6bb9131e58c4dcf833781bb944eedd4bd53f5736bb1c33af11b3031fb4cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372145, "uuid": "0795cd0d-50fc-4511-9a07-fb9b93df1447", "comment": "Malware payload (Formbook)", "value": "e15cb230b126eefbfebe0e26ea469b36b9819547", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372145, "uuid": "32aaecc3-0424-4feb-a336-31551c7551da", "comment": "Malware payload (Formbook)", "value": "ab54e472db9d0f282ca1fea4f275bc9ee7a73fe906ced116bc4eb60f9916dd9e485b958b870447fd8993500d4778a334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372145, "uuid": "804ed60a-877c-4c7b-815e-d5fc26ca253d", "value": "T122E412B99270D891FBA913B50031E3B753B29E0EE902D247ABECADF77906F113245752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372145, "uuid": "2f560bde-0e4a-4c40-8657-b341dcfba115", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372145, "uuid": "d21818f8-f2e0-4ce6-91ef-08901145a9e2", "value": "12288:2eHeLv0mNkwCQ0VxvWYH5PfXxJsEiZJ7+2szPgY0ZxXpkCm8PACcIZqCliD/:2e+LZkwCQ0VNWYH5PjsEiZJkwZENBIaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372145, "uuid": "d01bd034-f021-4af1-94be-c40274685bac", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372145, "uuid": "ace42e13-7c36-4ff4-9c3b-df841dcf29ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372145, "uuid": "dc2b7757-f182-4078-a29c-bab80eafb147", "value": "Shipping_docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b784fed6-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370436, "uuid": "e8300ba5-0e09-430d-9ca4-94826a1a7578", "comment": "Malware payload (StrelaStealer)", "value": "085b0b47536046ff5e8b2189ae81fdea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370436, "uuid": "1c0d219e-bd46-49e3-a51b-bf0aa11895d8", "comment": "Malware payload (StrelaStealer)", "value": "0d3ee7241b54b6bd45a0cb425b631c78f74c7662e54bc9a35c2a67ade618cef2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370436, "uuid": "1a0c3600-bb67-441c-b9c1-7fa606f597da", "comment": "Malware payload (StrelaStealer)", "value": "b82f179b27cdbb4c33cd284cbc22ea76206796c9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370436, "uuid": "e08cc3a4-c699-4197-90d0-de7dbd5dbf0a", "comment": "Malware payload (StrelaStealer)", "value": "ff3d71ccaf99a64337f37516720af7a3cc8e17804a128049ce4e0fc33808642283d0930a31bb37c71cf2263deba221e9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370436, "uuid": "3465e60b-6182-4ce9-975d-95ec09756f81", "value": "T1F6939DE0B0952A3539E05FA8CA2107F116C023475C36BA19A6F715D3A73F5A717BCECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370436, "uuid": "f247bb44-e8cf-4024-bd37-4742ccffefc0", "value": "768:OpJ6LGBPPSg5qyiuyPmw1d58bWzruOpQKuk8tgNY7uS6NHp8J2Nkh:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370436, "uuid": "0b4d7122-d347-4251-9a2f-3836362d4c8f", "value": 92303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370436, "uuid": "34975ac9-8aee-487a-94d8-e3e9cd8dd893", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370436, "uuid": "aef0e672-58f6-4227-a5e7-e5bf5ab92c6f", "value": "2091823311014728052.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cc671d-54f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779354728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354728, "uuid": "1816d84c-9431-492b-a587-83c3d2e95ac0", "comment": "Malware payload", "value": "ef3e2efc715e452da26cf47e7e16f062", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354728, "uuid": "af143dde-d855-4693-a423-6ef0b4a38c78", "comment": "Malware payload", "value": "0d63d842b4fbf02437d4776e60d562066317310de08ed76b60d165645267ecaf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354728, "uuid": "1197c698-1c3e-48b8-952e-a98ed1a2320f", "comment": "Malware payload", "value": "55fbdbdf02f86f58962f587f690d389616141470", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354728, "uuid": "541dc134-e18a-483d-95c7-4e6778ebbc60", "comment": "Malware payload", "value": "c6a51e9d627a3b2afa605bf2d6776c25ced07978f279ca59c48c9a8ebeb71a31948b5066d90c42a79353ca335c89abb1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354728, "uuid": "44696352-4a43-4e37-8219-476a7ea74548", "value": "T1BB45DE25D7E9C019F1F24B54BD7A5412DB3BBE16293DC4DC1D88018E4A33E49A8B9B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354728, "uuid": "03c83751-b76e-43a3-b2e6-79af6586ba0c", "value": "6144:QUbKDsT7rtztctcLoRvYzDi7yBTiurYe0QbihwwgBYMfFI3YatFnLqFz45cFao:jasFMpYz5Tittw5rfoGh4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779354728, "uuid": "5af26849-187e-49a5-8cb8-f54350cfc0be", "value": 1208756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779354728, "uuid": "9e48f808-f8a2-43a5-a2cc-0ab9acf613a3", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354728, "uuid": "2721a7cc-42e3-43d8-8a46-a76018df7715", "value": "Purchase Order # MB-2026-0090.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b02ca9-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372151, "uuid": "e849ab66-7bd3-4bd7-b527-52fd5d72562c", "comment": "Malware payload (AgentTesla)", "value": "196bbfa0398365d45b96447b8f510641", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372151, "uuid": "f7c9c344-ba0b-4a27-a0d6-7f294e64e332", "comment": "Malware payload (AgentTesla)", "value": "0d72918694fded9db22b234e517c260f1d59789d1c3f2fe0ad9a203a14ffcce5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372151, "uuid": "6423b7d4-fc25-4aff-ae6f-85b7e15a3dd2", "comment": "Malware payload (AgentTesla)", "value": "6bd1a86cd0b8f32be9806c83aeb478af37724005", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372151, "uuid": "58164c9d-35d4-4a4b-b375-353be77273ce", "comment": "Malware payload (AgentTesla)", "value": "365ac3f8160b403b75055124830488f8b5f9b7f7abf0dbe0e346b78a40f1e78722cb3bc35ec2bdb1c1ce88d341f71cb5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372151, "uuid": "3f467fae-8cc9-4620-9d40-cbdc5e18a055", "value": "T10CD423B1C494CD75A0E0D7A5A00D8D91B76BBCE487A0EC314DBD10428FDB6FACD1AE69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372151, "uuid": "968f87c1-b7ce-40ca-9be2-6c7a75c31838", "value": "12288:KbqEcvIeZ5D2KZfA68QZ4RS1R04sz/3565zPbJ50MaD9trvA+Ndd:KuEHmDLA68QZ4RSn0rL34PbJ5gD91vt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372151, "uuid": "142a4834-b448-414c-9cba-458545e03bd7", "value": 623732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372151, "uuid": "f183b7e4-3a4c-4550-aaba-161c7ea83b3b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372151, "uuid": "320a6207-7661-48ea-b044-7ad66ac3909e", "value": "RemXDetX008402XPyT.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93718bc-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372157, "uuid": "3ea454a0-94ca-48d3-938a-c382048d2d12", "comment": "Malware payload (Formbook)", "value": "591fa2e674c1a2bf1b23b1144770235e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372157, "uuid": "968cf4eb-ddc7-4f0c-8b77-1bcacc5bae6b", "comment": "Malware payload (Formbook)", "value": "0d89c1944bdbc50ef96d25d653bf62a90d7bb3ca1e65d0d324c3eb34bb8092c9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372157, "uuid": "a201466a-0756-4633-9fb2-53e44c1ede8e", "comment": "Malware payload (Formbook)", "value": "822999573362effc0fe40f0d3b7101fee77cf2a1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372157, "uuid": "9020c607-0336-46ea-b186-c29dbfdf88f7", "comment": "Malware payload (Formbook)", "value": "26097303a20c4a1717d64a83ea09b2d0cc56f5d0db46ff8fbfbda25d2a6f00af496226bf9cdb7f68de7ad87d905e1901", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372157, "uuid": "a3e4b257-3eae-4e37-a31a-5de4b2ec38e5", "value": "T1D6D423A74FBDEC4D12B1141AB5B3DDB14268130DB61830F63D34257F84EA9BE25A0E4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372157, "uuid": "ccecab8d-e069-4d96-97dc-85d4ada82934", "value": "12288:+8iQ5dK1Y4XsvtsN2Y+z6hYgllrE/0CIM05kF6XOuW99RyIKDOhn:Dl5P9O2Y+zyY0lrE/0hM05k8XOuIwDYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372157, "uuid": "fcd64074-e59d-4683-927e-943e54bf4f7d", "value": 650100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372157, "uuid": "fe1196f0-e575-402b-b5b7-66cbaedca0f3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372157, "uuid": "207bd20a-eed7-4c91-903e-7cfa4db1f66d", "value": "REQUEST_FOR_QUOTATION.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb554584-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372161, "uuid": "abd6d560-d254-4996-9ad6-3e27ce583536", "comment": "Malware payload", "value": "bc7b99f4ba61b0f14f1e0bf6cb8feebf", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372161, "uuid": "fcd1cac3-69c6-47d7-bd18-abff7f29f508", "comment": "Malware payload", "value": "0db5e8ef18f657821ea8077e415f0151c49b68571c6906691ab2b8dc01e3a67a", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372161, "uuid": "f5e8f367-0476-4a7f-a749-077989ac7ecf", "comment": "Malware payload", "value": "648248959a28c76dd347b74934b57dae9f87256b", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372161, "uuid": "a07d4c94-e009-4151-89ee-932ed0d15842", "comment": "Malware payload", "value": "0379e28cd1b1f03ddc88df9fdf351ecac010aa4a1fdde71869dc63160e51d8219a946ed9a56b25c70e93c94db49a42a9", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372161, "uuid": "eadd4180-0603-4e7a-b659-79de2cc92b31", "value": "T19395235523990E13DEFD17B4F0A0131B9772D5320073E7AE35AD84FC6B87BA2A664392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372161, "uuid": "bc3296cc-ba62-49b6-9edd-50ca00eef161", "value": "49152:NLzdJy9jEhhXFxAXVUw3yqQro900RheJYCVLy+Lv:/kj8LAXuo8s0xfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372161, "uuid": "320075a1-f4f0-43e4-88b4-89be8dacf7d1", "value": 1982464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372161, "uuid": "94ced122-597e-449a-81df-5ef3c78e26e9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372161, "uuid": "efac2330-6b87-4678-8567-e3cd266631a5", "value": "OTX SOA IN JULY.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd30fa50-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372164, "uuid": "af46f677-95f5-4d8b-9ce1-f0ed8cc5714c", "comment": "Malware payload", "value": "ffa13ba7ed18f34deba0182959b21266", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372164, "uuid": "e53fdcf3-28f9-4dc4-bff6-2973a8efc6b8", "comment": "Malware payload", "value": "0dc3d2dafdfa5b05b4c318516814db0d7a11c886f6298ad24f340a912e819b98", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372164, "uuid": "9cfc203a-3a1a-4deb-bf5d-55a4ba8034f6", "comment": "Malware payload", "value": "5388f108398675051bd2b2a392cdbaecb625c41d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372164, "uuid": "eb6e9a0b-b42c-4ecd-a73e-4d5b909e54c5", "comment": "Malware payload", "value": "f682ee13f78447b1c728a88c1c14640c6a8331b28f9fa58e5e278eccba78636dfcec1e2ebed08c7af5140764f78a4ade", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372164, "uuid": "18293054-eec5-4199-889a-61b3c2e5873f", "value": "T159C1AFC9AF37B627CD61843637B880109BCB539D258DB46E118A0BCF55C5AACF74682B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372164, "uuid": "19de7267-4fa8-4c66-9814-38793ce58d15", "value": "96:6SL6O9oJnyHK7SKVgqQAbTEykvu5UUIQyF43ZO8VGcPut4sl+p6/oqn0FjJkN5aa:6C6GWnuLehQapkqUVF43ZfVGleFFjSLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372164, "uuid": "b610f4e3-350e-4c8b-8734-a1b7e76431ee", "value": 5869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372164, "uuid": "6a1353d7-cbf3-45ea-bf2a-9cab89bb082c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372164, "uuid": "a3126352-e7aa-49dd-a5b8-176e38d350e7", "value": "Rechnung_BTKR24_0008703_52109030.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1c9871-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370442, "uuid": "1eb6a8e9-a291-461b-a161-1aff01dbff20", "comment": "Malware payload (StrelaStealer)", "value": "9cd4e82d2315c21f013c8c61928d3b97", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370442, "uuid": "1bdfa01f-fc50-4662-a30f-f9b18a3c342c", "comment": "Malware payload (StrelaStealer)", "value": "0de1c5fd4c8c9704d08bc75785b0368dd73fcd8aee50c5e23278aab66c7becfd", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370442, "uuid": "6131b9e5-07bd-4ba5-8f7f-8412f78e1a23", "comment": "Malware payload (StrelaStealer)", "value": "27564b8250eeeeb4b7a3245309db51cb02bc8355", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370442, "uuid": "1aaec8e2-786b-4bc8-8252-093830fa7c37", "comment": "Malware payload (StrelaStealer)", "value": "55ac2c3809729f2c0f984709de43104075747a6828bd94704ba5c70bca4a93cc42da5c64704f725ff6aa2ca866c0b42a", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370442, "uuid": "3ebc8137-d00f-4729-9cc2-d74b31e5375b", "value": "T172715CC5F1C4F655D29A00B1313BAF14F6E0FD054E564F0B8686F05266E37314F5D966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370442, "uuid": "b95efba6-1ab0-4531-b0e9-b6c8e2c4d4a4", "value": "96:zwH/RQwrSu4LayreyBP4yg3jEH4Yz+OZFaBjAlXn2V/N4OVED:zwH/RNrSuMrvyRzEH1GuRnW14zD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370442, "uuid": "1cf6b74b-5524-4f79-af76-c84a1d5e03b8", "value": 3579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370442, "uuid": "bc81440f-54a3-405d-945b-46b5bff00df7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370442, "uuid": "2bc93817-bd5c-4cd0-9a87-875b6fe13edf", "value": "GFC_-_Wolfgang_Endress_-_Rechnung_Nr._20243058.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1413e6-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1779370445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370445, "uuid": "3423589b-dcb6-42c8-91d5-59fed8b79ae9", "comment": "Malware payload (DarkTortilla)", "value": "bfae2e1ab58956a1320328bc8b1fc55d", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370445, "uuid": "1d9c2754-eec9-401a-9bce-9692519a0b34", "comment": "Malware payload (DarkTortilla)", "value": "0e0cb0e9ebb337ed6af2b58a43792b8d332024bdd31493648b76fdbfc1f0ea3f", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370445, "uuid": "71a5d3aa-9917-4b27-b9a9-cccf2e0be390", "comment": "Malware payload (DarkTortilla)", "value": "d99e4bcaf70141022dd64a30a807acaf6a7fd278", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370445, "uuid": "a102c735-f3af-4bed-a82b-a5661d605375", "comment": "Malware payload (DarkTortilla)", "value": "63346314903dba2e8c58259c4216fe2543b2e03b7d4f0afa5ce73cbfe3319eb81348648acf010a36187a1d49bb562c56", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370445, "uuid": "c3a9ef3f-bb33-423d-9557-ec2bb67ad6e1", "value": "T132C4233D1A624B23BDFF706F65B86444E27366139DAF4E447FAF2D099E20135A0A4F09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370445, "uuid": "6c989f95-498b-45ab-9585-9e67edf0dd8a", "value": "6144:+CyGnieRVCx29MUH9h2mAaAwtgbAV84BGKLLKijsEHDqn0b95OJ0jlfqe5L4CZ8w:FyGnieRVXXSZo5GsHjotuUcdCFiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370445, "uuid": "64f53be9-5301-4e59-9486-a27967cc87ee", "value": 548546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370445, "uuid": "437a523b-dd88-441b-bff5-7375db4758d0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370445, "uuid": "4e12d405-ff31-45f1-8b6e-430b0d3d6fb0", "value": "009883827379283.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf200daf-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372167, "uuid": "d4f9d183-bf49-4d93-95e3-7d3d37893198", "comment": "Malware payload (StrelaStealer)", "value": "c60631f725c7c6fd6470c5d86b6c624e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372167, "uuid": "a0f0ecbd-16d9-481e-815e-6dc2b51309f2", "comment": "Malware payload (StrelaStealer)", "value": "0e45e1b2fa3de6899caa8e401771825a5913ca3108e7730900835ee9d7b8c8a3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372167, "uuid": "943cbb56-3a2c-42dd-a1d9-3168724bcbd3", "comment": "Malware payload (StrelaStealer)", "value": "6ca84ab3f3d9bd1151fcf8381f29309900c6114a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372167, "uuid": "04083ec4-3cf3-430d-904b-f614f80ca5e4", "comment": "Malware payload (StrelaStealer)", "value": "c9d66f3d3ece789dfaec822492a0ca5a1c0e722a13a212e8b770a6d73dde4335f676d369cf37a90f70ce9252f31f04b3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372167, "uuid": "3afc8343-9113-40d3-9a7e-3318b1d7ccde", "value": "T1AA2273159127CB399F881A8361683053887530523CDFDF7BE51A68CAB27CFA6E3A107D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372167, "uuid": "35838ce6-7b91-481f-affc-51211a2757f9", "value": "192:oLtskrA51ASYj3BNHhPM3N4jKOvgaHfp8v1o4m8N4jKOvgaHfFpDQJV:EuT1ALZhPM3N4jKOvga/p8v1o4m8N4j4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372167, "uuid": "b06a81a9-6cfb-485b-91b5-a6f762c38962", "value": 10192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372167, "uuid": "f75b653e-0f5a-485c-b235-3800cd210d40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372167, "uuid": "f3d931ab-2df0-44ff-b318-0f7957d9e06e", "value": "501631954957523182.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8111b245-5514-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779368197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368197, "uuid": "5eb75ed3-a08e-4e14-8878-3a226175e2b4", "comment": "Malware payload (AgentTesla)", "value": "354bce1b735556a864f1240f7686c60e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368197, "uuid": "1b57379e-0e1c-4af1-acbc-1557cf8a6285", "comment": "Malware payload (AgentTesla)", "value": "0e6b2a35eab1409b4c48ad0b3faea07305558b743055369a4d1d18b522579878", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368197, "uuid": "0401553e-5149-48cc-9e2a-5358c1caf152", "comment": "Malware payload (AgentTesla)", "value": "68631cdfaab2e3fd5d0c25161da288580896f86e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368197, "uuid": "9d44ee31-5fc3-4fd4-9043-9ba284b03c40", "comment": "Malware payload (AgentTesla)", "value": "eb9af12a1373b2ce70f4750886882ccff395a829efac89feecace0ca8f3ef5a267f0ce997b0580bd23cae79ce1bd329e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368197, "uuid": "60e2ca93-f9d3-45fd-91b0-d01e52739636", "value": "T175152308EDFD1FEE469411B5F22B9E0829F46694E249F0F236E8D5C7EE85F04B646C81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368197, "uuid": "5ed97e82-ed41-4b77-aeda-732dc66ef732", "value": "12288:wGCyh4a+HeIFhNWyHjIWy6Jc6ARz23JjKHKf2Sqim7IWk+MUBzgvDxzqnlChGI/R:lC7TFhNdj7g6Ky5PuSVUIlfCgb0oL2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779368197, "uuid": "b204454d-d985-4bd9-a768-8a3862f04b65", "value": 938988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779368197, "uuid": "93faf275-0215-40a8-a841-c430975cf9db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368197, "uuid": "5a807b19-5ed3-4c75-9cff-4a4ce87ecc96", "value": "0e6b2a35eab1409b4c48ad0b3faea07305558b743055369a4d1d18b522579878.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29d6e06-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372173, "uuid": "57448e23-3850-4117-bac5-61fead457da4", "comment": "Malware payload (Formbook)", "value": "e43ab47be1f8fb003369f6042930892e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372173, "uuid": "b7c2caf3-1a78-47e3-870f-65446db08c94", "comment": "Malware payload (Formbook)", "value": "0e9cc5f817989d3f415dbe505b11bc79e34cf32e98ed16e14e1bd40f35b0724d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372173, "uuid": "9bd2884b-213d-4510-8284-97ecc6853d21", "comment": "Malware payload (Formbook)", "value": "92f107349aba43ed2eb9936f823bf5f45e2f5900", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372173, "uuid": "2cf82c58-03c9-4959-8baf-76e77c85af0b", "comment": "Malware payload (Formbook)", "value": "f3a265efb452f79bf4c33287a7eed4ffd9356d87da30aaed519d1bd56250d28ef461ffd1569a3bcf3ceaa539250bec71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372173, "uuid": "7422b98f-38c3-4cfb-8e78-5e781da88cd1", "value": "T15C05F05436F82FA5D5BAC7F91160601A17F2B50F64AEE2460EC774CF6AB1F410BA0E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372173, "uuid": "5b1009a6-e2e0-480c-bf6f-2d3ed8580615", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372173, "uuid": "6e2039ef-c609-415f-8f59-8864df3fe123", "value": "24576:9hRA5WSg566nXZhQaTxLay/M/XMt/+0BZx:9bpSgo6npFx+y/aMt20BL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372173, "uuid": "8b563c90-d836-470b-81bf-ba965eb7965c", "value": 812040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372173, "uuid": "d1110803-c0df-42c1-b03a-12b9f18d96c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372173, "uuid": "0a9176d1-71e5-4d79-ad42-5564e03312d3", "value": "NewXOrder_00200457.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f07fddd-5525-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779375415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779375415, "uuid": "17b4dde7-9543-48a5-9e27-bbbec32d5cd9", "comment": "Malware payload (Mirai)", "value": "faa9a18fab1a2e7141fd4541aa795b61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779375415, "uuid": "393dbeb0-86ab-4122-ae84-78eac2c727ec", "comment": "Malware payload (Mirai)", "value": "0eb6a40b077562a2d2d11f89e25958262c409e8e4f239bd7ce3ebf1cc289b9ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779375415, "uuid": "500ae1af-947f-422a-abd0-694f9122023f", "comment": "Malware payload (Mirai)", "value": "18f85999a102db68924862d0ef30ad1024e8c246", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779375415, "uuid": "ad4ddce5-7761-47f6-9652-41b8b2ebc2d2", "comment": "Malware payload (Mirai)", "value": "b64681c4a1b41f35409fd559ea95318fc20cb65c30560d1d16a30dc6ba9075bfe791b2a1b9df71c015da4770f379b14b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779375415, "uuid": "0cfdbc42-c427-483d-91db-4365926c4c86", "value": "T19D1302CAF4F58350EC773E331EDDB20A2150691C69AD817AD4D2760AE03AF8C5819F9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779375415, "uuid": "be30eaae-c45c-4985-a5d6-4452618bbe47", "value": "768:fImhn9jpEscPBTZ8YsMX0Gj2N7ljyUo+6u4Rm1hAbS2qqvifnbcuyD7UGQRjI:v59C1PtWYsO0GjCjh4oqBT0nouy8GyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779375415, "uuid": "11701e62-bb35-4c08-a339-18ea6fb6aaf6", "value": 44776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779375415, "uuid": "344bd6dd-9f0a-4a96-a4d6-cf729eaab828", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779375415, "uuid": "99e148a9-11d7-4692-80f1-32b371da9e4a", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a9207b-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372176, "uuid": "8bf96edc-55cb-4886-9b1e-57e7ec940967", "comment": "Malware payload (AgentTesla)", "value": "4d745996210940d586af0d03378c8fdc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372176, "uuid": "6f25fa42-7d68-4be6-ac03-4f9a471a6043", "comment": "Malware payload (AgentTesla)", "value": "0efed3b303e58e99f42f522e0c357c0b42d5999db3770f8bf43513869215c472", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372176, "uuid": "b76e0d37-3c13-42a2-9c86-2432fb8ce1b8", "comment": "Malware payload (AgentTesla)", "value": "6e38494f9fb7bf9813d89556711ce55c3fce51f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372176, "uuid": "bdc6e197-15fc-4b45-b54f-250681ea6183", "comment": "Malware payload (AgentTesla)", "value": "5f5e12264753e5f050babc1fce0c4c62643c6440cf9cbb15f17c9b9a22af604fd0fcb173ac22f912b7024049b77d0370", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372176, "uuid": "0dbcf5c0-3d80-4f3f-92fb-5a89ed068df8", "value": "T1AF55AE033780C065FFAB91B34B47E61057BCAD7A4127A61F17981A7ABEB05B1063E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372176, "uuid": "30fc5dac-a5e0-4b85-b6de-9453d619b242", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372176, "uuid": "e04d94de-07d7-4055-a351-2bd6c54553e2", "value": "24576:VqDEvCTbMWu7rQYlBQcBiT6rprG8ag6nnjqKoepMaX0PJxil:VTvC/MTQYxsWR7aljqKoepMaEPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372176, "uuid": "0a58e47a-2ce7-49d0-990d-f3a600ee9c96", "value": 1313280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372176, "uuid": "406b3419-c085-4744-bfe6-4c08ff228180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372176, "uuid": "050750f8-3a8e-48a3-ad41-a0ebe6512abe", "value": "PURCHASE_ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c213ae68-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370454, "uuid": "5da1f9d0-198c-48bc-a711-ce915cca8e78", "comment": "Malware payload (StrelaStealer)", "value": "a633bd50d7b0dae078bf8eb253268e90", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370454, "uuid": "b24ae043-c3dd-425b-b250-2af2bce549ac", "comment": "Malware payload (StrelaStealer)", "value": "0f0f811b603e3d0d4ca3be4b3be16a8bbb1ba0b8cdc3633bf1e43328d34ec7d9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370454, "uuid": "3e543479-edb7-4a7f-96bc-c25eb144eb95", "comment": "Malware payload (StrelaStealer)", "value": "b70ffadf3f3ed6e05b40db5b523c6320043ecb38", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370454, "uuid": "2aa87664-b70a-420d-a6dd-d434ca2610da", "comment": "Malware payload (StrelaStealer)", "value": "4edbc6d0ebf64b4e4e40522a9cc394b2ae752f5dbca2b185e575d3de7caa3de6fe738361ab4d4a2c50e421fa93f24b3f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370454, "uuid": "3d81cdc7-671a-460b-86cc-a3882d5a1580", "value": "T13E73AA8B1BC8FFB94D77231E0EAAC4098E874CFC6855BA1C778F5909D7696271CE0168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370454, "uuid": "d1d23a38-cd5a-45ff-a5ba-6961c18027f3", "value": "768:eACan1qaCd9nt9wnbf71tt9pbti+gFtDfz1fDwt+CJbtFVtHIt5HiyRAESD78FJu:HCQo1tL8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370454, "uuid": "6e7491f2-062d-44a1-ad15-63071db65420", "value": 79697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370454, "uuid": "4d413f81-1a55-47f3-9478-0ca58cce8e15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370454, "uuid": "39bdf960-f48f-4796-bdc2-1d15616abc68", "value": "29814279301592111351.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68fd9b3-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372179, "uuid": "71208d32-80c9-4ff7-8e67-80dad339bb09", "comment": "Malware payload (StrelaStealer)", "value": "edd711e6ae5ba952d8bc3586e9833314", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372179, "uuid": "3f8c4565-0ab9-4a8a-b878-36197286e289", "comment": "Malware payload (StrelaStealer)", "value": "0f30d30a5ebaadc0adca0018bc80f78b846a41ecc6aeb879fb7f96db5bfe5b76", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372179, "uuid": "5aae3776-443d-4d68-a7c5-a1dfb92abed3", "comment": "Malware payload (StrelaStealer)", "value": "10445ec8f4095a2b7436a79237e8c8e727d003bf", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372179, "uuid": "3c4b61f2-72c3-4655-80e0-ddf7d058cd04", "comment": "Malware payload (StrelaStealer)", "value": "c88e573886c93c01b21c31b063e4c6d324ff097730094c20eda89ff0cdbdfba6d8cb23a2fc6cf173fd0729d2af7dd6e5", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372179, "uuid": "35d5353f-c9b7-4a3c-b578-241cc7196bf1", "value": "T1EA31097CEE8311C9DB8218B83687A6A135EA2DD902ECA48752B549C5F48C96A3876384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372179, "uuid": "ab24ed3b-b416-4d95-a050-1f96a0103726", "value": "48:9SSEcIi/p+kHXam0uIlhbtXCUahLa6NYK8VENL8lo3co:KXi/AkHXPQLb0hLa6V00v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372179, "uuid": "f6b7ef39-ee44-4598-a2fb-6450956004ed", "value": 1849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372179, "uuid": "285f5dff-4b26-4348-b34c-f17dcb60514a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372179, "uuid": "9e53b397-e6a3-4fe5-9918-40e51ecf385e", "value": "RP24916095.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c887ba5d-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1779372183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372183, "uuid": "11616682-5a0f-4a46-83ca-7d0f2f723046", "comment": "Malware payload (DarkCloud)", "value": "09dd3affcf7712c622550adb170e055d", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372183, "uuid": "7366629a-cc13-4d7f-a6fc-3a7c563db188", "comment": "Malware payload (DarkCloud)", "value": "0f31077df9d5e4c458ca883ceba0cb1fc60f4af060850c118e29ef2b492ccdb4", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372183, "uuid": "59ce1438-957c-47b9-99f6-af9ab04a4120", "comment": "Malware payload (DarkCloud)", "value": "a801e14db6adcc6713d6443c770aa30bdf164dd7", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372183, "uuid": "8cfd49f2-02a1-4d7a-a427-6ccd34098dbe", "comment": "Malware payload (DarkCloud)", "value": "7cdc18c77734021888906a2bdd57a8b157fc8306492f9e3b1c48f111363d58ce9f4d5f5477d3fad3f1b19423e8ee0f1b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372183, "uuid": "90fdd756-d83d-483c-a84e-64a7054f3bcb", "value": "T15694231CC12E485F8AF665266DE8B31B08704FE6C330DE7DB7451DA7AEE024E5524CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372183, "uuid": "a496378d-8776-4986-891c-74bfba5629e9", "value": "12288:gmfM4T44XbjkP6jrsHPACPyQsvX15eAM3hH8NK74Mwow:rTvjkArsHFyQs/1ob2qxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372183, "uuid": "659ec967-af88-42f7-9970-c88c0794e3a1", "value": 414585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372183, "uuid": "d6166d33-7ce7-4c03-89e8-e102678d1478", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372183, "uuid": "ff8756a0-e8ed-4258-94e6-e15bdc0916f8", "value": "PAGO_BBVA-15-08-24.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca844b02-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372186, "uuid": "735e26fb-fae2-408b-8024-b8a2f2f4cd1a", "comment": "Malware payload (Formbook)", "value": "a757313556ccfa83828bca56638d626a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372186, "uuid": "64f97316-c24a-4883-bd28-4de50cb7c0e5", "comment": "Malware payload (Formbook)", "value": "0f4b7ec082f20162f96561f14312eeb1a7ce9700a08b9403cd77cf53f7496b6d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372186, "uuid": "f48e8ae6-cf1e-41fa-832c-9b2423bdac3a", "comment": "Malware payload (Formbook)", "value": "71e96a7d4b52a571754decc2f971756c1b682769", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372186, "uuid": "b828ccf7-6edd-4f9d-8850-37a604da2fd6", "comment": "Malware payload (Formbook)", "value": "1c63919f01d6486e8ced471b7c605a0eacf411e89e5e47f26fdaaffdad697a9be341fa2fbe1734e8526acd06c2102ce7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372186, "uuid": "1169dba1-ce68-405d-aed2-56617b422e31", "value": "T100E4238A6C18D297EB506503C7D6F8C4C0CAAE8BD51E255B8327DA3688C7DF207159FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372186, "uuid": "206d66a6-0ba4-4ec2-9d1a-ea5f2d4ed119", "value": "12288:4a6wQCYgTIIqoETUGPyoz6BKgxPuDNYiIkUI+9AOcpKC+bD2UEzvXS4j9xczH4F:4a6X3DIIYG6ozSK+2Ek06OcOP2UeKO2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372186, "uuid": "51ba82ec-75b4-4e4b-9257-577bed2559bf", "value": 688220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372186, "uuid": "6124f699-f907-4475-9879-bbd9a3a3b594", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372186, "uuid": "e1d7eda1-defd-45a1-a12a-ad7a56d052e0", "value": "PURCHASEXORDERXPOX#X2107-20454X24.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc92ceef-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372189, "uuid": "b3405362-cf7e-4985-be7d-cd287d18f0cf", "comment": "Malware payload (Formbook)", "value": "6131be6ecdfd66ca3250af5594cdbde3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372189, "uuid": "1f292911-3fef-46ae-a6df-4056d64cc2ed", "comment": "Malware payload (Formbook)", "value": "0fa10af85930601318378b27be24ae529dac371427dc75a51fe0fa30a6d1c956", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372189, "uuid": "a3bd8bbb-f477-4007-ac18-f6dd3f952093", "comment": "Malware payload (Formbook)", "value": "4fc468162c8d2c017eb918ddff3189858d074dc3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372189, "uuid": "9d09ed0b-82f3-4378-a478-ffea4cf45787", "comment": "Malware payload (Formbook)", "value": "22fbd2cf02cb2a35070f87ce7d8f126223a202ae9a0cf69dcc46f4add30e8eb0bf85364eeafe281429f17b27d4026a5c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372189, "uuid": "58c50b94-6118-416a-ae04-3105c529fb30", "value": "T14BE423E09E040D94B53163A8BDC72FDC748E9B6AA33140A77ED82D4297F8C56207B1DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372189, "uuid": "3a3457b2-e83c-4e36-9793-440cb4286569", "value": "12288:2PtqJJw7nL+yo/Ys0LKgPe39zgd8qayD3Jkp7r6QYBlhrNhbPqBoS8qQ/thYu:2PtqJO7KyGFD39z27aW3Jkp7r6QYBfZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372189, "uuid": "d47e8374-9fcf-4ec4-bd64-5548b820b669", "value": 705256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372189, "uuid": "f259a62d-8d99-4ea7-9320-062e2a688e14", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372189, "uuid": "fa54ae19-0290-42f9-b872-b2c5b4cde95f", "value": "PurchaseXOrder.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ac333e-54e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779349878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349878, "uuid": "4a9ae769-2f85-4d7e-9a49-4460548c69ab", "comment": "Malware payload", "value": "474249386dee8f7d594a6141e6174c2d", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349878, "uuid": "92f21719-4fbc-485e-b264-5e1a1275faed", "comment": "Malware payload", "value": "0fdeb82f7a175fdf9bb59e29e21dbd9a94298ae6a657c38e0eafbe5c7e642a12", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349878, "uuid": "c859e1b7-54bc-4bac-aa58-5c841979905a", "comment": "Malware payload", "value": "c6fcc470c527b7374ea3eaa19e389ec8c5504309", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349878, "uuid": "851e4b2c-5017-4f42-8a5a-16abbb417100", "comment": "Malware payload", "value": "cee9d6286206df90c17774cc99d59139227ea19638aa566e900d90fee89ee3615db3e28371165cbfba32560af13f116e", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349878, "uuid": "f9462731-f627-42f0-9317-c289dc748a1e", "value": "T19A53B7C9B7D7F066071931A73C3B6A97E22ECC8DB8488544EAD460EF7838724D47A974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349878, "uuid": "b345a63f-5544-4d27-bd20-cdb9e9bd8b4f", "value": "768:1AKkxhmwpSadGmA1+dNbxr1ZB2aplhmUBCBEYltIuPb1Xou3b0rrYYx+fDEELEjA:1x1+dXJZAUQCuJXou3b0r3+fdorkQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779349878, "uuid": "fac41342-c630-4043-aaa3-2d6db5bbe99c", "value": 63348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779349878, "uuid": "bf3333cc-e4bb-4c05-8d48-1f6f3b19b6ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349878, "uuid": "54772d28-2ba4-40d0-a111-03799877573a", "value": "ELYBANKSWIFT26_UEL200_PH37910013_NA73200118_CY7382010183_TD679101038738.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b7f7b4-5503-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779360954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779360954, "uuid": "891de0ed-a6e3-4924-b3e9-2691aeb3e9f4", "comment": "Malware payload (MassLogger)", "value": "dc8dbb5812edb5e104011d84d409bc71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779360954, "uuid": "84b3d412-03f0-4f08-ac6b-2f9706a53196", "comment": "Malware payload (MassLogger)", "value": "101bd5c2dc4ecb68e017d163bf7b8c472e12a3942cee6c9eed6ec70928409b26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779360954, "uuid": "04460241-7975-445d-b6dc-8dbbf5f57455", "comment": "Malware payload (MassLogger)", "value": "e710028e0e925df79b95548538c639279419f047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779360954, "uuid": "f1cccd79-5a34-4ddd-b5cc-627a0a877eb9", "comment": "Malware payload (MassLogger)", "value": "3c3e5691b33f7490eb4f9ad099b415d68ebd1ce498560f9439f81df7d9475ea0f6c7024b2432abbfbd14483d770ab92f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779360954, "uuid": "b8ee6cd3-65b1-48d0-b64b-8ac0fb8d4a10", "value": "T10A0512A86E68C543D8D617B45961F2B027B4AE8DF310C6278FEDBDEF787A3505904382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779360954, "uuid": "dd738aef-c5bf-46be-89d0-1bb2c89ff5f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779360954, "uuid": "3eb96b03-62d1-4bd0-928f-04b45f52525f", "value": "24576:/JWF1bzPZEYlI4R10IpdIK/Js5mmWjk0IqnM3xkPp0/wh:AbbzxzViIpessfWoTxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779360954, "uuid": "f452f068-5947-4c77-a9cb-d69c04a51e89", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779360954, "uuid": "430e2415-c008-4c6b-b6c2-a42f355a8b99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779360954, "uuid": "4ae74271-376f-4c88-9bf8-4929a8dba19b", "value": "RFQ_Stark_Srl_SDH9822.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b784785-54e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779346552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346552, "uuid": "f72596a5-8bf9-4cb6-b68d-74bf01109384", "comment": "Malware payload (Mirai)", "value": "de2a9219275420902130eba1405ca319", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346552, "uuid": "5e0ddd5a-cdfa-43eb-b518-d0830cb3d443", "comment": "Malware payload (Mirai)", "value": "102565406ab0a0e0b2d0c7588d9ecb693043b22b3c26ed1e71cea1db517e4493", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346552, "uuid": "6d02eda1-e814-4a16-a5cf-b7dd8e162db8", "comment": "Malware payload (Mirai)", "value": "a4f95f02bb60f780dcc9a114e59071c3e4bf21d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346552, "uuid": "63ff8869-1198-404b-8404-3f702cd0f00b", "comment": "Malware payload (Mirai)", "value": "942c934ef00a2dce0328e8ba10aee61b501931d0a3ab74e5ae33bb4ff7d0c300fba30f14265374b5f498d8f349a9ff85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346552, "uuid": "928be18b-9252-4e0d-8808-09d65ddf04fd", "value": "T107737BC5EA83D5F4E89241B06077FB36A73AE639003DDB13DB99E936EC42A00D65634C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346552, "uuid": "7b6c78a7-ab0f-4fae-be9a-8f34b79c202b", "value": "1536:KmdnGo/ISDUW0i6obD87wc9Dqvnul41Eh8WTkAQ62SGT:ddnGoTQWz87FKulEEeskx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779346552, "uuid": "9f823d79-7231-4334-90af-02ef9b68f34b", "value": 79412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779346552, "uuid": "08a8522e-4b6d-4e57-b9e7-176ef0ab91c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346552, "uuid": "30aeca8b-d7c1-46bd-a404-a0cdf4c4e171", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d028042b-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372195, "uuid": "7fa264d8-e6ac-4d49-aa99-71c113647b51", "comment": "Malware payload", "value": "13db78ce484eca4c4de0c0d9588e73d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372195, "uuid": "4ed813ad-f918-411b-82eb-b64708d81969", "comment": "Malware payload", "value": "1051b5a48a4db66f11b8a28762bc7fae03de6b0a425dbfea26f89b0d99506959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372195, "uuid": "6f1d941e-3cc7-4322-a077-75c3e6e50655", "comment": "Malware payload", "value": "426eecf28cc830d86ba06c7436eff7691bcdc75b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372195, "uuid": "1205be85-67f0-4e7a-b673-543becd135d5", "comment": "Malware payload", "value": "e8363deeeb9b222c81fe00cd3f330e622b99fa50fd30c98f9821066def733b13ee1f5fd41003b626b39c68fff5f0cd1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372195, "uuid": "2425e0a6-1850-4f39-be9b-fb4baf5317cb", "value": "T1947533F216F167EAD5C157F0339D471EA7FC21247A5607AC6389347BDBCBA805EA0888", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372195, "uuid": "dd48abd4-8c16-4b7e-aac1-d914adf7bbec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372195, "uuid": "f5797876-3df3-475c-9940-3f1e02c9c2ed", "value": "24576:m0VfY3Cwz7l4vFd1AknTHQRK+qZApFZiWhd/9jEbpbdszpJ6TuUQSC/+wQxCxlh:JY32FdnubqZANiQdONpVC2wQw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372195, "uuid": "c47f0a0c-22cb-4f2a-9ba6-16bd7af61428", "value": 1633280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372195, "uuid": "6012dc56-b743-4b88-ab4d-024e254b6c1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372195, "uuid": "28940f2d-40dc-4717-ab97-83abd92c9bb5", "value": "sc_copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13dafeba-54f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779353841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353841, "uuid": "ea42ba92-e893-4b39-961d-42df72ecd580", "comment": "Malware payload", "value": "0c9c97a332a60d19c3d1369d03a27f99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353841, "uuid": "c9fb3cf5-8e6f-4af4-990f-8a1cb5a5286a", "comment": "Malware payload", "value": "105a60bceb01b8575009bc941a2c719187d63c689203105e55c50f0d101ef4a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353841, "uuid": "031abdc1-4f8c-4192-9be6-a3f179cc03cd", "comment": "Malware payload", "value": "fc53410327b728b5d4a9897921fea2750ae57595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353841, "uuid": "8b620a51-335c-4c33-800a-0980a6be3674", "comment": "Malware payload", "value": "b5d7af059583e4956e6b7385b7c4454f1398342a189cd69a5cd4b6aa2c3ad02f257ba703a84e2cd35918e1a1c054f6da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353841, "uuid": "eb8360a1-e2fa-461f-814d-6252e3694a2f", "value": "T1DEC7333BE256A43EE1185B3579B29521593B7A51A4028C8686FCF8CCCF7A0701E3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353841, "uuid": "dd32d5a5-3b04-4d02-b9c1-6609cb6ce11f", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353841, "uuid": "58f4ac33-32ef-49b8-9f73-03338888282e", "value": "1572864:nZT5vQnGbS5OtUIYjFbUTtpYlQn9IIpiI5:nZTVLZuFbVanrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779353841, "uuid": "9140c0f7-9f88-424f-902b-9e22170e1e4e", "value": 56580857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779353841, "uuid": "3203e994-c598-48db-9b8b-2a7f1194db4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353841, "uuid": "f1fc4e56-2b20-4401-b4a0-a827a18de47d", "value": "105a60bceb01b8575009bc941a2c719187d63c689203105e55c50f0d101ef4a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2563bb8-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372199, "uuid": "41504fba-90c8-4ff8-800e-a6d849d5a711", "comment": "Malware payload", "value": "1b8c67d564ff63fa1aa3e83297538eb4", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372199, "uuid": "e783cca4-1c09-4739-9491-b15da5a63710", "comment": "Malware payload", "value": "109530b5a04dca7d4bb6a646e30574a960d76abe954751614d396417bae9c463", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372199, "uuid": "4b914284-e79d-45d2-9d3e-6fb707c70c2d", "comment": "Malware payload", "value": "a8a2d6f556b54dff5d72a3c798666ba9c9618d1c", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372199, "uuid": "21889149-4e7a-4e63-832c-a52cf69f2817", "comment": "Malware payload", "value": "6c089a572595c103168844804cd17a01257f2a9c74aab1b2ac60d990bf89565553898497d522c1812dee8837ef48cf9d", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372199, "uuid": "493bd881-5b38-4a71-8d0a-370718a9acbc", "value": "T16B568257E48B61C22708A3EB634F49824CA3F63B1A7E6A9877C5221C0F335DDED9119D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372199, "uuid": "e4955e20-f6b2-45b8-81cb-67bd1e647e9e", "value": "49152:SKT0ymm9RodOObxwbu0a9dJxICIV71JsPxPZ1m+:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372199, "uuid": "89e8a800-288e-4122-b4c7-863cb07c1fbe", "value": 6330860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372199, "uuid": "0b3d8f6c-22d0-4a75-a230-2424ad696ee7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372199, "uuid": "cd3f9ec0-db57-4f2b-b8fb-6f6c751a83b6", "value": "Payment_receipt.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3daff1-54df-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779345641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779345641, "uuid": "644dba8e-d2e2-474c-8d45-094b872c2531", "comment": "Malware payload (Efimer)", "value": "34f89e89900d49680fa87f637fa80d7d", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779345641, "uuid": "451ca084-aca4-4227-8327-0ab31e962777", "comment": "Malware payload (Efimer)", "value": "10ad8c91b8c9ebc2a02e461c1e32b72ef594f516115e6ab5759df4076798da7a", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779345641, "uuid": "d2d4139f-80f7-40bc-b34f-4748255927f9", "comment": "Malware payload (Efimer)", "value": "d7d7f599771b6be5bae247c97bf87d0f213a63b6", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779345641, "uuid": "e014eebf-716e-44bf-a59b-859b98c2df07", "comment": "Malware payload (Efimer)", "value": "84eab886e25d480a65d68ff367d78ef75b80d728c90dc955f1254e793749367b3d067e7e8285792edc8dc8894ec54b0b", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779345641, "uuid": "c5d8c268-df97-40b1-8da3-bf7b13032b74", "value": "T127D63325E9D220DECBB78578F2F11974B851B0340AB5CD2AAA59C7B1FC3B690C67D04B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779345641, "uuid": "32ac53c2-4136-4c4e-9720-15d8725b0bf8", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779345641, "uuid": "2d40629d-77f2-4562-893d-8e1ab69c9089", "value": "196608:dgQvqVNBQDkHJR0KE0UnwsnPX3CLXMCHGLLc54i1wN+MCXPIcu9KYK39sI3PPGTg:dgQyak06YNKXMCHWUjXgcuI3/PGTAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779345641, "uuid": "3fa4a3ad-e7f7-456e-963d-13d56ba1dca6", "value": 13854197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779345641, "uuid": "1bc96e30-90f3-49f0-a845-fd2c9a6e3077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779345641, "uuid": "03d3f32d-2bfc-4c3a-af2e-f1e6d9cdfae2", "value": "SecuriteInfo.com.Variant.Ser.Tedy.8546.75396519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30780c8-54eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779350752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779350752, "uuid": "5c6bf0d3-cfd7-48ed-bd73-bc5cabe17b45", "comment": "Malware payload", "value": "75ba32416ec5dc0f4754f5a93072f01b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779350752, "uuid": "7db485b4-6c01-4a7c-a588-44b5c7b9b2da", "comment": "Malware payload", "value": "10d1cf4c236dd95a7bffe508604d77fdc11de55aa56627eab89c0ca62c6c4c76", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779350752, "uuid": "b0632a60-f0b8-437e-97a9-17c2caa3875e", "comment": "Malware payload", "value": "0b262ce71682f8bbef0fce40dafa59251b4213ff", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779350752, "uuid": "a80bc6b1-9114-44cd-9cd8-486b21fd1ca3", "comment": "Malware payload", "value": "ac0d3f316521d067c75aa1029261c5dcff3c9665e09234a53c4ae6b85ce3d6be100b218323b6b42d2797bc4cd4e13aa7", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779350752, "uuid": "3b759085-b478-4e86-a4d6-12e19312e837", "value": "T1E931F30456F887D4E7F28EB868BE36074836BE16D975CA1CC164116D04A0A13AF7AF27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779350752, "uuid": "913bf2e2-6a6b-4bd3-8e42-f336668f5c5a", "value": "24:8lLJ/Bqk+fVbiTcRtS2DvulqHLCmvH3+aDxwNFRwGD2Zuh6ZryipPvH3+bnOZ2zJ:8Nxoc0tbDWajW+xA7xbiBWbZzFRaQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779350752, "uuid": "e6ff7f07-a1e3-40e5-bce0-dbb1aa808ffa", "value": 1826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779350752, "uuid": "4b173f79-4379-4d4c-89ee-01cadcc956f5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779350752, "uuid": "ff7dde25-8777-4da5-970c-c99f2ce9b68c", "value": "List of Required Items and Services.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41ddd19-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779370457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370457, "uuid": "a0db0e71-c2e7-48b3-be1d-54c8a434778c", "comment": "Malware payload (GuLoader)", "value": "d016229b6e926b773bf1bfc9188dc8ae", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370457, "uuid": "2544663b-83d1-4c21-8762-ffd6652591a2", "comment": "Malware payload (GuLoader)", "value": "10e2006be8c2befd00b1ed41977c8f9cf7208de1922bc2630eb444434828e399", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370457, "uuid": "0cd0b2d4-a4fe-4abc-9d74-73e66522dc5c", "comment": "Malware payload (GuLoader)", "value": "fcb1ef65c20d9c11c60d697f6df42649fee16059", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370457, "uuid": "e7592940-95de-4cac-94a0-ea58c9a49582", "comment": "Malware payload (GuLoader)", "value": "367f922169a3815cb05af3810be739bf3ce609dc6b8bc7f6c233b88aaad40d4d574c36aa6d7b7ed77cfde160ba0e3d34", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370457, "uuid": "549ce5ef-3566-4b8f-83ba-62058d98f376", "value": "T182153378020615C59F6A75BB7759258320BB2BAA6E3FC7D0126431B9FC6E3610B3B17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370457, "uuid": "e033dacd-7523-4ff9-97ce-a6c492e5d93b", "value": "24576:eOTR9hsA0zROhilkL1NZWUIQt5gLkr0BJP3:e4L0ROhil6pdIm5gQYD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370457, "uuid": "dad62e87-0c98-468f-9764-7f9df0f3e805", "value": 916477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370457, "uuid": "d5954304-3ca6-443c-8627-8e6cee350a08", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370457, "uuid": "19b6516c-b9c3-4cbc-9bd0-a4e58ee4eae8", "value": "IMGCY46473567583458675867864894698467458.7z.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23982c72-5512-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779367182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367182, "uuid": "b64171ff-ef06-4603-8887-4b79c956f664", "comment": "Malware payload", "value": "5217c71d3464b6c4406abc70a5d0e6ae", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367182, "uuid": "65dbca22-9953-4bb1-bd06-ab45da9fc32f", "comment": "Malware payload", "value": "1110536da6a392190d7d05cfbe290b94647abedf2e12dbbd9409f04c63afdeee", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367182, "uuid": "e64c951e-4189-42b2-9828-37a1cbc286bb", "comment": "Malware payload", "value": "8021c83b1b07ecb7f9fd08400fbf9e602c6b58e2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367182, "uuid": "939ceb54-6ea8-4b98-90cc-277052c9077f", "comment": "Malware payload", "value": "018b15da4a37283b67732ac3c160cbd26331d58d44224f0c94a9e7552722a4cafc43f698ec25afc2a74aebf68353867b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367182, "uuid": "b2a1863a-a0ae-4763-9b85-f23d7a538d3e", "value": "T147A5337206840692CA773E33E40ABD7FBD5A20B018E495CB6995854D3FACCE4EDB25C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367182, "uuid": "307c8cd2-a9b7-4ccc-b53e-fb4d6941d15a", "value": "49152:GJlYJ2Pzt+uTWdDqtOrGM78JcgsCFpeMisPNVA3df2:GTYJ26qsrGkCFpvNVydf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367182, "uuid": "80ec4443-5701-44c8-a6d6-04b3d0f8b2c3", "value": 2187616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367182, "uuid": "9b65ca3d-81ad-4791-aaf9-bb4e4bd9935f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367182, "uuid": "c4edc52f-6168-498a-917d-625d9842c3d3", "value": "inquiry list.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d497df-5543-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779388338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779388338, "uuid": "6ce1bb9d-434b-4e35-8fc4-7ef27c6a2be6", "comment": "Malware payload (RemcosRAT)", "value": "ba72dbe73061e3d5a6037fcc838302c6", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779388338, "uuid": "17a51ae0-70db-42b1-879d-ba982db9e203", "comment": "Malware payload (RemcosRAT)", "value": "1113a52cb6ac061c4b08c2cc5831b6f824f6742b14ebfb5c706374ad1016d41a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779388338, "uuid": "f068f11c-0d49-4cc4-bf31-04e3f8f9a8d3", "comment": "Malware payload (RemcosRAT)", "value": "886cb74d43406bdf505fa0fd6b53f05d24626628", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779388338, "uuid": "62a50a61-a183-4d1b-8b17-2c181aaf214c", "comment": "Malware payload (RemcosRAT)", "value": "3ab9b3f8820ffac3360f2e04150c1e11bfffed2c440f5707183690682ac19ce57e3ea6a12106d4cd1015f317b0f9cad1", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779388338, "uuid": "d55eb66b-4407-4dbd-b3cb-379ea2949513", "value": "T1BCC2943BC584AFF40B5A62D2298F3E1756490713B5743A0DB8CED48D3B6A3608BF54E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779388338, "uuid": "391a371a-5ca6-4972-ad76-86469238113b", "value": "768:KjDY1sp+ueFDYdDsKHC4wEyfFgM0Z5eaqq5:R1KheFDWDsKHC4whFgM0Z5eaqq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779388338, "uuid": "e6e87ede-f0ba-434d-a48e-c359ab4f7c07", "value": 27971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779388338, "uuid": "4f7cc2af-7d85-4733-aa21-8901c9deea9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779388338, "uuid": "bd295547-1c81-4560-9832-06d40ad28af3", "value": "tr.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4588184-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372203, "uuid": "7a2e3eb3-9769-4d2d-9490-ec54c8f200cb", "comment": "Malware payload", "value": "ced618636b2d5aaa55dbfb285974e5be", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372203, "uuid": "27518940-d7ca-41f0-af8f-c72f5893c99b", "comment": "Malware payload", "value": "112468a380d155738bed39ee9951894dd101820b233270017c9854921a066852", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372203, "uuid": "d30fcdfa-c2ac-4825-983d-3fdf5a86525d", "comment": "Malware payload", "value": "1e12439c4bc78dd9431b95577bdde1e6d27ab291", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372203, "uuid": "43376f52-e599-4597-a937-a3fcd15050ff", "comment": "Malware payload", "value": "06ba76a52d00c1e98a87490131676c3ed9196f6faf22efe0fd67a3e3fa747b42e49e7f91923d8e2a2a70a92b38150a3c", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372203, "uuid": "5add843d-6f93-4db2-ae85-63b1ce33221b", "value": "T1E8B238E77A1671ADC74572BD84254CC868F80B3E49742F072DCE72C83BF7A9462578A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372203, "uuid": "8d6ad9c0-8e69-4820-9f1d-4ad86d07bd72", "value": "192:z9kEqYZczz/w0EJCDR4HzJZqgZrkI0Bu9VdLGFbe4SCqlyIBXly2VcjaPK/hwGu6:GEqYZowqUI20rePK1lqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372203, "uuid": "ea1bf582-f801-47ad-82a8-6bea996a98be", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372203, "uuid": "73d9eb65-ee6b-460e-a568-0e8125e7b6e6", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372203, "uuid": "ab1996a3-5700-4ea6-9ac5-6dc45513242a", "value": "MY13497Q0008400MYKUL.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6177082-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779370461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370461, "uuid": "276f77eb-abfb-4cbd-a239-b3f312a6fcb1", "comment": "Malware payload (RemcosRAT)", "value": "c592b0c6cc862c16318fbf8c2c9424b0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370461, "uuid": "10ac221c-3b1a-41b6-8cd6-bc5f53e6ce5a", "comment": "Malware payload (RemcosRAT)", "value": "113fdd73572c10480aa59194b0aaabc3ad6fab78b9fe4bf0f9072310ee3a23f5", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370461, "uuid": "854eb3e4-23b5-4dd9-b490-c3bd9385c11c", "comment": "Malware payload (RemcosRAT)", "value": "a1dbd2f4b4982f37ed81624abc1c671697e5203e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370461, "uuid": "752d4830-040d-4646-8dcc-b3592150231a", "comment": "Malware payload (RemcosRAT)", "value": "98f062f63eb4bb3ac07017077127e7034280c7b692e7f46b28820bbbe6273b1e3cb12bf6eb78f5567189b00ae52fa00a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370461, "uuid": "feec9481-7204-499b-82b1-c1aeb6e7c087", "value": "T100E433E5AAABC7F85C18F77482662B83C8D9520CD92EB2028305CAC459796DD93D1B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370461, "uuid": "b36b11cb-deee-4829-a491-338a498a401d", "value": "12288:dowNzy8E9FxWtz28J4wGUvlYn0kbdEty1RAmjXUAEFoxBx8WtNADZZeb7EkOz:Fg9F4l28J4wGEun0DtdmjX1EForx8jf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370461, "uuid": "beffed18-b4ed-4994-b34a-cdb707fec90c", "value": 688896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370461, "uuid": "a29d197f-0c26-417f-9e10-622f0f71fa2e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370461, "uuid": "e974efd9-a0c5-4641-ba0f-05278c1aac29", "value": "DEMASI-24-12B_DOC._SCAN.7z.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daba0a40-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372213, "uuid": "ae9bbd4f-b56c-470f-bdf3-a513dac0e5d4", "comment": "Malware payload (SnakeKeylogger)", "value": "698ea92f9876cff269460875782ab793", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372213, "uuid": "19fbee63-4da2-4e07-80c5-10c7a16637c5", "comment": "Malware payload (SnakeKeylogger)", "value": "11655cd005959b3dfb5a7fd847823b8eea001fa4b24ee6e63bd6c5c4fa9f7ff5", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372213, "uuid": "4ef2ceaa-d574-42fb-abb6-963b359c874f", "comment": "Malware payload (SnakeKeylogger)", "value": "b424aadc4799def38436f90f166b9eaf2d35e69d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372213, "uuid": "61ffe1d8-bef4-4a48-aec3-b299ee0f6954", "comment": "Malware payload (SnakeKeylogger)", "value": "7d0fa8e3502af6d3da3b34a86dd832e0044ec7ee0e0f74080a2e4269bfd0ba4c23dfbaaa7e01845b66f56471607a18b6", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372213, "uuid": "45bfd888-7394-4010-bb8b-d4bdc76ae149", "value": "T1C8E42327E16B5029D742DA08D2C4C0772B812D398A8B690746BC9F8B79933F6DDBD0F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372213, "uuid": "2f871361-a4eb-4400-8732-e03b5abb6fa1", "value": "12288:ii2uIWbovS0QZMc55c9sbSvCMw+VP95g5iPe0stJhwmJZTujvjkxAZm:iduIWcalZMwcbCMwIjBPzkVCjIxAZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372213, "uuid": "e2e11530-721d-4ca6-9eb9-4ad0ec3eb084", "value": 676706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372213, "uuid": "b950ec20-b384-4db8-bf14-77052d227e3c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372213, "uuid": "52c497ab-46eb-42f0-8d4d-e22f392ae1c5", "value": "Purchase_Order_24-0266.gz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbd3c74-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372217, "uuid": "5d2c02ac-a4ee-403e-8b7e-1337cdc0ef84", "comment": "Malware payload (StrelaStealer)", "value": "b70302922f9c62628161dbc817176b70", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372217, "uuid": "2d884694-2282-48c6-82c7-d3e37af8426c", "comment": "Malware payload (StrelaStealer)", "value": "117fdfa5d2295ead138b74474e0e94cf43e09a9f27128decaaa1a212f3eb665d", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372217, "uuid": "9077c7d4-7382-4860-969c-10e3ae34efc5", "comment": "Malware payload (StrelaStealer)", "value": "12f7231c31d4e6c4e02b7814d4dd9d0bc393f70c", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372217, "uuid": "7837569a-6c1e-4e28-b4bd-c7186f91d4d7", "comment": "Malware payload (StrelaStealer)", "value": "eb2ba7d21c91b2f9c5d06a5251adc59f4b107d41199224bef6212498db3e04a08d7af3396cdb81ecb3fc319e6935d0e9", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372217, "uuid": "2cb522d9-0c2b-4a8a-ae37-6456369b9329", "value": "T1F6C17ED01EBFA9B3DE4CADF281B94980D14C8AE1E15C54716D4D79B194E1AEE0FF4504", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372217, "uuid": "d6a8a62f-215a-4cab-8d51-4f9b08347a88", "value": "192:MaAdE2u5zoZtqRhGECgr+3cDq8SVB3UlCqLN:MHuVxoZtRPTsumLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372217, "uuid": "8902ed6d-6116-447b-b003-8d757487ef54", "value": 6153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372217, "uuid": "3f10ba07-5d93-43e8-9711-65e1d2fd35ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372217, "uuid": "d3579be7-3828-4912-bc07-5a4ab5fec0a2", "value": "2024-07-03_Rechnung_737804.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80f71bb-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370464, "uuid": "83155007-cb2b-496b-abbb-92d693c68ee4", "comment": "Malware payload (StrelaStealer)", "value": "6c5048cb45445a11db5a3f55e1956dff", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370464, "uuid": "4a4fa608-a2a6-4ac2-b55b-ffa4f2b3098e", "comment": "Malware payload (StrelaStealer)", "value": "118bb9ac44c2320c4b90459287b852cc39b0e5a72fb88074430f31af15b95c1c", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370464, "uuid": "d78f2d2f-61fc-4099-9d16-0edb75a01a49", "comment": "Malware payload (StrelaStealer)", "value": "9851475f3748b4d2cadc687ccc1da7e76ebbffa6", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370464, "uuid": "61c469c3-8f93-4111-aa9d-78cb423a1ded", "comment": "Malware payload (StrelaStealer)", "value": "4d7a63d4290ef4f29d19ef06d859aa27add111ee6f905fdb932e564891f10c1eb51e81bef60e9d1aa2098d4070767152", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370464, "uuid": "7f51989f-92a0-4963-8a6a-9c1b762a5898", "value": "T1FB6413F7B2EE60A921A61DE866033B5DF42558E10102E4CAB53747BF87E373DD625207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370464, "uuid": "49bf034b-0f2f-4c91-a22c-020c9e9ba932", "value": "6144:ddohlr0AToVPiGp1kI/J6n5mI6D1J7r7hMLFAW6LAiyf8vI/w1iwfz:duhlr0koVPzp1kI/J6cI6H7hMRAXA8vB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370464, "uuid": "6e9a820c-c4df-4658-b6f0-8b15840b5985", "value": 331592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370464, "uuid": "b637ae5d-3caf-472c-aeb1-043634d4f301", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370464, "uuid": "269f72b1-c9eb-47db-aa4a-efb8e751563f", "value": "20241007_RERE10202482031.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3b5105-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370468, "uuid": "8b46539f-fdcc-4ec2-bb3c-29b1531e2c81", "comment": "Malware payload (Formbook)", "value": "ef34acc0ceebc7c9cad9ef9f5147bbb8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370468, "uuid": "9a9ef9ed-4318-4720-966d-3483d2140111", "comment": "Malware payload (Formbook)", "value": "11a034cd1ba0572114a3c36d984e9108c3d42d6f061ff530d9c7b984824f9ad8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370468, "uuid": "a34ed36f-0f02-436d-8e9d-47a51638ddad", "comment": "Malware payload (Formbook)", "value": "fcc5f8cbaa18135a335144831f94c76050d0c2e2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370468, "uuid": "ffe09534-eea7-49a8-beba-53b35e9a059d", "comment": "Malware payload (Formbook)", "value": "6b6540b138383a64a93b3632e074398794c31cac61f0ab6af2539e9c77f83dd4eb078637b2dd16c78a949fb6e3968c60", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370468, "uuid": "a6c0582a-f95b-4854-a0d7-e2b4324456e8", "value": "T180E4236D3381459FA93D2BCC18F7400B5A199490F872477EB954CE09FA6219EDCB8ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370468, "uuid": "af3ad197-9ddf-4fe1-b3ec-c2021854a996", "value": "12288:IN0ICiHLMrm8L0azsrcIM584n4kpbSg5b0qLWQ/x2jEOdKK694eL7lCXxPWJmQ:LI7WmTaz7R5JDjbryQ/WEs09JLgXxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370468, "uuid": "d7425cfc-1670-4ef1-9bee-020bfcd8d841", "value": 693671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370468, "uuid": "e3640071-e6fa-44d8-8755-28cb402a3713", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370468, "uuid": "37ad36d9-6363-4e92-97ad-f5c98c48fb12", "value": "P.O.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc391133-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370471, "uuid": "2da58cf9-6272-47b5-adc2-4abce8b21ff2", "comment": "Malware payload (StrelaStealer)", "value": "0740631775fb723aedb9a7cd477a3115", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370471, "uuid": "a685391b-45a8-4395-b348-73b825953948", "comment": "Malware payload (StrelaStealer)", "value": "11a40c60c05c75e50a35b1812282cd1aba0b3e71434c9e8df677de9538cbf31a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370471, "uuid": "f9fe7ef3-86cf-4420-8269-5f01699d5202", "comment": "Malware payload (StrelaStealer)", "value": "7f65f8d1b8ae82a67e653ab7478a00924cece392", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370471, "uuid": "49ff6b0e-3227-4308-8d9d-aa8d37f84a36", "comment": "Malware payload (StrelaStealer)", "value": "9a6d39a0b9ff2a2424068b1dbd909c7bb48c9c480c17d9b88735c645aa048588c0f932f6bf12442050b1adaef34d7846", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370471, "uuid": "0cb79903-9bb5-4f4d-ab3f-a4eb64cc2c6a", "value": "T1A283E1ED704D85CF0306D1E7E67782410A876295F5A783B42ADD89C39F8E2681EC52BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370471, "uuid": "7366d4b7-b064-4295-a508-c3cde7a6ed81", "value": "384:Vqbpzaoe0C1XYKj40visFfI34TjEoadaU4lpbJk:Vqbpzaoe00WslTEARJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370471, "uuid": "785e1bbb-f0c1-42c5-88a9-e52d60b3698e", "value": 84112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370471, "uuid": "cae83bdd-17c0-4a92-8a98-493ad4a9c9a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370471, "uuid": "74412a57-5255-4315-b9ca-2ae783665467", "value": "2858129883276341172.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb9ea26-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779372220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372220, "uuid": "a36ba8cf-05ef-4b46-9f5a-715c779c4dac", "comment": "Malware payload (GuLoader)", "value": "693d96e5e78e84dffa825682015ed434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372220, "uuid": "ea0a7d32-f158-468c-b3ce-706172e43e1d", "comment": "Malware payload (GuLoader)", "value": "11a563757a79333564f1eda8325816a621d4f404c282245c8a382f0ec9e2dcfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372220, "uuid": "f2d9314d-32aa-4d3d-b544-1d43ade88532", "comment": "Malware payload (GuLoader)", "value": "e4c82332c18ec8204e754fdf39119f02735adea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372220, "uuid": "de553936-0567-4e42-8342-66b15695a357", "comment": "Malware payload (GuLoader)", "value": "e4ff7781a29a53a0decea7f9cf118dcd9bfea15bf59098f808bb1aad31a015e233b2f502515ace1ac7fc5be1eb4531e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372220, "uuid": "b34ae1ea-d08c-4e83-9c82-d406e11fd018", "value": "T156C402A42BB8CA13F780AA38F1E0F77DAB74EEA81E42D61356E93D4F75353655C24102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372220, "uuid": "2e223614-9a7b-41dc-99a0-a289e452d3de", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372220, "uuid": "4dec9367-1ae8-42c7-b804-14feb9fedf8b", "value": "12288:Eq14BlXN3B44aZKwRFyR3oYVkWY04v2yItybWaDC:ElXJGjMwRFyKYVXX4oybWmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372220, "uuid": "4b69356b-0eaa-42cc-916f-f716d37738fe", "value": 585618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372220, "uuid": "c986ef80-1609-45fd-9767-e793f2d32ec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372220, "uuid": "56beb387-1e1e-48a2-9043-b49d608e7f30", "value": "MY00111Q0562482MYKUL.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec80feed-5513-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779367948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367948, "uuid": "bf53f96b-2596-4bba-bb4e-fef1f5c32d75", "comment": "Malware payload (AgentTesla)", "value": "3544ff066027cd79f34989328b58ee5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367948, "uuid": "7dc378c7-b959-401b-98aa-8e6a9c1057e1", "comment": "Malware payload (AgentTesla)", "value": "11c7c3f7c5670ad96a41fac566b22060efba8c724089ab583342c237946a9e85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367948, "uuid": "2f4d3687-6122-448d-8771-478d9f799856", "comment": "Malware payload (AgentTesla)", "value": "002b5d30a7755cbc369b2c3f215065d6c085b205", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367948, "uuid": "0f243923-7961-4d47-af9f-ca1dbbce6ef2", "comment": "Malware payload (AgentTesla)", "value": "63c8cce36559c1c8930c274b3f9e7b712ceeff47b197530ea5b1a4b4397b45c09ee73e8c6ae6e59be68ffcfb16f8d7e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367948, "uuid": "c9819e8a-f7ae-4d59-aae6-676e0f65fabb", "value": "T17F4400027F88E715E1A93E3782EF6C2453B2B4C71733C60BAF49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367948, "uuid": "cb72876b-c2eb-4572-bffa-93ad97a6c4a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367948, "uuid": "35b4fd04-a769-4058-885c-3e4ab952abc2", "value": "3072:rWbqayiqH2zSyo+AskmTHo9rG8KaG5jnTh+SYufzz:oqayiqWm1Isq8KaWTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367948, "uuid": "bfdea6b7-3c9e-4c5a-86d7-78df4c0f625e", "value": 262156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367948, "uuid": "922d4c6b-0db4-44c1-84af-a880cb76ac69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367948, "uuid": "2ea2014c-4ca7-4b77-88f6-82a076342767", "value": "11c7c3f7c5670ad96a41fac566b22060efba8c724089ab583342c237946a9e85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c2432e-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779372223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372223, "uuid": "f966b0ec-3f6f-473f-a216-e6ec11d96732", "comment": "Malware payload (GuLoader)", "value": "b64a471d9077672ab11afbc380ca0b09", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372223, "uuid": "47817918-501b-4661-9753-bf09eea06011", "comment": "Malware payload (GuLoader)", "value": "11d5e46613b0338d908b3f73422670b3c672b3bb7a03a793a749349110d858f0", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372223, "uuid": "1455da7f-807f-45f6-bbfc-99cc929402af", "comment": "Malware payload (GuLoader)", "value": "9f5507093915245f268959c4f9b370a3b59901b7", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372223, "uuid": "f777f0a0-ce6d-48f2-891c-f2983afb2593", "comment": "Malware payload (GuLoader)", "value": "dd1ffca92088aa5e6a4dfc37afdc75e92ef890ba22778430a4eb2cf2205bb0504d489ebc935a1aa68639cd9b71460c9e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372223, "uuid": "c8d98e50-8c9b-4943-bb27-738c484647bb", "value": "T17DA4236B50F7D173C74AB9F6D700D2A991EFC2094D8D2913A7E4272EAE015BAC43CA4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372223, "uuid": "255798bb-31eb-4b93-899a-3d2a7aac8a60", "value": "6144:R7/584TChZow711ePaQuLBftX3Uv4dZT/eWAW/YKMod4gI5RHeq17Dd5mLk+oDw:R7/581PKr0BftHUQeMYK7/cHeqtiL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372223, "uuid": "063a07fe-26ef-4708-a1f7-a7743cc924cc", "value": 459320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372223, "uuid": "18733cff-e23d-4473-85cf-a09d61e96bd0", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372223, "uuid": "fa1dcd15-abe9-4df6-8da9-9e8eeaea69fb", "value": "RevisedXPI_2024.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce44871b-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370474, "uuid": "6fffccaa-a6f6-4f8e-9bb9-0e6828003a82", "comment": "Malware payload (Formbook)", "value": "7d73ff9770c033727b1cdd9b71d45b23", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370474, "uuid": "05184b7a-1d54-436a-bff4-77dab88a2cee", "comment": "Malware payload (Formbook)", "value": "123fd80d99e873677c32be7627da6437fd97ca533724096ce86d4ff141860e14", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370474, "uuid": "2510c85b-bcec-4b23-8db1-b65931034d27", "comment": "Malware payload (Formbook)", "value": "fe4f0452da6ddeb468871ee392d979115cbbcc79", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370474, "uuid": "d133b70e-46fa-46ed-84bd-e5552ff0041f", "comment": "Malware payload (Formbook)", "value": "1f2383460605162c77f1cdb8278a6f3eb662d2ec2d5b3876c7a68ee143cbc0913e7a874d6317fb02bcbb1a9eb265b489", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370474, "uuid": "7011fed3-75b4-4ac3-9c13-924e4828652c", "value": "T174F4330187CB75EE543B849E74CCB458FA508F2F18A1DF1182689076AD2E9FE193DE1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370474, "uuid": "f2d3f7d7-4361-4a0e-ba57-eb386f6032c5", "value": "12288:z2kHz6Q7NvP6g2cWQtqE1I22CO5SNiQEGmOz2KgX9LcMJzRKf+UD8hzR5:z2q1qvAqE1I+O5SNizgxGLcMJVKffu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370474, "uuid": "f0c09cfb-2da0-49a3-84fe-b2dec4e5ad66", "value": 764751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370474, "uuid": "0ef950b2-013c-44d8-8e25-f1e342a1492d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370474, "uuid": "ef257f27-1cfe-4409-a809-bf192852b459", "value": "ORDER_08757646566535857_95877465434-2.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4744823-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372230, "uuid": "1ae0f92a-7750-4e0c-9155-3883c290a6db", "comment": "Malware payload (SnakeKeylogger)", "value": "c39b4dee7360187b8f979c2fa327b137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372230, "uuid": "979474ba-48fa-4792-b6dd-341703e78fd3", "comment": "Malware payload (SnakeKeylogger)", "value": "127c404a67f2d8c1673bd85759a1875b2e87055c506d769f1b7c699dbefb50bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372230, "uuid": "7521f712-9295-440b-b87d-dd7b9bf61064", "comment": "Malware payload (SnakeKeylogger)", "value": "f8108fc13797fc0dec5e3b9fb7565e99a2d39f6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372230, "uuid": "0c0c9c6d-ac4e-4f9b-967e-2f4a2a874b79", "comment": "Malware payload (SnakeKeylogger)", "value": "bb2cc9f902f41f7080a2e1fc4180a9d67ec410b181bb46f0bcd01ab3fd67e7ac81ca1253dd9a1c8b3b93d434705d24b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372230, "uuid": "ac81fe71-d4c3-4252-a985-0869139a3316", "value": "T16235BF027391C062FFAB92334B5AF6515BBC79260123A61F13A81D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372230, "uuid": "b2bec734-1f8b-4f45-bfc1-1851d49da438", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372230, "uuid": "34479080-1224-4159-b40a-3a3cbc7c7313", "value": "24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8aFvrESRC:oTvC/MTQYxsWR7aFvrESR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372230, "uuid": "a52d5ff3-4b26-4dcb-a205-63e5b324258f", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372230, "uuid": "4dce71a5-33e6-4dd7-be9d-4e5e0bbb40db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372230, "uuid": "c3570f55-e12b-4128-b33d-907efc86f101", "value": "RFQ_For_Tender_8-14-2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03292b7-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (TrickBot)", "timestamp": 1779370478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370478, "uuid": "1c998670-2c17-4dfe-bf20-1921b3cdd893", "comment": "Malware payload (TrickBot)", "value": "9db5584eca2b1e730f43a22fe423d3d6", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370478, "uuid": "6a3ea503-2554-401b-8cff-9da017f665e2", "comment": "Malware payload (TrickBot)", "value": "12898ccc6a9cf84dda412ea2bc17de58de6742ffae8392a84294fb7f95fcde27", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370478, "uuid": "04ab4e70-9ed8-45e2-bdc4-56c755600d3d", "comment": "Malware payload (TrickBot)", "value": "96a491acb5e0ab5d9d1bcb92720382ba9d959e02", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370478, "uuid": "f7650b7f-ed0e-4547-8891-e7f37ccc69e7", "comment": "Malware payload (TrickBot)", "value": "a9946ba40f2c3fdb19119fc1a1e27f55064d96d6398e176783c20ec7fc3c8c46c8439001c74c776eb2db6cfc4253c724", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370478, "uuid": "1aa186c3-7d40-4035-93d1-613eec453ab4", "value": "T1C393023A90673804C53352F1B014179EEA58F263873B7BE2F72542E58CBB2CB585765A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370478, "uuid": "9cac814d-4da9-4c3f-952c-205f9d2e024a", "value": "1536:L24J3t+leYjtfEKucFDtaUuq0rAs3To7eZdmSvFhNS4xlFETG8vG9NWDZ:LbAXucFoUy8sjtYC6Gr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370478, "uuid": "b2380481-6f5c-4d02-8941-157fbf9a4425", "value": 91423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370478, "uuid": "3ad850f9-6129-4eb1-a4cb-8e161d2b9970", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370478, "uuid": "f743f14b-4722-4d34-aa8a-09769e84a56d", "value": "SWIFT2024001013.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6731a8d-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372233, "uuid": "c269e2d2-fa32-4c88-8d9c-20f7ad206804", "comment": "Malware payload (StrelaStealer)", "value": "42cbc337eda116713d5d40a25278ec02", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372233, "uuid": "5d360db5-6cf3-4305-8841-fc9f341508a5", "comment": "Malware payload (StrelaStealer)", "value": "12920924ddf4fd5e897a0824e302224d4daafc3949e0a25a447246f45945b6fb", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372233, "uuid": "c29f7597-d990-45e3-9db8-bbe4bd5f9864", "comment": "Malware payload (StrelaStealer)", "value": "777256862bd6dc763e9f1977a824d602a6a488d2", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372233, "uuid": "4c975e72-a855-459f-a43f-104bc12d945f", "comment": "Malware payload (StrelaStealer)", "value": "3d73d8e189ded2f42fdd935a6829f96cd49cd7635c61edb9c647516f9650086c164b6abe3d0ad2520fc5bb06dd3da576", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372233, "uuid": "57b2756f-506e-4e02-921a-d5f59a558faf", "value": "T19031E835D64E66D9C0569CB70BCD37A39806C08FBE0D2D891018BE05AA350962E89A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372233, "uuid": "691743d0-a473-4387-acf0-77da16cce2da", "value": "48:9B9wNnFGaiVexk3J8h/vZsvZRhku6acfg:SQemyh/v+ZXEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372233, "uuid": "15e62541-6553-4813-a083-f6357a8d1285", "value": 1583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372233, "uuid": "61fe3714-f894-4257-a126-108039b7a2de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372233, "uuid": "07dfaf94-3bdc-4943-aa9c-5aa9e1aa7fa8", "value": "abrtop_106_5_545_20240625_150258.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86fdf72-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372236, "uuid": "509f446e-92dd-4104-a889-12d7f7797cab", "comment": "Malware payload (StrelaStealer)", "value": "43493d88150d80ba26074c619a47da87", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372236, "uuid": "eb8d4023-9227-47f8-bf40-57cc6482b37f", "comment": "Malware payload (StrelaStealer)", "value": "1295214c5716edeb314cbfdd5058af6cfd15e090df3f9e2df385bd2a71682282", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372236, "uuid": "aa5d0ce6-a4dc-4656-ad35-3c9bf8a7b067", "comment": "Malware payload (StrelaStealer)", "value": "ad98cba5b1882edb995191b2ef6fff62e68144a8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372236, "uuid": "a8781cc8-fe15-4d20-bae8-cb74669f5607", "comment": "Malware payload (StrelaStealer)", "value": "8e6339080758de74160bd3cc8624923c98604cd9338f605ddf893b249c6650b0a34eef0a856ed0f70ca74fa5b989d656", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372236, "uuid": "8796f3bc-c60b-4794-8598-f803fc7f85bc", "value": "T122418DFE516109683A8EBA0B3132C972D5197AB70B76ACF9A240F555C47788F12C51D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372236, "uuid": "87d75da2-ed3e-4cb2-9ce7-f8f8c80ff536", "value": "48:YouJ0HuOlHKf1rRK3Pm88Im0m49X73jcIm+mgi4OeDzmyy2uh/QDzjOeDzmyy2uf:Bu+DHIKudDOkV94OSOqHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372236, "uuid": "f7cdca72-dcee-44dc-ba0c-b1fcba5cca3f", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372236, "uuid": "2596d157-d0cf-44ac-a8e7-f179243434ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372236, "uuid": "fc748ed0-5324-4e13-ba71-0592270ed358", "value": "811212137237003460.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d244e4de-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370481, "uuid": "79a47f8a-1e1a-40b6-b579-0ccd0add115f", "comment": "Malware payload (StrelaStealer)", "value": "35aaa0a0960137b024ab49f87fe11298", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370481, "uuid": "b407b21f-41e4-4534-a614-54a4fbe16586", "comment": "Malware payload (StrelaStealer)", "value": "129feaf9c5ec1ad00c6eeff1db633a809a342b75c4905b5365f88feeb19433c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370481, "uuid": "9d20d98d-d2a9-4fe1-90c6-6bd3941c1fd2", "comment": "Malware payload (StrelaStealer)", "value": "756ee54ab8dfd730e3f07c5e99294211b7309e26", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370481, "uuid": "12f1470e-2ab6-4aa0-a30d-f5cd21407424", "comment": "Malware payload (StrelaStealer)", "value": "9963577d5e1bb02da8c4336230babf60182fa258fbf645b0afe587f86b6b56639f9a2732012036a1ba44719f19034ee9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370481, "uuid": "8bb78056-74ca-4cbb-9c6b-d4e9d09d5115", "value": "T1E255AEA7C85707AC6A1C2EC8CC8D1A0FC459BD652D725DF1FDB07A0B87364C7939292A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370481, "uuid": "6544bc40-4809-48ac-8182-9ad9a3de3d7e", "value": "24576:0eHTDIjrrXrwJRmHSi+a0qvUBpqbqTR76cfFu48zrkSwhgFQ5KtjdgnI3RVHHMVH:Lro20g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370481, "uuid": "d59eb459-4771-4fa4-b64f-4327f0295dd3", "value": 1287675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370481, "uuid": "0355b5c3-361e-4e3d-bac3-488bd5624342", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370481, "uuid": "13336c7e-c12f-4cea-b07d-3fedb6270045", "value": "13790283351022032.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6f2622-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779372240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372240, "uuid": "f0dbfcae-7c38-4dde-80c5-498a155fea89", "comment": "Malware payload (RemcosRAT)", "value": "4d9039351175c3e30010ff7c72b27bec", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372240, "uuid": "32c2c339-6eb9-481f-bac2-a72856c9679e", "comment": "Malware payload (RemcosRAT)", "value": "12b21ea019dc2965a50c906e83c8be229b4649db3eca0f3abd6bab64315b2967", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372240, "uuid": "121787bb-5aec-4565-987f-941e02c72e74", "comment": "Malware payload (RemcosRAT)", "value": "27fa5ddfe9f7f9db4e33f30e7e55850ff5b2a54d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372240, "uuid": "3c3614ea-338a-4a81-bbc5-601cf21b86b7", "comment": "Malware payload (RemcosRAT)", "value": "9d46fa6f67f6b6751701551f68d4dc81cfddef9c006eb67a201dc4b16c6c891d1f3bf3f339c4c87aafb3b9f2d713d11f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372240, "uuid": "52053b05-aa30-41b8-857a-a6fc88ba1f9b", "value": "T1CE0533203B29F3EA7986DC9338598CFFBF8759287CC5629D20E52625F1E1E407ADC425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372240, "uuid": "efa963a3-07a7-48ea-a490-406869d156ec", "value": "24576:5VsUDA5Fd13WTjvn4ESIVhnfoSoFcZz4H/tM4tLAdT3:vsGAXdc7n4XIVh5oFA+/ttLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372240, "uuid": "809edb47-88be-46e2-9e22-0110b06a4953", "value": 864556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372240, "uuid": "cc1d9fc0-f0cc-4ddf-8258-0bb666d2b6c3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372240, "uuid": "9dd83348-257d-4d06-9596-a24a801bd04c", "value": "RFQ_PETROFAC_PM-C-24-4400.gz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2baf43dd-5513-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779367625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367625, "uuid": "02981cb9-6d6c-4e05-9105-dd4dc6770f26", "comment": "Malware payload (AgentTesla)", "value": "de1cc39b709a9843fba87f206703807c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367625, "uuid": "dceca524-a6b0-418e-a11a-4125ad0e347c", "comment": "Malware payload (AgentTesla)", "value": "131caaf5d7a1eacdb9edae3e5cc35ce3fb86b228971902faa397d7ebf27017c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367625, "uuid": "50a5257f-810f-4625-af5f-1b73dac1e111", "comment": "Malware payload (AgentTesla)", "value": "85a119e62f480205d393bd296094037c633af0d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367625, "uuid": "916f14f4-667a-4afc-a4d4-1f8e100d3bc4", "comment": "Malware payload (AgentTesla)", "value": "02d445d3c80d4c87e030e4483f35bcf65ed0ba4a09a2fe9e763aa0f4d0a17231211faae05312665e715a466031a757f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367625, "uuid": "24b20b79-fc81-44f5-8e16-35f7ce6a6d8c", "value": "T18655AF317D60B361DFE92F1888B9B91E47F456471A2134C2EFC666392CF3B45863E829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367625, "uuid": "d92e9afc-4602-47c4-9579-95bee764df0d", "value": "12288:n2WIftjZesoJQnwLW20LV4YmCqvcMWFbKUARn8ov8zR1zv8UvRzYLm1J5sLlr5:n2WmVoJQwa2MQvj9R8ovsuep5sLlr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367625, "uuid": "38e09983-0730-4e21-b573-3e5ca9fa0e27", "value": 1385463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367625, "uuid": "c5c96449-7ad4-46ff-b67b-4c96a4f9a574", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367625, "uuid": "a57c9749-ccae-4d90-8b18-346851690184", "value": "131caaf5d7a1eacdb9edae3e5cc35ce3fb86b228971902faa397d7ebf27017c8.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec785250-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372243, "uuid": "5003a23c-5c2c-4cfe-b237-8708f45a6cdc", "comment": "Malware payload (Formbook)", "value": "161b39d1d66fca83758bef77f048b24e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372243, "uuid": "6b15be84-10ea-4fbe-a0f3-c76a0c0085d5", "comment": "Malware payload (Formbook)", "value": "13309179b758d4ed65797bed682c1efc091f776ead5c83f82c1719263b33a6d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372243, "uuid": "85fa9e55-6830-468b-b737-77085ffd9a06", "comment": "Malware payload (Formbook)", "value": "86ce438ea282d605c6bb7a04df99d8d3e8111bd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372243, "uuid": "b82d1b3b-715c-484e-b356-34a84b0c5714", "comment": "Malware payload (Formbook)", "value": "e9317766cc8bd84cc7a03f7c6ff00755d31bad0eba7d1d11f90554f65d21f019ba4b8867e16d887be95119b60c49adab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372243, "uuid": "45030707-07c8-4bc9-8e78-229c99d73b62", "value": "T1F9F401642615DB03CA6043BD0A71F6B52B786EDEA802D2169FEEEEDF7975F410C50283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372243, "uuid": "d4e05cac-b019-4448-ad64-0bd1b6b7d0d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372243, "uuid": "24a03f65-af73-4a53-a3aa-63a58d9f1760", "value": "24576:Rp/tODdEeg98UmAkrd9qeE9yqRhi7Wh8Qo:v/tOKtqUmABeE9yqris8Qo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372243, "uuid": "79ebe1af-6036-4edf-90eb-4a9bf4b8ef75", "value": 793096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372243, "uuid": "199e22f0-70b8-420a-9b86-ed69e5f6bc39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372243, "uuid": "b7d32eff-8a3d-48fd-805a-b33759b72fa5", "value": "New_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee66e340-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372246, "uuid": "7c3c0ddf-0145-46f8-b343-9c8a28f12bf1", "comment": "Malware payload", "value": "55b46946daa5b58d63d66fb5009186b0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372246, "uuid": "e9f3c970-28c8-4ea4-8616-a885804a64f8", "comment": "Malware payload", "value": "1330d4e2cdcc61d75857b73882c7235d8865b20a57e4c3a76ccb099e4dedb440", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372246, "uuid": "e249e682-4191-4457-8a17-93bd23caf989", "comment": "Malware payload", "value": "0d8b7fc9b6e400e9bee624d41cba5190c41eadac", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372246, "uuid": "f975dbc4-f19b-45a5-9c8b-f8212c98c562", "comment": "Malware payload", "value": "9b21127d429ffbf6a725742905b57875ed6d43acb644b253dac720453faeb90ebb326b4cb7fc601e6ecfa6cd6722e273", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372246, "uuid": "dc06da9d-d6ad-41ca-af63-9cd2850b29b3", "value": "T1C94184D0F386681F16C64F07E4A579A434DE943C0C6CC8E90DE98C4EE825B9E5AAB50B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372246, "uuid": "28c14d5f-f945-484f-95ec-92a7c96491b6", "value": "24:JfCjbafPQnfHTg8AULgBGp9vC0ebbVou/DjH1nbf89fEZeLf89fEZesY0c:Cawn7gZsgBGpJjebbVxWaewaesYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372246, "uuid": "0a57828a-5c1a-4c6f-a52d-8ef2f3be27b2", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372246, "uuid": "2bab4f96-4de4-4838-acaa-97e493ae9a6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372246, "uuid": "8a0b4947-f545-40a2-b922-d8aebea2568f", "value": "13285252973138512744.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5359d9ff-54bf-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779331613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779331613, "uuid": "8ede1c3e-fa7a-49f6-b161-44f43a7d3464", "comment": "Malware payload (RemcosRAT)", "value": "7b4cf189c140330b0fe9c64051a1a79d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779331613, "uuid": "7e152642-baae-4a9a-86d1-9999263daca3", "comment": "Malware payload (RemcosRAT)", "value": "1345f21a54489d342367deff244634710e027677d73452dfa10e132ccf860137", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779331613, "uuid": "77f3d3ff-959b-4c3f-b2e1-1ae5af0c5bb7", "comment": "Malware payload (RemcosRAT)", "value": "ea4cd3d398443311cb4e40765b3c7d544862c200", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779331613, "uuid": "366e6421-ec18-4bbb-9e5d-963ab2a7c32a", "comment": "Malware payload (RemcosRAT)", "value": "a2babbd264ca4f4664f10cab9260605991ef0990868cd9526f904a02b77130c1fed9f0cd6d1b96b113b8986ccaff6d5b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779331613, "uuid": "4683da1a-3a99-492a-9044-988f5bd4d186", "value": "T1EAA560FCB35C548CD81D8067C059DBB21BDA7EA6BF4856BC992270940936BECBBC64D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779331613, "uuid": "bd302c02-48c2-4309-8fad-8f2515917529", "value": "1536:p+m50x1qBWm5p//S+Ym+hUEfvfuYuj69SwhsFvldCjMsSAb6bEwMv2TiSSyivfuP:fX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779331613, "uuid": "6f80a374-2644-41cf-9810-05dfae31954b", "value": 2157993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779331613, "uuid": "a1b3cf7d-c511-4412-b505-422f35de62a8", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779331613, "uuid": "f9a1f824-9135-4361-8795-e98064344572", "value": "Name_File.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc8556f-5541-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779387705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779387705, "uuid": "c1cc645e-c32d-4807-8474-d8844edcb6b6", "comment": "Malware payload", "value": "ff7933dc5c119008bda88cbfe48f7ed7", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779387705, "uuid": "ce65e921-910b-4de9-83a1-3cd4aefaab58", "comment": "Malware payload", "value": "1352616c04b2a939928a89efe54ccc333c7a92d6360fcc98456aee32bf450638", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779387705, "uuid": "2618d977-c7c6-403f-a574-1ff0bb34e686", "comment": "Malware payload", "value": "c1162d346e7bdeb6bf6dc355fe478f387292fc41", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779387705, "uuid": "f50cff1f-459e-43e4-96c7-6d0039d04fce", "comment": "Malware payload", "value": "0d79a1ec22d5e41e598038642f45bb3972f0c657465e3bebf0ac974af434ba865675258ef570974cbc8e1f89a041c98e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779387705, "uuid": "4823967e-5820-41f1-ad0d-e73180e202c5", "value": "T1B661A7A53357606B0196B7F0251B3F36286E9DCF2A178F0CC50D2A0CE45D7B89A788BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779387705, "uuid": "7336a9b2-9e16-48c0-a54e-62fb4882f65e", "value": "48:CXa0Rrmis12sHjvU1WWPnnjc+wA/0h6GD8GoqVYRDwsMOvZUj3G3UeaEODKLr92e:CaumidsDvU8WgZC0hsqVYxOOvwIUeatQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779387705, "uuid": "5bfbfb4d-84b8-45d9-aee0-c57119c6c23f", "value": 3390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779387705, "uuid": "959bcce8-d577-49d2-b556-f6624acd16b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779387705, "uuid": "f4ee10d1-a2b3-4e2c-8ad6-e3711679afc1", "value": "Obte.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2075bef-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779372252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372252, "uuid": "6ba60746-e96d-4c0c-9bd8-d37278a0d6e4", "comment": "Malware payload (GuLoader)", "value": "17ae700cf861e07d94a5ef0422fca187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372252, "uuid": "01a0c631-01e8-452d-8901-d1566ea03c3e", "comment": "Malware payload (GuLoader)", "value": "1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372252, "uuid": "25d8d258-e7bc-4d5a-8c1e-b988052c70ea", "comment": "Malware payload (GuLoader)", "value": "c9f1e8c56848bf06e94788b922b9323f96eda4bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372252, "uuid": "0bf1846a-3a6a-4b5b-87d9-e391e561eeaa", "comment": "Malware payload (GuLoader)", "value": "55d2c2d4bdc0437144b673261c8759b9e839d997c195cdff3716e0badd40373d07022f72f700fde2ffc11c0ddafd03c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372252, "uuid": "a07b8491-8fde-480a-8ead-28323b3cef03", "value": "T13BD4E0C2F14086E1EBDE1FF0187A9D6A43673D26C9A4064A7A46779A1FF3352603F907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372252, "uuid": "93f24265-b12b-41a7-8f89-c2344115014e", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372252, "uuid": "768784c2-7e5e-4a75-8d31-8e3fc5e1569f", "value": "12288:QC3wdew5NKr6XviorEgLZJwXSzmC7ZKlB1m91:QAmewTW6fior/DCC7Z8B1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372252, "uuid": "4079c0b6-d1ba-4e8f-a2d2-70a500b71a30", "value": 624063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372252, "uuid": "938da91b-e49f-44ed-b8d2-9d036d176192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372252, "uuid": "dadc1f42-af34-4444-a487-13042dd43288", "value": "Frankliniana.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d485d9eb-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370485, "uuid": "8e565d57-f3ec-441d-afb7-259badb2331a", "comment": "Malware payload (StrelaStealer)", "value": "c7544a2f675e0a8d5ed82a41665b2afc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370485, "uuid": "a57d32f6-954a-4c56-ad6d-840b4adf0767", "comment": "Malware payload (StrelaStealer)", "value": "1387c8f8af3c005df2b892143df00ffe25887db6cc508175f75962653fb9c84c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370485, "uuid": "e5d2edbb-5684-4307-8f63-8fee95e4943c", "comment": "Malware payload (StrelaStealer)", "value": "732e568d3e955a6e54b31ae8b6e318e4c6ef586b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370485, "uuid": "8d137f1d-8ef5-471c-993d-14d75c5a667b", "comment": "Malware payload (StrelaStealer)", "value": "75f8461fe6c7eab58d9d1bd0accd71a4840901387563452cedace1b5cb66753bc2ee86e313e0a0947c5bc52916ad48f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370485, "uuid": "43c0dd31-33fe-49c6-86ab-2224be5e410d", "value": "T1DE35B086DD75F5FC9C89FBCD80AECDEF4C8A646161111C87B9AE2907C92C7EB0586036", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370485, "uuid": "94a75602-6187-4ed5-a94f-e3154ce39805", "value": "12288:YNbKdy2u3dPSu1NhIII/OP4NhIII/OPtAa:YN282ojhIII/OPMhIII/OPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370485, "uuid": "de64ef3b-9b07-42a5-92f0-b7f924d64797", "value": 1105932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370485, "uuid": "fbe6df5c-2128-40cd-a96c-4c8f3f1a079e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370485, "uuid": "f6e16104-2c46-49e1-8f72-6642b46782ae", "value": "16034193851203210171.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68c6402-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370488, "uuid": "d2d9ce63-4aa6-4a51-b9a0-f95ba838f426", "comment": "Malware payload (StrelaStealer)", "value": "7f742d94123d1e14cd7f5e6ad171be2c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370488, "uuid": "3360fb43-6289-44c2-bc1a-c005a9401bc7", "comment": "Malware payload (StrelaStealer)", "value": "13db775a76321ee9ce918161e1cef2b56aaed6a4be7879fb2789f0fd780a4429", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370488, "uuid": "b66fc88a-396b-4e19-b793-291722ab5054", "comment": "Malware payload (StrelaStealer)", "value": "f93403acd42b11768bd58ce7512ef60e5d1e2a8d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370488, "uuid": "dd71ee1c-1df4-4f92-a6c2-4e3fc4d6aec2", "comment": "Malware payload (StrelaStealer)", "value": "15d838c3b52851b5c3eb8393e5523e592e5a79094c667eb9d93ec904b23e76a2d8f55b5026e7e14aceead11daeeb837e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370488, "uuid": "a59f0b6d-64cd-40b0-9b45-f4b760ae97d2", "value": "T18293CE82FB570DC1C13D90C0A7BC05A01F41BE9B23A5551F8A54A7A74B81299CA7FBFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370488, "uuid": "286208dc-a426-4e78-b2af-b092ecc3dcb8", "value": "1536:gIiBv/JQzjob66cfdSQ7vOnfg0PeEmRl6:ES6cfb7irKv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370488, "uuid": "3f0658da-e245-460c-b312-4d148c15b12a", "value": 96222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370488, "uuid": "90b777e7-f2a3-4338-b993-c9b2d7dcdb34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370488, "uuid": "4bcc550b-6ca3-40a8-9476-5759b7b0a355", "value": "222281441190144406.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a6029a-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372258, "uuid": "b54e7b23-6e5b-43fa-b67c-5582c3e81222", "comment": "Malware payload (StrelaStealer)", "value": "323bc2462e2de7dcd61dd9cc385076f1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372258, "uuid": "9ff3f6d2-a7e1-4cd9-b35c-2715adaf2a29", "comment": "Malware payload (StrelaStealer)", "value": "1489b7f980823b3f4ad0223037ffdaea6b7b3d78509793097d61a3cb87643133", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372258, "uuid": "986d9793-68e4-4122-8d37-bc03fc04d5ec", "comment": "Malware payload (StrelaStealer)", "value": "fd5a55abee980077e45c692a1f9702e17d56a1b9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372258, "uuid": "984162ed-8815-44e3-8ff5-421fa722267a", "comment": "Malware payload (StrelaStealer)", "value": "5a1b592877c700cf052c3739d4e66604fc5e493521432fb4e8060b1cdd9d63899a416e967160a640eec2ff4ae14ebc8f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372258, "uuid": "9fd5f789-1548-4c61-954a-24bbdc74d427", "value": "T1E391AC3EE07E75146BF730A60F402F21C69F57662C0FA6B4C88C5D59F4685B4C2282EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372258, "uuid": "8b55288a-a854-4b0e-a4aa-7433e5e2e5c0", "value": "96:byHYA08l8BDRFGMvKhZJ9rmz7AklR1z7U:bYY64DRFGMvK/J9A7AklRV7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372258, "uuid": "4bc12174-429c-49b4-8dcd-e256be4bb17c", "value": 4476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372258, "uuid": "f058c1a5-39f7-48b3-a325-c639a1d636c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372258, "uuid": "c079d38d-cbb6-4865-b283-6bfa7a2749d8", "value": "13732321231933323146.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87a9058-5519-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779370491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370491, "uuid": "193d111e-0ff2-45ff-813c-b31ed58b87f6", "comment": "Malware payload", "value": "82bee980a793dda4e334a4302a4d18aa", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370491, "uuid": "108e2f4f-a2f5-4bc8-8d34-e54ea15468a5", "comment": "Malware payload", "value": "1493995e0380c7894f3900f87f72facf03a17c94b307a3e4a3a686fb00e6c5e8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370491, "uuid": "fb5467f5-4c49-45f3-9096-e1192a5ee7e9", "comment": "Malware payload", "value": "534545d25b256393f4b17f2883f502cd9c467377", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370491, "uuid": "249cc59a-b3e2-4c43-930c-1ec2d34d1ec9", "comment": "Malware payload", "value": "3a419c9608e71d769047222876087f23f4c280e072ceb5991b89c3a8a309d6c780c7dfad631cfc48318aea3c42bbdabd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370491, "uuid": "cd5fce9a-1d3f-4ab7-b5f4-a8a41dc86293", "value": "T187C3125E547B04658C963FABC0859BE97BF24E812BB58CCC94238C07691F2D3561DAEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370491, "uuid": "3dfcba2e-06eb-4a97-bdd3-cfce69462e28", "value": "3072:KvGLGkY9y7f1Ux0mqPSy+CVgwcltcJ4amB/GvAayfhu7g:KvGRmy7f1Umm3v+2tjj/Iyfhu7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370491, "uuid": "e98ba32f-16fd-4a5f-a459-133bfd481053", "value": 129198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370491, "uuid": "b98c11db-7a06-43f3-88e6-c5304255672f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370491, "uuid": "ca03e5fe-4389-4f27-bdef-70d6b8e30784", "value": "DE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc216b27-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370498, "uuid": "549fc135-4ccf-40c7-8f51-aaab1b05d86c", "comment": "Malware payload (Formbook)", "value": "56cef3461fb431917895877d0279ef85", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370498, "uuid": "4f31c69e-4751-47cf-b002-7b9cff650649", "comment": "Malware payload (Formbook)", "value": "14c782f69e3c01ddb32290e05393c06ba7b59fcad66a924984b16eb7be92a400", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370498, "uuid": "1125442e-08f6-4a5d-beb7-841ae76526b9", "comment": "Malware payload (Formbook)", "value": "a744a349e8b60b0134ac8b627649b3864e0eb7c2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370498, "uuid": "a5c20c70-792d-45ec-b2c2-1c1896822fac", "comment": "Malware payload (Formbook)", "value": "d52d341e7d61321957c05e0158fb872fdf421cc34f6642936d4311b4b81e91698a3b77ee9973407b7a12c9398ae2ac41", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370498, "uuid": "0c20c085-0ca7-435b-b0b1-f6c51516c4d2", "value": "T1A305233089E870EFD09C9AF0CE7667E49903DE65C7F659B12810571BAEF5B21B0BC219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370498, "uuid": "36249f44-20f1-457b-adf7-454db32502a3", "value": "12288:LnE1swfnrLpxJ1yz7JSIncuoBwoQ57F3QIPEfTPwzGKuHRt4j+rRNQLitgkBWnnB:TqdS7kQz2SGKuxt4CILrCMgXQEJeH23o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370498, "uuid": "dceb3ee1-732b-4925-9037-3cb6bec8da28", "value": 835799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370498, "uuid": "7197bb40-3833-45bb-ab54-517b16e12d3b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370498, "uuid": "a7d10d4f-ba91-452a-bf45-2af7c74f5d07", "value": "ALD_REF_19475_-_DEC_2024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7be0adc-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372262, "uuid": "961b8922-7dbf-4366-a98d-98a9637936d1", "comment": "Malware payload (AgentTesla)", "value": "e8fc8beb4704b873c091a095d6e75a13", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372262, "uuid": "0a9f18ad-b310-42b9-8973-1c5e74d75dee", "comment": "Malware payload (AgentTesla)", "value": "14c95ac703fb1a84e2f4b303de075fb235fd26431dde2c60f46b1d90c8c834b7", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372262, "uuid": "dca62c8c-2d92-4b06-856f-2dd73fcb753a", "comment": "Malware payload (AgentTesla)", "value": "73bd839269ca188e70cbbcff782ebb3d5e0acee5", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372262, "uuid": "f9317f06-65aa-4437-9e7d-5349b01eb63f", "comment": "Malware payload (AgentTesla)", "value": "5aa360bed1493fa8bbfb87c61bc0a70e326538d9b1037fbe7ac52a3506cf024630e8968fe28ceaaa2c6eb99769833b45", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372262, "uuid": "886bed8a-a5b0-4d86-8349-6c9954b97af3", "value": "T1E82523D177E97C600194109FAC6B46B7E4274551332A4BE273F712AFF8B6B198FA2843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372262, "uuid": "6e97e611-7f18-4b6b-b42f-3f56928e0911", "value": "24576:YU+Q7KyXetv6ySPnBgs0ZOBbY/Hik5oAyKD3DU9:YU19pyS5gp9/qED3w9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372262, "uuid": "030f7c16-ee24-4bdb-89bc-ad70b1e43c1f", "value": 964283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372262, "uuid": "9865d099-6518-47c0-ae1f-d72048f343a3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372262, "uuid": "a64581da-88eb-4b33-bb8d-547f82d8f3f6", "value": "PO-A1702108.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a5b436-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372265, "uuid": "c767a959-b70b-4819-8d42-920a3ebd6d90", "comment": "Malware payload (StrelaStealer)", "value": "281e99d20f5e367821561a0271d75fc4", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372265, "uuid": "f471b759-2134-467c-9b55-cf43637b8cd9", "comment": "Malware payload (StrelaStealer)", "value": "14cb8cbcb9c6dabc4d4fe5d0efa88f0589c9a50f11ece44c18ea15f6de9c2c7d", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372265, "uuid": "d4f4bc4a-6e1e-40b5-a447-bb070151be12", "comment": "Malware payload (StrelaStealer)", "value": "5b45a5b793d678c7afb742fe8da14c354c71e982", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372265, "uuid": "c05e532b-71c3-4c71-ac3c-f115e6b22bbb", "comment": "Malware payload (StrelaStealer)", "value": "2ca621e2d6cce608d8ea5dee3102cba8a33fb82dc1beee40abf99e07ce5f3165199b055b0d2c8a8af48efe1d38ba822e", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372265, "uuid": "bd5a5cb9-c0f0-405c-b327-267875a34421", "value": "T1D311B609D1484112D7CC8E7E502D1A857C68C8573040A08BA330130FDC0AF5583AAE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372265, "uuid": "3b593f3f-95f0-4e52-8c43-0ee3285dab4c", "value": "24:9bmBgSFoIrk2arXEcgtAmfsVVHTDnGY4bJjjdeuO2xu00A50p:96zoIoFXEnOVGYm5dhO2xuPAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372265, "uuid": "9d631f80-70b8-4b0d-b287-dbe7d31b2c16", "value": 1101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372265, "uuid": "64fdb90e-5163-4df8-9e16-0789e06fb711", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372265, "uuid": "d594b83f-dd8e-48a9-8167-38a7d2af59ff", "value": "R202417214.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e18bbd-54e3-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779347026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347026, "uuid": "6fe0cae5-52f1-4dc4-a7e0-ba603581074a", "comment": "Malware payload (RemcosRAT)", "value": "bcdb53ee3f7dc17e6a90989c85678a45", "object_relation": "md5", "Tag": [ { "name": "21/5/2026", "colour": "#F16E40", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347026, "uuid": "e55cb221-e7af-41b3-a976-ea6b58f0b65d", "comment": "Malware payload (RemcosRAT)", "value": "14dc58949649a39f2f591d013e94b01d73bd1fdeaf2710637ab1ead3bc972958", "object_relation": "sha256", "Tag": [ { "name": "21/5/2026", "colour": "#F16E40", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347026, "uuid": "dcf9e3c9-9718-4deb-9477-0f85dda0ce8c", "comment": "Malware payload (RemcosRAT)", "value": "66f42e91379472839f3502070a8d638b8eff7e56", "object_relation": "sha1", "Tag": [ { "name": "21/5/2026", "colour": "#F16E40", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347026, "uuid": "4d9b1ab7-0c20-4783-b4ca-a23b2db4d4b8", "comment": "Malware payload (RemcosRAT)", "value": "1905a5bbf66cab6774c66ceb9c75c0d746c473581516eed37cf5212ac02451e839f3a9e072b0e32b9dbc4832203f200a", "object_relation": "sha3-384", "Tag": [ { "name": "21/5/2026", "colour": "#F16E40", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347026, "uuid": "fb5724a6-0539-4fef-a475-563f775510bd", "value": "T1AE93D813FA4AD0B2E42591F146426F31CEBCBC3636492173D38FCA41AD79892D456EBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347026, "uuid": "da56c536-f8e8-4809-8c5c-f732726728b5", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347026, "uuid": "983477f7-1f8e-45bf-87fd-e3c30711fa8e", "value": "1536:4hhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6vrt:ehzYTGWVvJ8f2v1TbPzuMsIFSHNThy+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779347026, "uuid": "1251a31d-1961-428b-b491-ed30510b45af", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779347026, "uuid": "bce30c87-f4ee-472b-96fd-28032f0a393b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347026, "uuid": "75f2d0d1-cc97-4a27-b2d1-79892af46d30", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9c80a3-551d-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372268, "uuid": "240f0442-740a-4097-95fc-c9e3f78b4d82", "comment": "Malware payload (StrelaStealer)", "value": "499c9b79b6245ef4ada0ed127f4eeb8c", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372268, "uuid": "b72c6a56-6b1e-4f42-abcd-e836993d2186", "comment": "Malware payload (StrelaStealer)", "value": "14e1f212a6d74f6d7da21f52f3d89ee1442012153120f3bb835e172b5e6a3541", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372268, "uuid": "c92fbe41-7439-4c21-9a3c-845dd5943157", "comment": "Malware payload (StrelaStealer)", "value": "5372b37ad03504052ef85aa9e3c8a78f55795252", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372268, "uuid": "9ae6886d-d0f0-4a83-a9bc-20e733cee8f3", "comment": "Malware payload (StrelaStealer)", "value": "d1c6cb7ee751f5981d54ac0320ced9a6be261a47aa7d9191be67743f7ea213cd742b693fd7b10bcacfbf77cf148fef49", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372268, "uuid": "204f9842-bb4f-4c03-b3eb-f80015739b03", "value": "T10A31F768F10C079DC73BDABE08825A99E165C36C40F883B5A98C34A8B8324FC0F11882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372268, "uuid": "194b8343-75fb-41e9-97f3-5a9bd88766ca", "value": "24:9HSJSovwGYnQBIDj2OY5mJcSzhPFGQXurhmIoY1+nzfbAYDWKRYwi03QzG+k:9yJSo4Gq3DPYB0Du1mPdzTAOWKRYMgSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372268, "uuid": "6f4b4147-4d03-4809-9d7d-47219974a9b0", "value": 1528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372268, "uuid": "70971213-c4cc-45ec-ac11-00e7aea44c37", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372268, "uuid": "531fe081-4aa6-4e95-8587-d8ddb9f2e11a", "value": "VerkaufX-XRechnung.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65e14a0-555f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779400472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400472, "uuid": "f697c353-40d0-4485-aa0b-47b48233c32d", "comment": "Malware payload", "value": "c60356821311e30c640fc8bba97c18a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400472, "uuid": "630546eb-a5ef-4dd0-81a3-6b87754096a3", "comment": "Malware payload", "value": "14e71c1d3297bfd33f6da5c91d878cc1f305628226a844232949c6fcbf94efb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400472, "uuid": "4699d1e6-78f4-4b1e-9663-54da7ded6d3f", "comment": "Malware payload", "value": "e1336e256008285800eec78da3786ee0edb6a258", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400472, "uuid": "35cd3ebc-c61a-4831-ac76-3ce0c2b5bc6d", "comment": "Malware payload", "value": "d7be0b83bbefef223e9ba261a1caef274dfb64398dec7efe2634ea97ee190238d41b840af63b4c6ae972bbeb6f185e23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400472, "uuid": "7b05f3b6-8265-4b8e-beaf-7fca4485cf88", "value": "T1B025E01BF91160B9E47360B1134FD376C924A634566388CBFF5A1D68AA3A2D09F3C35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400472, "uuid": "08c080dd-0867-437b-a2ba-ff919159cb79", "value": "24576:/UnOvpPA8peAZS7z2KQYu3LTJEpZjHaV88oErhoW0lM:/UnORPBpeAUJqL6pNHaV4ST0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779400472, "uuid": "227b9dac-2ee9-4d93-97c5-8e57b52de73f", "value": 988858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779400472, "uuid": "376e4f0c-dc23-4472-acb3-e45c64dc3b4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400472, "uuid": "2783592b-9728-45ed-8cfc-2f09cb99ba95", "value": "lduhsjo.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2775ca4-5529-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779377300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377300, "uuid": "5e970d80-75d3-4b64-8739-f037e0b2feae", "comment": "Malware payload (Mirai)", "value": "99c00ccd6b4f05dd531cc9471cfcc590", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377300, "uuid": "a0d320cf-a001-43df-a4f5-0eaa5ca00a64", "comment": "Malware payload (Mirai)", "value": "14eb6338704c4a6ffc5d9a9cd44bd9b8bbeb3f8820fed1c75deed3f40a926449", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377300, "uuid": "089f34f0-9384-4ce9-a665-ef1dcb87596c", "comment": "Malware payload (Mirai)", "value": "e86db5e52c4c004010699c84cb248d5569671aa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377300, "uuid": "30709c14-f15b-4d34-a95d-dc7c7ea5cb44", "comment": "Malware payload (Mirai)", "value": "a10554162c61fc2a8db16e158355d8ac34fd5a7a2681849d2f65ba566bd95c956b2dd55b819b59d39ecfc4020b521940", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377300, "uuid": "0d24810c-360e-4a2f-8f4f-5d767f57957b", "value": "T144856B4AEF45CD7ECA580670CCFB4B387737E0A81B06AF2B259D91343C93759AE46849", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377300, "uuid": "9a2c4028-08fc-4a7d-b1f7-386c38ad2c75", "value": "24576:0VHVcdstbxgp/O0kpCSunma41ZF1cq54hsZB/vi9DrW1qXuEPYi:0ostbxgp/cbKXgaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779377300, "uuid": "8a1b60e0-ee54-4c99-a228-aecdc022b4f5", "value": 1862336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779377300, "uuid": "d42e7475-0f2d-4280-a6e8-159add01298d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377300, "uuid": "ae4d9650-48d7-40fb-9827-4fa70b1ab798", "value": "m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b6e56f-5546-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779389779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779389779, "uuid": "44eb23d4-2c85-41cb-9cca-d6a4d97c6601", "comment": "Malware payload", "value": "24f1bbbb891d9107461d3017a1ecb887", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779389779, "uuid": "967f5ec4-10be-4771-89f0-a729719f7c47", "comment": "Malware payload", "value": "14f348fd0ea6ed64732676c7eb17bd45a83ffa76fade37439e75653099a439f5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779389779, "uuid": "8ce37ea2-a80e-4336-88e0-9ac5aa3251e9", "comment": "Malware payload", "value": "f21cb3fb5ad17d2a6be8fa4ad1f2141b219db214", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779389779, "uuid": "7b40713b-c197-45c5-bd22-b12b2051e28f", "comment": "Malware payload", "value": "4d40324d7e94f6eb801d94192959ac66871c18e23092d03fc0e62d2bf88fa60edef94d728bb18afbe2feb21b35c65c17", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779389779, "uuid": "d1a6e9e9-e824-488b-bfb0-e54953ad25e5", "value": "T174136D6526953C25AE99883B5C7F2F0CBDA983E2304491DDBF8B3CF18C55A9CE318719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779389779, "uuid": "b2a7977e-d888-477e-9c02-9b80dad46b9a", "value": "768:Xr9NyXsZztCj9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:7HusZ5co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779389779, "uuid": "588a7b92-a19a-49cf-b7a8-ed64eb9579cd", "value": 45533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779389779, "uuid": "6bb050f5-bfe1-4252-979c-2f4fcf8652ce", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779389779, "uuid": "e70832ba-d2e1-403d-9b6c-4168e5b704aa", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff26cf5a-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372274, "uuid": "01017f54-835b-4e17-bb20-6da6e6d67390", "comment": "Malware payload", "value": "3997ea4a9d0892ffe39b999e77dc27f0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372274, "uuid": "7f1a7877-8e81-4865-9df1-65a4fe462e7d", "comment": "Malware payload", "value": "15431437f4165d46ccda4c1bfa6a8eeb49f4be3f9f0927d98f279766e3b3272e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372274, "uuid": "1ee47804-b47d-4463-a8f0-98dcd77c4004", "comment": "Malware payload", "value": "fd7dd092a389e1e67294243b85e3ecf6cd344bab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372274, "uuid": "a9ea28d4-be08-40c6-aeb5-72de24e2cdde", "comment": "Malware payload", "value": "5f2008430eb54b5ce5581fe7388522cfdea61c8c50af8469b54379680aab3bfbb05d55b452b3ec69e10b6d98187d6bfc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372274, "uuid": "24769140-47b0-4aca-b482-285b4d38da16", "value": "T1AFB40EB4698B47D4F30B8BC12DECFEB550723DA3A5E609F60B68A6019F9DE513D0885C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372274, "uuid": "5615a0b0-5f7b-410c-b9ec-6724075fb1c0", "value": "6144:DaSdPgUiwsmU2A9DlbkaFlaNrjDVsfiYZX6lEXwRHQR:2SdPgUiLkaFYNYZX6lEXwRHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372274, "uuid": "223c951c-a425-4204-bbdf-b546b902acc7", "value": 496284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372274, "uuid": "115b7703-c699-41e7-a2b6-8c0e5990fd41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372274, "uuid": "6f441d59-f9af-45b7-b17f-99c8e44aa0da", "value": "CTM_USD70k_Swift_Copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd30238-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370504, "uuid": "b26b443f-bc8a-43ce-8644-4386f40d3bea", "comment": "Malware payload (StrelaStealer)", "value": "72ff287abdd1075929a108291a8cfc0e", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370504, "uuid": "9d087d06-ef47-45b4-8226-7d1e5cfda661", "comment": "Malware payload (StrelaStealer)", "value": "155fb8839fe122a73178857e27af5b9ef78e95ac42cb7411f72c304854c7a452", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370504, "uuid": "0ce2d23c-ceed-40b0-9cd8-177d3c5aae64", "comment": "Malware payload (StrelaStealer)", "value": "883b9cca20891b9e53bd28be5a444c09d5d0ad5b", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370504, "uuid": "bb9215e2-fdb1-4c71-8071-1ea9f28cb633", "comment": "Malware payload (StrelaStealer)", "value": "32865802691ff497b6e7f2d17322f6c009952a951796aa6760ab6c48b02c47c66b48645aaf162fac9e1a1df28ef8870f", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370504, "uuid": "84b8db3f-6be0-4161-b2e5-76395c19ee8c", "value": "T10192E12071B98623F22067B4A35B35220ABD6707C3D1372D85CFF952DD9147A7AFD06A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370504, "uuid": "f4e604a8-be66-43be-9042-20b8a79f71c2", "value": "384:Tnkoln5XmtWZzMVY3LPIYOtr37s2Y5MTmwP636W7MaBShpMgIbYz1ro4:TnJ5mtOzd3LPiA5iu6UMaUhq3Yto4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370504, "uuid": "228fd027-5b08-4d78-94e1-16a1f6e59e3d", "value": 19489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370504, "uuid": "8b376ad8-93cd-4264-90dc-b13b4d2a31d6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370504, "uuid": "a7d51ab2-a72a-41d3-bbd3-07704a824a7d", "value": "Rechnung2722397.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0123587e-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372278, "uuid": "981d2561-15f2-455b-b86b-ddfd8c56cd14", "comment": "Malware payload (Formbook)", "value": "6422d983d9620b7c075c2fc4f1b967aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372278, "uuid": "655efb38-2ef0-4064-b613-3ea685f2a3dd", "comment": "Malware payload (Formbook)", "value": "1561ad922077feff2c52da3e2c2e514c0e8e897a49b3bf74237c53b86eb4e064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372278, "uuid": "38b33231-7462-43da-abc5-1853878df9e3", "comment": "Malware payload (Formbook)", "value": "b9ac2219c288fc7bd9550de4a7adc0e785603cc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372278, "uuid": "c28696c7-d1a3-43de-8627-e37ef203638a", "comment": "Malware payload (Formbook)", "value": "cd41c61ff7544cdb08c41097133eb900daff8eb62fe294738027a27eb818bfa297363b2e694fc210de398042683f0e2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372278, "uuid": "e5922010-3e4e-4aaf-92cd-dbf9a95fbb7a", "value": "T1D5656A0323BDC0E2FE9EBD720A55A31156786D160132E51FD25F3DE9E973163C22A6E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372278, "uuid": "610264cc-ffe9-4a1a-b139-36c9755121a5", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372278, "uuid": "00100ec3-9c6d-4c13-8f6c-071767a913d1", "value": "24576:RqDEvCTbMWu7rQYlBQcBiT6rprG8apYy7cmIjyXZY0lm+L64/J+:RTvC/MTQYxsWR7apYy7AyXekbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372278, "uuid": "898c781b-d4c7-4325-aa23-f7c91cfe3797", "value": 1468928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372278, "uuid": "99a96d08-7b60-43b1-9d7b-5b0be1ecf8ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372278, "uuid": "341b8531-6993-432d-b7c9-e1b9a2a9f151", "value": "PO_240103728.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2019771-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370507, "uuid": "22f42985-8f0b-43b1-9e07-720f64b2a394", "comment": "Malware payload (Formbook)", "value": "aac8f8af6617c2fd6dc8e82f79420a64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370507, "uuid": "1105cd17-33c6-4fa3-bd78-6d001c97e4e2", "comment": "Malware payload (Formbook)", "value": "15790a8793243a4da6cc41ad91a258440c6cec9da0d95116994266d986cb17a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370507, "uuid": "be5aa802-d0f7-4954-9739-fb31b947b435", "comment": "Malware payload (Formbook)", "value": "53b364a853e7be27513c865f9574176b3b36de79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370507, "uuid": "555634d3-43c5-4baa-af42-a5db12fc47be", "comment": "Malware payload (Formbook)", "value": "fa7977258c0cced221a4a951daaef6c7d6d50d5b71a44b6b3899bb4ffa43062f6c099542a3490d14cfc96b637e529171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370507, "uuid": "10aa5463-fde8-4309-9dfa-561d5a2cfaf2", "value": "T19555CF22B3EE8264C77651737F1577116EBB7C3945F0B62B2F94393C9A70161220EA2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370507, "uuid": "19f2ea3f-31f1-4a5b-a542-7bcc4399cfbf", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370507, "uuid": "e7b66fbc-7ce2-4721-95cc-51a4923bf8cd", "value": "24576:7tb20pkaCqT5TBWgNQ7aij8VBWbH23zye6A:4Vg5tQ7aij8VBWbHWh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370507, "uuid": "1e039d13-92c5-4b81-835c-932b2d068be3", "value": 1393664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370507, "uuid": "9e6a40b0-f549-4051-8429-248839b79014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370507, "uuid": "5f265e38-35e5-4497-ab17-ab20eaa8273d", "value": "LPO_-_97866547876_-_7667438670034.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0499fadd-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779372283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372283, "uuid": "6c7db765-44d7-4d18-a823-38441ec85982", "comment": "Malware payload (RemcosRAT)", "value": "7c0d94f6fafb0ab183681f61613cb4a9", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372283, "uuid": "c244febd-e6bb-420e-adbd-faea718ec07c", "comment": "Malware payload (RemcosRAT)", "value": "15f5ef6a82f3b8130389d4bb30db1e6fe59344d5dfb29b1c1f5be28177ffcd38", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372283, "uuid": "887ba930-68b2-476f-a687-239f82b6a229", "comment": "Malware payload (RemcosRAT)", "value": "4ad1b2f30e160cf5c0dcbf7bc21aa3e7e7d173a7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372283, "uuid": "d4399fe6-4e83-46db-9089-eba75ed22864", "comment": "Malware payload (RemcosRAT)", "value": "c8d32c2f43c40d48ec05bad822ead4318fe53692892ae9ccd593b41e26432771313c0dba091537c4734140ace42a84b2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372283, "uuid": "8e99c9df-8f4c-4f37-bcf9-95ef3f755c4f", "value": "T19D514A4B96CE1C85E5D675E0216056FBA78CA51A09E48F51CBD83C770B3D6CB2823867", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372283, "uuid": "cd3567de-bdad-4a31-8cea-8c037fa66abf", "value": "48:9tGtVAFfUk/uAFpHS5DbQvA2QsjE/XogXO1k6QBS7q3FmH+76gKY5Punu4kSuEWZ:f7Jh/G5Dbx2Qii9XOS6B7xHwv5GtkJKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372283, "uuid": "483f3bb1-5eec-4d4d-99d3-f2162dace50c", "value": 2990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372283, "uuid": "b51433a9-4c36-4984-a342-bea1fe0bd069", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372283, "uuid": "0ea33fd0-bb7a-473f-b881-ab7ba9602c51", "value": "rfq_last_quater_product_purchase_order_import_list_09_2024_00000024.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4394b98-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779370511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370511, "uuid": "cafa12b9-0989-4f18-a36f-1ff5169a6be6", "comment": "Malware payload (GuLoader)", "value": "635727cac495ef3d711816d9956d3303", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370511, "uuid": "500be724-7596-4ac3-b8ac-b5e87a4f0b95", "comment": "Malware payload (GuLoader)", "value": "15fc3e84a1bb4f057034ae965321afffb4faf602aacc291bf4a524f961c6121d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370511, "uuid": "f1f66c65-8715-447d-8e48-4819eb873c75", "comment": "Malware payload (GuLoader)", "value": "a27cc729b0823fd827a4cac22675b5112b96bad0", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370511, "uuid": "5bf68960-e222-4c9e-97ba-0a72c99ef332", "comment": "Malware payload (GuLoader)", "value": "d99a9b9087afa4fca57db081ef85cbbc923e56245d504c5af4dbd8db205586648153d0f46b08a83bbfe4b27f6ac00c8d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370511, "uuid": "4ec40727-185c-4ef2-a6bc-2c281a083f84", "value": "T16E84233AAE284531AFADF7D56A61DF41049DD9A6EDFBCB2311030CDF748A12468BD308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370511, "uuid": "2255938d-a067-4687-ab87-9f2affa4c5a2", "value": "6144:DfkbFNgaDctiVTI5SWTUQBHUdmE/L3SptyP+/QpZW9vDqL7XP/fxeVMY0Gj:7TaoIVsTUKHZgKyP+ofWLwD/8ShS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370511, "uuid": "15013695-eb20-426a-8b64-e4093e9e48bc", "value": 375967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370511, "uuid": "f4c2d01c-7ccc-4af3-ab12-acc4144ef040", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370511, "uuid": "1608e4aa-6876-49ae-ab8c-6af224571725", "value": "inquiry_4387.z.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff10030-5508-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779362934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362934, "uuid": "3e81fc4f-00f8-45f1-a34c-955ab1e142df", "comment": "Malware payload", "value": "7ae8eaf938adf157ce388b3d570d7030", "object_relation": "md5", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362934, "uuid": "ccddc8c2-ca00-4a11-8a91-6a810f10476b", "comment": "Malware payload", "value": "1602e827dcc914587dc22d55e49d26260c14c6ba86bd51f78b8ff95941ce290f", "object_relation": "sha256", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362934, "uuid": "f8324817-0923-47a3-bd0d-5647943440ce", "comment": "Malware payload", "value": "5455f1b8653febed37f75c1a5e429b5c0a37d1a1", "object_relation": "sha1", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362934, "uuid": "00164441-9abc-48b5-981a-48c83369827a", "comment": "Malware payload", "value": "6b03faaf9dab0cacdba65b7072eeaf1264d6a841a10d421257d3b5310c9ca0a28313a3fe2da0f36556a52a27b0aeda7d", "object_relation": "sha3-384", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779362934, "uuid": "eab0bef6-d959-4ba0-b9b4-966142e92bf5", "value": "T12D3533460D70DBD4C22C81F216B797198479BC0D2771F3356E056EA9AE882B63EE9307", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779362934, "uuid": "9ec7154a-161e-42f0-9ebf-b8c03c0535fa", "value": "24576:Skw0XQFJzf229fUeoaylKayrEbhHaj9s8ZORv305d5JcK1JmrGuquJb:dlXSK0cenylKa/hwhZavkRJcKwGuqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779362934, "uuid": "e37e18f7-3b29-4361-babb-fffb2e187709", "value": 1155232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779362934, "uuid": "ee634101-d613-43f8-a93d-5ff014fd6dbf", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779362934, "uuid": "2c1bcbe7-b26b-4daf-8f3d-6a0b87fa8fca", "value": "1602e827dcc914587dc22d55e49d26260c14c6ba86bd51f78b8ff95941ce290f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06906125-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372287, "uuid": "41b1c3f5-dbaf-4399-b189-93ca51091622", "comment": "Malware payload (StrelaStealer)", "value": "61985789de51cdbdff2a36599bd7f1bd", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372287, "uuid": "18d89db2-6d46-4c45-a9e1-fcd09cbe756c", "comment": "Malware payload (StrelaStealer)", "value": "162f70470830a3e3acbd900ed76825250b07cc257634df575d2f366551db8383", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372287, "uuid": "35261c26-01be-469d-b9e3-bb8824ef708e", "comment": "Malware payload (StrelaStealer)", "value": "b728c42b374497085b4f6de81156b28026b3f1c9", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372287, "uuid": "cc3f9001-e0b7-4303-9849-b46ea08a9397", "comment": "Malware payload (StrelaStealer)", "value": "0202722f57aa09d9dc3c4c27c9918bcf8bb2ef5bfd76e4e68afaa9264eff710bde3880daf2310e7776cbb25d00e670a1", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372287, "uuid": "1661c7c5-921d-4571-9684-1d3732eb9cb6", "value": "T11311D8C4565B0F89D20882BEA147902CC571DF1000909F97ACCE3C7388C12AC7EB1738", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372287, "uuid": "ee406912-fdd4-4093-a872-97a5fae76f70", "value": "24:96iTdOJAZEUWI2DfDX09U1nG5+zd5BEM9tg:95OJYWIkLXwwGQzd5eMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372287, "uuid": "1edad1ff-b188-45ea-9a43-2e33cc5d0c64", "value": 1070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372287, "uuid": "b12ba0b5-a4a3-46d9-8148-6db67c1f95aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372287, "uuid": "2a9b8fab-4a03-493f-ac4d-c5e1261fc47b", "value": "RechnungXFV-UE24-243304068XvonXALNORXCANDAN_O.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2fd453-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779372293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372293, "uuid": "f5d24f0c-599c-42df-bad8-71c36eb886d2", "comment": "Malware payload (RemcosRAT)", "value": "f4d2abd9141e1f60cd1e518a700e407e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372293, "uuid": "e4494ebb-ea13-492f-9bc3-5cdd6ef8f002", "comment": "Malware payload (RemcosRAT)", "value": "165bd5cfc46baeefab886b4375416e2ee062f81ae488a551f5636acdeae1a592", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372293, "uuid": "15dadf21-fc34-48cf-88b5-19999835ab1c", "comment": "Malware payload (RemcosRAT)", "value": "64709c6fe99d4babf10baa8e26f8ac1d4e58f697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372293, "uuid": "349f2dda-18f1-4fbd-b10d-d56e99f55560", "comment": "Malware payload (RemcosRAT)", "value": "bc2e3dd5df5d381b982e167156c4c2efc2d70d96674739d2ed017451d575337b7131609835114057cc73d78bf835e699", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372293, "uuid": "cd109bc0-9370-4c95-9104-bd6c5e6c80ab", "value": "T1332501213BFC5FAAD576C3F95064900517F2B84FA4AAD68A4EDA70DB75B2F010B50E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372293, "uuid": "0deb65b5-b811-46ee-947a-7cdb10461288", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372293, "uuid": "d62c31f0-7da6-40d9-b191-f7a8bad61cac", "value": "24576:MIxgpEWM+ajGlE4xp28gWqTK5KAbTkCIrdBUjtx7:MhvQF4xp28gWq2Ack9BUZx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372293, "uuid": "4e51c010-87f0-4c2a-b7f5-603fe36dd3ce", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372293, "uuid": "9be31ce0-36b7-4a44-960f-fe8efa70c2ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372293, "uuid": "fb843a80-dd71-43d4-83e8-38fded970286", "value": "AWB_411744484099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a401e69a-5500-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779359666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779359666, "uuid": "98c11e2a-7d86-4215-b88a-310b3240869e", "comment": "Malware payload", "value": "32e02be38816b2cfa9835ab88f9a5d7f", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779359666, "uuid": "b49f92cd-c3bd-4399-8d20-2183cb18eb6a", "comment": "Malware payload", "value": "1667fc6f28dc820c19c37fb2afe7258be6ff4628249c26ce18b09fd4af5840cc", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779359666, "uuid": "cde2d3b7-a129-4373-9589-6ebafd23d919", "comment": "Malware payload", "value": "0026ccef8adce27ad472d1daafb856b6de802263", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779359666, "uuid": "9482fc47-b9b7-49c3-a1b7-f03dbe636e90", "comment": "Malware payload", "value": "3f408a85850316343dd9583591f60e58cbde589f20051f3e2fc9af0d0b4b74fe6d2f718bb395ebccc170bb5a449ddfa6", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779359666, "uuid": "fc57c8c3-4359-4ba8-a087-a71ce3966b2c", "value": "T13D92D28025E80300F5B5BF35DDBAAF490837BA90EE35D35C4D108C6C6954A01DD76F7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779359666, "uuid": "f87bd112-af8f-48fc-ad15-91d54434609f", "value": "24:qY/akn/PJuvXSf0LRiqX+yDW9KT6pTyJWNbwD8BxU/n9vM3Rr2UZu/m+V:NFiLQqXFDW9lpdUDkUFvaVu/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779359666, "uuid": "424e1d89-c705-4ee2-ac75-8cdf410929c2", "value": 20875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779359666, "uuid": "3c53962c-c73e-4c6c-9422-72764c225aa9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779359666, "uuid": "4725f29a-30f0-4079-94b8-45f56642f7f3", "value": "Koval_M.I._PEREVOD_ONOVYTY.xls.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8099bd0-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1779370518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370518, "uuid": "f1bdbfd8-3cec-4188-948e-7f03849c6e6b", "comment": "Malware payload (RedLineStealer)", "value": "ed7480dfd2d2fd5742d7b4eff9c1d26d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370518, "uuid": "82913b4c-fe30-40b6-8fb0-68130b77be27", "comment": "Malware payload (RedLineStealer)", "value": "166fec0187fb56dd61b937fa2c903a762102e1c139b47682eafa4cce0e991e7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370518, "uuid": "0712e9db-3752-4b6c-b5a1-f12d8e1a55a8", "comment": "Malware payload (RedLineStealer)", "value": "5a69a5ec59e9bfcd221ca0925d774516debfdf4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370518, "uuid": "9bbbe30c-38e0-4a8b-9618-d45369da789c", "comment": "Malware payload (RedLineStealer)", "value": "146c46d31cbd9c48d42c55ef2a785be58ea66c06f192b1b2081b78044f9fbd2e9bc1338c8b665086a4261b9f012de007", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370518, "uuid": "76be234d-9c21-4c84-b05d-cac97bb547b6", "value": "T102252393E29198C8D43310F05CB29F7A810F7E2869A14F5E76A6F679C9B234053B3D5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370518, "uuid": "ac744958-64a6-475c-b6a4-12e97724832e", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370518, "uuid": "c0df63e3-8b60-4a65-862c-8093cdf443c0", "value": "24576:biUmSB/o5d1ubcv6UtHb63cCdRm9ndM1N7Z8lUP0q8CVIwGO:b/mU/ohubcv6UcsCOdQJaqAwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370518, "uuid": "530cb1c9-1db4-445c-b2cc-5a3f93cd4355", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370518, "uuid": "da3ac310-fd4c-491d-87ab-238ec7004b94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370518, "uuid": "f3dbd7db-37f7-4cbe-a694-f2f39289e8b9", "value": "DRAFT_BL_&_MBL_PO_NO_ECM1D2403-29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21de3c0a-54ee-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779351717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351717, "uuid": "4b46e450-6ade-4fd0-b6ae-a41a19393df4", "comment": "Malware payload (ValleyRAT)", "value": "db85e60219cf07f3f27b32c3a774f7b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351717, "uuid": "44f2d704-bb82-4828-85b7-7c03e87a9f54", "comment": "Malware payload (ValleyRAT)", "value": "16a772d508add92dbc9f0d1a6839b6cbfe90fbff5dbb7daccec062534968cda8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351717, "uuid": "1316d36e-7a2c-4297-8f91-55aff854e9f9", "comment": "Malware payload (ValleyRAT)", "value": "46d54584aafbb033aab9bcd80369a4a2de000e4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351717, "uuid": "515af1ae-b6a3-4610-9ed4-08993eb1ef65", "comment": "Malware payload (ValleyRAT)", "value": "002b7f2d95eb07db3f433033ab24b3a9a4b128f3f023c36327daa58a237a5d5c967767548797de0603d36b38b44cf787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351717, "uuid": "871a505f-4ee0-434a-9839-c3a4b52901a9", "value": "T150843A432E944C84FAAF2570853D99EF98FB3D79EFE0918D1394B2CE09F179158B2252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351717, "uuid": "ae7206e1-3bd6-4538-9298-ae7bf7a05ef7", "value": "61aee1efa149f59d7615c8dc7392ffa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351717, "uuid": "2fd5f611-fb55-44e0-9b19-0330fd8eee17", "value": "3072:rAOJfTHHG3Na0p8gdRAaJVYYPwtJVYYPwi8a0p8gdRE46aT+TZ4jWYH+YTK9awLb:rPJzw6gdRAow5wiPgdRqBEh729Z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779351717, "uuid": "d48c10b0-685f-48df-88a3-72f23d9ef94e", "value": 383504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779351717, "uuid": "03915565-3d1d-48f4-acc3-7dc5eb40fc31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351717, "uuid": "4898a718-c13c-4195-bb66-f4f1d31b09f2", "value": "2026.05.21\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebadc98f-5519-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779370524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370524, "uuid": "384a9fbc-f8bf-4ea5-8845-11e61f2573f8", "comment": "Malware payload", "value": "cf3b25e294f6a95c38d2a000f9c815c4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370524, "uuid": "2732094a-1a9f-4b8d-bb06-037ba3891adb", "comment": "Malware payload", "value": "1749cb8252569c74ddb71df69d490cb0951f8a76158663d941c7cf273ef824ad", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370524, "uuid": "27a1400a-8a27-400e-a92e-631bf743f625", "comment": "Malware payload", "value": "1b19e1ff4d1512b58fa48c2f7bd950703977b165", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370524, "uuid": "3712ee9a-22dd-4297-b619-5ae48631a5dc", "comment": "Malware payload", "value": "5285a32908782c0a582fee61cf3237df30dd52b247a3d0315aa5cff80fc77201b0feade08caf3c6e7e25ad3f14ece00e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370524, "uuid": "dbdb1859-839d-4d5d-a28d-d55651140fcd", "value": "T1D9A3129E807B446E0995BFA742C6EBEA3BF60D411BB44CDC44278C07191E393A62DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370524, "uuid": "43242234-c697-471b-8e26-4192cc4979fd", "value": "3072:U1Ux0mqPSy+CVgwcltcJ4amB/GvAayfhz:U1Umm3v+2tjj/Iyfhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370524, "uuid": "cafe6975-3a5c-4af1-b526-16f9db8a84c6", "value": 106230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370524, "uuid": "0455cb2b-9f1b-45c6-8e3c-23d8e28435f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370524, "uuid": "8a09277f-75e1-4969-a352-0bf8f042eb0f", "value": "Banner_MobileRect_300x250_Blackweek_sbs_de_01.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edaf4990-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370527, "uuid": "7e999a97-463a-4c47-aa85-ffb0d8483c96", "comment": "Malware payload (Formbook)", "value": "bed4f00a1ee458c107359f401a449e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370527, "uuid": "7eefe391-b3fb-4e2f-9977-c39c14edef77", "comment": "Malware payload (Formbook)", "value": "1782566f16d93dbd5d65860ec3390fc6d7aba821ab7bcbdc6abc46bff72f5317", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370527, "uuid": "1c3bcfc4-c29c-4b66-adfc-2df86d6e3468", "comment": "Malware payload (Formbook)", "value": "91b01193617149daa31a29d9128a5dbb284e43df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370527, "uuid": "9f6284bd-25d5-4c89-99fe-d0aac932b913", "comment": "Malware payload (Formbook)", "value": "9a76406b5b5d6c0cdfafc8220653261798b9cf100a7748028b175ac98600a02de92b44f4055f9b8e67e3a2398826c917", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370527, "uuid": "3bf72204-24be-40f9-b1f2-e9c156687d5c", "value": "T1B305F19C3604F58FC943C5318E60FD74AA546DEB970683039AEB2DEFB91D8968F141E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370527, "uuid": "bf6bf8f7-a991-412c-9914-fceff40911e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370527, "uuid": "3413ecef-e8cd-4631-a4ed-db105e4eff1f", "value": "24576:JiIIeeEojlYqJ5LG1xCvcMLq2o6kJvtIP:sIBeK05LGekB2o6ktta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370527, "uuid": "82d8ede5-92c1-4ed8-a2ba-c231f93cb915", "value": 828424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370527, "uuid": "89cb57c2-be85-4922-9fcd-8ed10ecb2bde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370527, "uuid": "10241640-18ba-4878-a7c7-de8cc4f529eb", "value": "WaybillDoc_5112006093_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de14839-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779372299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372299, "uuid": "08724338-6c8e-4a52-9714-f92662f15a58", "comment": "Malware payload (RemcosRAT)", "value": "7d1f5daa834e8d54d7f35ebb5d4db003", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372299, "uuid": "644c2ab6-f9a4-45d0-8c5d-f40267050448", "comment": "Malware payload (RemcosRAT)", "value": "17cdbd04ee380e72ad6a4e54e7b8494d442d55f9b4e484d3aad1878a6a0d09c0", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372299, "uuid": "cca519ba-b86e-436e-afea-577fd92f85b7", "comment": "Malware payload (RemcosRAT)", "value": "3c71acf13195590fb3454409980e06c3e2cb7226", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372299, "uuid": "4940c1c3-0a7c-435a-a417-474250e18f9d", "comment": "Malware payload (RemcosRAT)", "value": "8e06618b18b7c0951fbffa419408ca253460770ad28cda56003b5b14b35b22f22c7776809e4d6a9d2598a103e5192c49", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372299, "uuid": "1c589ca1-495a-4d01-b739-27965ad212ad", "value": "T19915331B69306A7C260879D6E624644BCE32FD30EDE44263DF3426A19177C7C2B7E61E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372299, "uuid": "2e32a16a-5d9d-4929-944c-0789caf15ec8", "value": "24576:aOJqMt+1XeGleJCFzimMAh2peoVLQw4zrwGg8I1jzWpax8/:ahMtgleK2mJh2pLVswDGg8I1jzW6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372299, "uuid": "91cca5d4-0f0f-4394-a062-8050662879c3", "value": 880827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372299, "uuid": "f5ffd845-7b15-4886-9707-6cfd6596563f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372299, "uuid": "887667f5-a373-4686-9aba-eb5db2aee96a", "value": "AWBX411744484099.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffd3925-551e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372303, "uuid": "e7885cb7-1e58-4daf-9582-250366975483", "comment": "Malware payload", "value": "c819635ea43773195533adaa4a87b590", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372303, "uuid": "d030b806-ec95-432a-b08c-0aef56a035b3", "comment": "Malware payload", "value": "17ed0974018b98d1db8b67acbd96971a9d53d11d3d3c714b46ec0601a2ee841d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372303, "uuid": "156f23c8-bfab-4e0b-a7df-d2cd5f498f76", "comment": "Malware payload", "value": "6027d6aab88e9b95a56ad7923a83f78f4fcf982c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372303, "uuid": "5fbc9c70-22b6-4b78-8afd-55b93e62f03f", "comment": "Malware payload", "value": "0d187be8c67caed779d315e81c1f3fe2dfb6516de580ffda6cd19eb7b34c6c952f92431334ad018aa516796d24bfe263", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372303, "uuid": "f0d7ce17-0400-46ea-9824-936b4a2a989a", "value": "T1B3931220AD1A49338E05A1E58EBD71F0F95A248C0E2F3C6655C2E3124DBFE336B975D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372303, "uuid": "5c0c8f6b-4b71-496c-b2d5-c006e061dcb6", "value": "1536:xk7+NpCMW3e5fTis2PaWjXsCMpcf1lWgP1Jkesvxhoic+9HoTCoUVuvdQ+Ox2tGo:vCPOJWsWpXs9ylj8eWyic+9HoTKqWUtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372303, "uuid": "df9918a7-4a08-4d51-8379-47b62dd2b617", "value": 93770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372303, "uuid": "d4c69a85-37f5-4cc8-8a96-ef2179e04e42", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372303, "uuid": "6e077409-0fde-4e0c-8825-030b18a0da9e", "value": "FREIGHTXINVOICEX80189CD.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122ddf1a-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372306, "uuid": "f61480e2-316a-417d-873d-0bb6753f601c", "comment": "Malware payload (AgentTesla)", "value": "20dfd008961b0ac1448ebc090540e028", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372306, "uuid": "4663e46f-1f4a-4b62-b3d8-a45bd12f22e6", "comment": "Malware payload (AgentTesla)", "value": "1852ae4be43d1d9955cff1d4489a5e7dceca605668fc8f2f9358c08c5a5bfcc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372306, "uuid": "5f118bc6-4c30-4a8d-891c-ab59924cac26", "comment": "Malware payload (AgentTesla)", "value": "3bc89db7869d72b7f77f07bc47eaee2641fec8eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372306, "uuid": "2427c54b-77e0-40a6-a8d9-64cbef0c6e64", "comment": "Malware payload (AgentTesla)", "value": "772f8e6f4b56d821c911c9798d01b90854e7c5e03c87371340392b97b17765adbddd48c55a2c75bfd5f5210b96da57be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372306, "uuid": "d0664a31-4223-4389-b56e-8afab1592618", "value": "T1D7E423223C9E290E9C8B56A435AAE7F7C4111E5248EA4E2776D4707E704BE14F35CCBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372306, "uuid": "4b6c9f86-4106-4d77-b5e5-0de6d37bf16b", "value": "12288:VjOrpP+ptIeRE7ZKWCLM9VfXCk57kX43pkf8jp/bLmHSxvVLhRo:kr5St5ezCLM9VPCq7Jcs/bLZFRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372306, "uuid": "d6936cff-489c-4bfb-89c9-d0c34f16f326", "value": 657970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372306, "uuid": "96d06205-2bbe-4907-bb04-93a1b8e65dd7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372306, "uuid": "c91a4d60-3b44-4f25-b0a2-defc211d5f4c", "value": "Ferrecsa_D701163.uu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14500ebe-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779372310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372310, "uuid": "7b248721-ef6b-4dbc-862c-b32b87008e61", "comment": "Malware payload (GuLoader)", "value": "b4ddc78d8e3bd96d1cfc82a668cde2de", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372310, "uuid": "4b41704b-bd2e-45db-8446-24ae68125ad4", "comment": "Malware payload (GuLoader)", "value": "186b4bd89ad84572f85c624994921747a3da44ffc426c4c9b9ec4c8a8e92b8ce", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372310, "uuid": "d99533e0-1702-44a0-a825-5cb15c9e58f1", "comment": "Malware payload (GuLoader)", "value": "39d06caefaa0564080a1b0646b231cc831b958cb", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372310, "uuid": "187c402f-b10c-4428-b3ca-b977f7f3522f", "comment": "Malware payload (GuLoader)", "value": "5907b29aa62d6b3fcd6fe3117a69501291e5da5158d4c915a49ba0e90c2e2071a9fb6b0c62b750ad37a80615881a2630", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372310, "uuid": "adba44e1-e71c-4af2-8ba6-21d6d5e264bb", "value": "T1323533FC85103736F52D4E781D0960D6E18BAACD1F22292A29D654E3B1BC3FC57A6F18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372310, "uuid": "92374719-ca21-47bb-b810-bfc5b7ac97b8", "value": "24576:zqBRvw/gQBzZ5Z/vO9RK3rAQjnmVOtjDtRjw8MVzc2HACY6z/U:zkRvwoQB15Z3GUcQjmVOJocAX/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372310, "uuid": "1ada1223-06a4-4edc-91f9-89faeae878b9", "value": 1085617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372310, "uuid": "dfa800ed-efd8-4305-8c4e-c64f0d0b3778", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372310, "uuid": "9789ef33-127a-484e-bb49-5fb979be8448", "value": "RevisedXPI_2024.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe60857-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370531, "uuid": "0e2d508d-4860-4cc9-a94c-ad633d797965", "comment": "Malware payload (StrelaStealer)", "value": "035849e213b2d67691fc2b074f7a83fa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370531, "uuid": "12700fe8-fc12-4e36-9093-23c7de7dfb60", "comment": "Malware payload (StrelaStealer)", "value": "18dc7f7ef25f11da729b36c5a8ef4594f2d2cec8dafdcbae9f741e5253e98ffa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370531, "uuid": "45c41ff7-f61c-4588-9d61-d85730d944ad", "comment": "Malware payload (StrelaStealer)", "value": "c12102a6050a49136728be9fc540dd3f1fb9f0ac", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370531, "uuid": "cf8e34ca-adc1-4003-9432-e6a2762b026a", "comment": "Malware payload (StrelaStealer)", "value": "c71f889aab4638aae22af011b9f42516146dd54cbb753e2dd85ff114a6e270ac156b79f9bb6babae2ed7d9fca5cf82fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370531, "uuid": "6259cb2f-210f-4526-a9f0-86a41f00c7d3", "value": "T19CB53C42FE4A75656BAEE40A254BFDD219F9C9BBB815C4C20B3A388DD410168FFC3176", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370531, "uuid": "9d7ec688-6386-4b8b-8f1d-998221a2ecb9", "value": "12288:2LQgrHA9AiA9ABIAc4G+oWWvFoQGErhWvFoQGCvMnBE9nK4x:Yo6rC7c4GjZcKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370531, "uuid": "29a7563f-c163-4d04-8a8a-b461a2060f27", "value": 2348959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370531, "uuid": "472373b9-071d-435b-8b47-75f400fcf0ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370531, "uuid": "16ce5eff-858d-44f3-a0f8-95e9388ac34d", "value": "1771011035217654451.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181a12a0-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372316, "uuid": "488afe47-bc10-4875-bfb3-a4aa139bd973", "comment": "Malware payload (AgentTesla)", "value": "31c1ec7655c1b2a302b248b4f93c8365", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372316, "uuid": "17118489-6824-4c08-b670-1656e747ab25", "comment": "Malware payload (AgentTesla)", "value": "18f45455028bca78db58a8efd9e874a8362c77e1f1a7fa07aa5ddaff7df66bae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372316, "uuid": "e0623c75-1eea-45d2-af6c-1170870d7cbc", "comment": "Malware payload (AgentTesla)", "value": "0dd687cdcbfb4b9c066d1979957e7a88aed79630", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372316, "uuid": "bf96f27e-af93-4641-95f7-bdb058da2938", "comment": "Malware payload (AgentTesla)", "value": "d01f2bd1caca3eda1a07d268e3ec85adbc29dda7676dc551d343231f66fa86f8958f5c7d75fe2f19eccae4f0da1b815b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372316, "uuid": "fe230654-48f3-47e5-a3ff-6479439aea9d", "value": "T150D4237C8EE9B152B7860D4455DC373BE2E084B5FB60D696E031C2B9FA8944258E42FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372316, "uuid": "ebd5199a-ca84-4512-8027-3e22566b1af6", "value": "12288:UgBq440WXxrXp0QFg4k6Fur2hHGxEfrNv0vt0rZQ7ObsN3UmURudJ9bib:hq/0CxrZ9K4XuChHLDtRrq3UmUgdJ9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372316, "uuid": "12c0fc23-faf8-4ac2-9cf3-1fe71613b700", "value": 644572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372316, "uuid": "90c8c57b-9841-4ec3-8870-dc543faa4dbc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372316, "uuid": "0f0e4e50-5528-4f2f-8bfe-47285e899ad0", "value": "QUOTE-2K840322-A-CCC.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f206ef3f-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779370534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370534, "uuid": "fd870727-24dc-481a-8369-ff65b7d3176b", "comment": "Malware payload (MassLogger)", "value": "093fb0ca0c0771d36d583f1c07895e67", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370534, "uuid": "05c31de4-664c-4753-b637-f0872efa8814", "comment": "Malware payload (MassLogger)", "value": "190a48b33f8fa0a2e41094c6736bc12cfa6a56c03d5f770a35afbcbfdf5cbbd8", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370534, "uuid": "87c68bcc-4bfc-4ece-baac-853a0b713808", "comment": "Malware payload (MassLogger)", "value": "c2c4c000a92b4a970e9d3e6d11e972fac3d0c42a", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370534, "uuid": "9491ffff-438b-499c-8a21-b2fff34570ae", "comment": "Malware payload (MassLogger)", "value": "00bde1be503eb65a01927787a5a800f77fc6c7e39442a3687cfe351f191e79f0f35cf56c6466446b44a8abbb37b320af", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370534, "uuid": "cab3067d-4be6-45b1-9528-20383d77c28b", "value": "T1D6B423FA7F54C48940507AF88313FBE799D40709F1DF8A668A05DC3296EA660DC1DE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370534, "uuid": "a28c8d48-26db-4a38-abb9-94473badd1ac", "value": "6144:wST5e5ES49Vn8WQH6YKZH9WomzT4f1lgAgcpNuq/VavryhzBGdSz:rY572V8WQXKZkLzJ+uknz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370534, "uuid": "61d2840f-cf73-45f6-8ff0-d90d703799ba", "value": 531721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370534, "uuid": "7ba7e863-906f-44d7-af58-f82192af73a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370534, "uuid": "b2de803e-49d0-4390-8561-3a9f0b2e29f7", "value": "FCM3903.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42bdcea-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370538, "uuid": "3ccf415c-acad-4ee2-a42c-c54a00d2e410", "comment": "Malware payload (StrelaStealer)", "value": "58e17a35db8a83cc4dcaeed096ee0d53", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370538, "uuid": "ffc7d33f-f97b-4cd2-af69-6fa12cbeb4ad", "comment": "Malware payload (StrelaStealer)", "value": "191e9064503a54cb7b04ddacb34d4e34a67c248a8d44942a8dfc04204448854e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370538, "uuid": "7658a3de-429b-4413-935e-96387026b97c", "comment": "Malware payload (StrelaStealer)", "value": "ebf1e9b6e2b0889900e7f36f85b29976abfb3a0b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370538, "uuid": "c026afac-3672-4588-9de1-010a73b51dd2", "comment": "Malware payload (StrelaStealer)", "value": "608023d00a3fc6d1b87e5c7125d3e9f5dd757d86a34e1590b0484cc3de607ca44c64d04d3d3ae6014f51ec1b073e34c7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370538, "uuid": "76fdb01e-f04c-498a-ad72-bfe0d28e165c", "value": "T1A983A2AB9392C52AC653E528C6ACED72C6600FEF6372FF58145D72F74603A4527EC818", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370538, "uuid": "2b70273c-9b67-4dac-850c-74723e8a04c8", "value": "768:aaIBHCCWPaQyrYpzkQvyRA/AWvLfmhgYpzkQvyRA/rlEXbztXo4E:aaIRahJvL/A8mh1JvL/rlEXbBX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370538, "uuid": "6aed146b-fd33-44b7-9a5a-4a1f2918c8bb", "value": 86314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370538, "uuid": "01e6e045-dcc8-4c1b-a347-5d93554efe69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370538, "uuid": "3b6e390f-9363-4b40-a57e-051eb7a6a745", "value": "13636207852716631976.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63e4100-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370541, "uuid": "c490a955-39dc-4c76-ac41-dd68b77e588b", "comment": "Malware payload (StrelaStealer)", "value": "65c9d0afd621533cc007f8b9f932b52f", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370541, "uuid": "205cca1a-bc4a-440f-828d-23dba50108de", "comment": "Malware payload (StrelaStealer)", "value": "1950053182723d492599b1391c6eb6524b5f815b86d7f8c43aec7b4d35059641", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370541, "uuid": "01f1b3bc-a267-4cfc-bbba-63dd2ba267eb", "comment": "Malware payload (StrelaStealer)", "value": "10ab438a62e77155a2a7f65b11501f5efcfa659c", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370541, "uuid": "e37fb077-6be6-48e8-86c2-b16b1a852cc3", "comment": "Malware payload (StrelaStealer)", "value": "db3c95b559213363996ffb017d5d50525ed2d487b780938ea2d2c7e0c7b9f364f8ae13190d271b22340ebe7f3b4d53b4", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370541, "uuid": "892a60cd-2a99-44d1-8276-13087ead7322", "value": "T1066423C52105CAB997E5F707221C26DCCA23447E216A1738F3A6CE5B58E0670BA73DE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370541, "uuid": "8d3b8415-cd27-4c6b-9377-0165440cdb60", "value": "6144:ZYZIpzgVhbb+NBWB5D6a4mHbqXWlbhzo7WugOiq2vHaZoqfblEFZEVx:Z2IpzgDb+NOB4fXWphzo7S5q3DDliZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370541, "uuid": "3455e9d7-97a4-4d51-9957-db12a84c034d", "value": 315236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370541, "uuid": "5a21ebb8-1c32-4112-9045-84d42dca8410", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370541, "uuid": "9333b81f-f9d5-45ff-b693-c236017f5648", "value": "HP-Rg_Hausser,_S._(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b5b8dc-5513-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779367883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367883, "uuid": "f542ca4a-8810-404a-9ce3-e47dc00bba84", "comment": "Malware payload (AgentTesla)", "value": "5771a4694bcf033129bf533e9d7ffdd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367883, "uuid": "39b174c7-ec6e-467a-9fea-dda05d8573dd", "comment": "Malware payload (AgentTesla)", "value": "19b5ae7ef91f114a2bd84284be36cf7699cffd2bd4ecfcb07ad5bbba790d3920", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367883, "uuid": "27a9b803-88fb-4391-9ecc-107290b40ce9", "comment": "Malware payload (AgentTesla)", "value": "e6d7fd547a5770eca4f4eed23730b260ec443662", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367883, "uuid": "4fe0adb0-de22-43d7-ac58-c9fb6e8a31c9", "comment": "Malware payload (AgentTesla)", "value": "648eceef010c075ef8ef7aeb4acaa09c3437ca2e6917ef4534d5226db5fe62ccaf9d38c7c4455a647edec384e6bf07be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367883, "uuid": "a33f1827-91e5-4e6a-9b7b-004c25b5ea34", "value": "T1DA340F027F88E715E1A93E3782EF6C2453B2B4C71633C60BAF49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367883, "uuid": "726c5475-3ccb-4799-be48-1c89ee89b347", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367883, "uuid": "5fc996f8-4a3c-4d0f-9471-f324a2b6804e", "value": "3072:tKliq6CyZVc/2MKc2BLIg0THo9rG8KaG5jnThgqYufzz:Eiq6CyDY2Mk+sq8KaWTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367883, "uuid": "708d890f-c475-4fdd-94ab-144f5789e256", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367883, "uuid": "f44858a7-7678-4019-aa3f-935e4cd6b1d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367883, "uuid": "0174945e-8b25-45b2-8167-a7f008930fd6", "value": "19b5ae7ef91f114a2bd84284be36cf7699cffd2bd4ecfcb07ad5bbba790d3920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d571ecb-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372325, "uuid": "5c21812d-9a95-41a0-9b01-e516ced02a0d", "comment": "Malware payload (Formbook)", "value": "4e737a00e1380ea2dbf63f30196f5e55", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372325, "uuid": "f58a211c-24d8-4dd8-8668-d801cb102ede", "comment": "Malware payload (Formbook)", "value": "19ffbe48fd2f4788e43a5145deec1c1b5757be4df9a73948ce9408db98d96a89", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372325, "uuid": "a39d4566-6c86-487b-a7f7-e53b7fca8576", "comment": "Malware payload (Formbook)", "value": "aa90590280a8e3b19d0dc7fc0c2ac3ed355198fa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372325, "uuid": "a3470695-b471-4bb6-808e-d9c172528819", "comment": "Malware payload (Formbook)", "value": "c1432d5c210de256c6315638e20e5887100c52593846c3069e28f681d1e8c88dcac543f69b612ae8cd33a9ed90471252", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372325, "uuid": "3f3ed976-b2b6-4936-8dc8-9fe4bcdfb597", "value": "T14B05232E018B15C1F19F647F27BA017D8296286EE8396AB4681F477C13BA75007BF8B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372325, "uuid": "d545bec2-0504-4892-a5e9-ace81c3503ca", "value": "24576:ZbT851LCmluWgvPhlp1FSBMCX3x+CQvrmkbG:Z/XmEHh7ihhcmkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372325, "uuid": "7b3dc8a0-25bc-441e-a89d-1da5c22e1fb1", "value": 813167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372325, "uuid": "769d878a-9d9a-45db-b209-dd4fa1998974", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372325, "uuid": "63724c18-2c06-47a1-ae1b-0e98cc4f8547", "value": "PO_#86637_(2).lzh.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8486c4e-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370545, "uuid": "3ffb110d-05b1-4116-9203-9877d0111f81", "comment": "Malware payload (StrelaStealer)", "value": "65886dacf598d1383b48996111193733", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370545, "uuid": "48c9cc00-f209-4a28-88ef-2125b3b1e0d9", "comment": "Malware payload (StrelaStealer)", "value": "1a0fc3431b63c73e788e5f2f466bbfe4f6942a7c21dbf94cfc6ed1111b779ca1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370545, "uuid": "7c69ba17-e0f6-4e1f-a3de-5703c57d6efe", "comment": "Malware payload (StrelaStealer)", "value": "a6a7020a5ff9939ace13f395e83fb9be2d91ee5f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370545, "uuid": "0470b088-b7a4-4817-bd25-26f4c764c136", "comment": "Malware payload (StrelaStealer)", "value": "4cb7475532611a5970cf0192b2d21fb659766127497f00c14073acd8f77f0ec15975d0d8f1f037d34586dbd0d6cbd4d7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370545, "uuid": "ea1f05b8-d2d7-42d5-b951-8ce84aedb0c4", "value": "T190C424B7B3220A99F45502C9DE34A73D8E38E8410463DBCEFF666F442970FA94897578", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370545, "uuid": "bc139648-ff59-4a38-9a52-ccc75c43f68d", "value": "768:C421tLGIbn21vBkT170Q4OnB0w12AB2w12ISB2n12OOnB0w1rO72ssPvk2rRQTFw:CnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370545, "uuid": "29f78b3b-1823-4e17-b1a7-0abd70c36f4d", "value": 573305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370545, "uuid": "c87e77e2-414a-4709-948d-5253d5826a0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370545, "uuid": "129dcbc8-505d-4f21-97d0-fd849a360aae", "value": "2122325799163701915.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a126d3-5514-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779368390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368390, "uuid": "1e151fbc-f797-432c-b8fb-64c4afc4f9da", "comment": "Malware payload (AgentTesla)", "value": "8a1f33aa27768e0844543e1181efdc58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368390, "uuid": "4ed5e4a7-d6e9-460c-b755-e9adfb1a1d43", "comment": "Malware payload (AgentTesla)", "value": "1a8c75f8a60404d62a001606052cae6ef4766489b9b9f0f03aabc47985c811ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368390, "uuid": "140bb27a-118a-464f-8044-158b1b4f895b", "comment": "Malware payload (AgentTesla)", "value": "d74ab34b6ff03ee6f4421c3310d94aa6555e6afa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368390, "uuid": "57c81960-3a61-4769-993c-2373ae803d83", "comment": "Malware payload (AgentTesla)", "value": "a969101c2158e79871d1f6812457ded4c96e75196b4587b7076ef7a3fc43b2132a1b41587fd9fbe9dfb97cf2868a5ec2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368390, "uuid": "b3afabc8-c42c-466b-81bb-119a7404cd23", "value": "T1C355011189C45FB9CFAC5A1C90FE160E63E0598F506A758AFB3BBC46AFF794812031D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368390, "uuid": "e6ac82b1-22c2-426d-b612-9071d9732d1d", "value": "24576:hwVWa1/m84214qFjaRRU/cmpiDj/8X4MtZlYAtBYx:iVWa1SF0UPtxAjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779368390, "uuid": "43e6b550-33c1-4846-9a3e-efdba25d504d", "value": 1282855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779368390, "uuid": "753f7e4e-8269-432c-9211-0a98a3d0eec9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368390, "uuid": "e09e5a63-8738-4a01-a886-699f54b0fa0b", "value": "2025101600202510.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5bbeb1-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779370548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370548, "uuid": "ec07f255-da91-4f75-872c-bc7141c08303", "comment": "Malware payload (GuLoader)", "value": "c5aaed4f25dba5ce9b9f89dee2e191ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370548, "uuid": "7bac05bd-4687-49c5-8c22-7d3623df8e6d", "comment": "Malware payload (GuLoader)", "value": "1a8e7715578d4922bd335f26eb4dade7d1bc74e1a0f8774ef0269fb55b3964f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370548, "uuid": "3ca9d34c-ffd6-4a7b-939c-39998ef5e7de", "comment": "Malware payload (GuLoader)", "value": "97abbb6191a7f6b310623c4c7acd782629c1186a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370548, "uuid": "2764f357-ae09-4754-b8de-3afb38b70bbf", "comment": "Malware payload (GuLoader)", "value": "5f9d38548c323cea3633ef25b6bfb7e81b141e85190a7dea45ecfff8e1f9131d50ca29d313d503645fbbcc4a446f70c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370548, "uuid": "6a3cdd8b-1073-4d29-82b7-96753cd1f944", "value": "T110F423AD3E82D532E5278E33EE32D96567395B016C021A0B17957F7B0D14EB3462B32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370548, "uuid": "6d2b88ed-6aa1-461f-9dfd-f4ca5a67bf23", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370548, "uuid": "36f7b0de-1c67-4c7a-b43a-716eccc4fea7", "value": "12288:bBLbRRz/zKvlAo3YXGyxExlewhrTcbCrP6MFE4ArCoEzm+WLk2dtfgqKujNHAGgm:ttNKvKXhKxlewB6CAMmtFdtBKujpgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370548, "uuid": "a32ddd8a-d126-440f-be4e-047fb87edc5f", "value": 750543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370548, "uuid": "b116756d-7293-4d91-a49d-2f574a45d9a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370548, "uuid": "ea20a236-f1d6-4502-b8c5-f1c1744ab784", "value": "RFQ-NOV-SUPPLY-JGT-ORDER.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba23ffb4-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779373018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373018, "uuid": "a2b2111b-50d0-477f-acdd-1d512cab6c35", "comment": "Malware payload (RemcosRAT)", "value": "e73f7ff7572070d56a631ac6796adabd", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373018, "uuid": "a130ec00-31b9-4c0a-9c9f-c426a515d3d3", "comment": "Malware payload (RemcosRAT)", "value": "1acfe23aa60f95a6a5ab24d3067c7e63c9e79b6089b49a2b0c7610e5c72d18e5", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373018, "uuid": "9dc1641b-3262-4d80-a417-5295c99a1ebd", "comment": "Malware payload (RemcosRAT)", "value": "38018d65d3f93ab5c049a89e863b1388c898633b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373018, "uuid": "a1c29139-c987-42a7-b33a-5e25449ef087", "comment": "Malware payload (RemcosRAT)", "value": "dddff2452a1450880f2539dbf9c80d3186189869f2648432d82ffcdfed348bc4ac588e976a6148794a8ae66b27a6ea9b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373018, "uuid": "e23fd76c-a174-49e4-bb17-dc3c942df5b3", "value": "T15B31DF0C5ABD0714E2B28F39BDEE16154C367D06ED71CA180164154D10A4A33AB77F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373018, "uuid": "f7207f72-4bb4-44da-a10c-405de74425f2", "value": "24:8lLJ/BqD+fKbiFJSSXilKHLChJxQwNFDfumyr8p4JS2zFVrabqOl:8NxosjSCi60fQADmOWdzFRauO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373018, "uuid": "13b9016d-ba8d-4322-9322-ff2fb8fa9a8f", "value": 1710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373018, "uuid": "34be49c9-8331-41c0-9c6a-673ecdf43c8c", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373018, "uuid": "c5bcb603-cbd2-4a78-a3f0-3c8407397b78", "value": "IMG_20202605345.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc72c7dc-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370552, "uuid": "2e8e9c43-4279-45a1-a4a7-46ac50d521be", "comment": "Malware payload (StrelaStealer)", "value": "8fd01313fef896989444fb75374ba19b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370552, "uuid": "8a0e0679-9343-4fa1-9fe3-be3d03e89f0c", "comment": "Malware payload (StrelaStealer)", "value": "1ad610bdbd856e61e4c35aeb46ef74ddbd56769622e2c74e7d8ee81278e9d97a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370552, "uuid": "9fe31d54-9c64-4d0a-b644-29a97c0156fc", "comment": "Malware payload (StrelaStealer)", "value": "1231872ba2e826818276abd26cc99115950c0a70", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370552, "uuid": "5e4592d3-a84f-4386-9656-5e26d861ca7c", "comment": "Malware payload (StrelaStealer)", "value": "cc35c15c186fae9297db7ec45327205ac7d43fbfb50c04adeff1ed0e78ecf265b4e4d28ccd4b7b411126731a18a6f17e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370552, "uuid": "9bbc4949-1c54-42aa-8edc-47527345de5a", "value": "T1A7651AB484952910D8ACF3EF636D689FCF002D8D21787CD247958487F6146EE3AE7E29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370552, "uuid": "f46de5de-3950-4f02-a0c4-b8dc806fe504", "value": "12288:ulSPkS80P0vcWURFmHotNAXn+lXnK/1Ftg:0yUuCcEtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370552, "uuid": "307e03d9-88b1-426c-9233-1284cab6a1d1", "value": 1421959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370552, "uuid": "2baa2383-2201-408b-8cc3-66cfb964ebfd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370552, "uuid": "824387fd-4e46-418f-a010-f06803313a4c", "value": "731255012095832304.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2295803a-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372334, "uuid": "d90eb0c9-fce3-4463-b2d8-a090801670a1", "comment": "Malware payload (Formbook)", "value": "9ae24f1d34b69078dd1b3bc6512b3d6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372334, "uuid": "96bcc8f9-647e-466c-b426-60f67f51baf2", "comment": "Malware payload (Formbook)", "value": "1ae0a0d2722758dc392f2fda447b617b06f2f9e56b3ce29390aa8fad937ac179", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372334, "uuid": "49f1f8c2-3f58-487f-a4b3-482a52384c0f", "comment": "Malware payload (Formbook)", "value": "0b8eb3c367497d1e925d49e11015c18cb1f631ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372334, "uuid": "bcfff3dd-545d-4496-a223-cb66c6254535", "comment": "Malware payload (Formbook)", "value": "bffa1a8722e4000e0202015b5785af05809f566713cd51e196e8f4bf5decc2b3c978f795d8397e87e79aa6b01dcd5c8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372334, "uuid": "55dc782b-0056-4212-a15a-2578fa2470b2", "value": "T1B8A5CE14E3A801A8E467C738CA659333D6B079525730E58F0A99D6462F73ED2AF7F312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372334, "uuid": "13cf06cf-c27b-4a80-933b-356c3148497f", "value": "5946b66c0c248992121c77a3b48fcbde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372334, "uuid": "db3d967e-fe72-4c33-8795-b6ead4e45d91", "value": "49152:ouAEE6l/kZzz3uBytwA6cYAyhEvFb4W1ed2xW2zrOVGZ:3uzOKDzKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372334, "uuid": "b9e6fdd0-a313-4c18-950f-7033c878e3b9", "value": 2230368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372334, "uuid": "36bcd62e-f46d-4855-9e1e-59f2418479c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372334, "uuid": "fb0568c0-249d-4ed9-86c4-9fc0cfda586a", "value": "Predracun_u_prilogu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55cee57-54ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779351159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351159, "uuid": "fae8d8f0-8b9c-4f25-9428-241fa853f752", "comment": "Malware payload", "value": "b39757f6bb848fb64dda81a61c89b97c", "object_relation": "md5", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351159, "uuid": "9f4e32d4-7134-4ba3-a256-85c86f87cc33", "comment": "Malware payload", "value": "1b10548dcb54914ccaea22ab358776f7164f1d3bceb4f214be99177d9e1ba66c", "object_relation": "sha256", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351159, "uuid": "0fa23b7e-e9d6-4331-990d-c0dda3d8e5ff", "comment": "Malware payload", "value": "c3a63ac5e50d6a13d1671bb32e3ee49d9a4fa380", "object_relation": "sha1", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351159, "uuid": "f7b34a8d-ae9e-4fe4-a42c-049691ae55c4", "comment": "Malware payload", "value": "62a69b6d7283d7e86270f5847137565a481fd5c4185089746b04d381e4349359691e00aa9d67c122d2fa9237c11060ee", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351159, "uuid": "38729c5b-bc2d-41ea-b494-a3874591f8a3", "value": "T180214701FC5AC0B1CD77EB1278AE510D7EA25108A875B012799CDC7C9B54BFDD644046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351159, "uuid": "0a25ce93-b48f-4917-8442-f9da4ed6d572", "value": "24:vpLMLW73rL0kJ8r28IOkZiUaXNf29AJ/Anh2SZzFVeh/WSHv9WKBKpXj01U:vFMi7b98rIOk47sARg2EzO4SHMKIpg1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779351159, "uuid": "2f8502b4-203c-472b-ab0e-0ff19aee278a", "value": 1203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779351159, "uuid": "a348c0c1-55bd-486c-8940-84a0948f042e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351159, "uuid": "6900901a-3c03-4f8a-b10a-5d9a8a4dffbd", "value": "1b10548dcb54914ccaea22ab358776f7164f1d3bceb4f214be99177d9e1ba66c.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb1f285-554f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779393560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779393560, "uuid": "d0eda990-5ae9-42c9-a9d1-a6901ed167f2", "comment": "Malware payload", "value": "39317f0ad4c76e5e7f5f3c25c070b991", "object_relation": "md5", "Tag": [ { "name": "216-126-225-129", "colour": "#E0B864", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779393560, "uuid": "93277c4b-e0d4-4bd4-979d-99e3a11bba2e", "comment": "Malware payload", "value": "1b24c1605a603d58ef7ba11788601d8a28987705791a6502fece8281b039ccbe", "object_relation": "sha256", "Tag": [ { "name": "216-126-225-129", "colour": "#E0B864", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779393560, "uuid": "111389a6-b996-467d-acf9-a010eb5c8bd6", "comment": "Malware payload", "value": "b197df7023aee0e0a7a2ae0267d2300b132754d5", "object_relation": "sha1", "Tag": [ { "name": "216-126-225-129", "colour": "#E0B864", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779393560, "uuid": "6bfbb3a0-c593-49f1-9b3c-64b7cc44a904", "comment": "Malware payload", "value": "2dce6d8e45883eb91c4d9f40819a4c8d18cb72e4220766e051333edb17846302a4d84124a38e298e3710c65d072a894b", "object_relation": "sha3-384", "Tag": [ { "name": "216-126-225-129", "colour": "#E0B864", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779393560, "uuid": "676b5082-7fdd-4038-9de2-bbf999704a5a", "value": "T177717E5BE1B01439C0DC96F9010A06AA4B5974734C05682EBE797D859F83606C8D7EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779393560, "uuid": "77cc610e-2092-481e-93e6-1cfcbabe5ad9", "value": "96:ar799y/Vc+LqYGJnnPfDrpEeGVIYl5AEmkV:ar7jIWYG1nP3pEJnl5A2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779393560, "uuid": "89319689-31a1-41ed-95fd-2242c849373b", "value": 3678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779393560, "uuid": "09a4ba57-1d11-447f-b8ab-1ea3065e4d5f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779393560, "uuid": "5595b7d7-017d-4eb0-a567-3233af0ba836", "value": "0fc7aba0497bf6b84fe63cf433f17341fc3629fd76c192108dabfd5b54008b6d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b47b5a0-54c9-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779335787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779335787, "uuid": "09f8c681-7b77-47f7-8f9c-8ad48c5f3269", "comment": "Malware payload (CoinMiner)", "value": "50dbc09e9a84488f21cba391023c042c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779335787, "uuid": "aa57132e-c446-4d36-980d-e9a86098b06a", "comment": "Malware payload (CoinMiner)", "value": "1b747725923a714767cf75dc2a95d526381e23507304928d9a0aed1dface93ba", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779335787, "uuid": "9f50ae91-c38e-48fb-b62c-b6998a01a00c", "comment": "Malware payload (CoinMiner)", "value": "df0a0cd9851c434bf87660b14a5a9fa02178e9c6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779335787, "uuid": "de57a81b-814f-467c-85f9-8721db5c7a7b", "comment": "Malware payload (CoinMiner)", "value": "4919c8c5ebe9d425e19640c586bba45d2d2a90c1fc006451a61883d3639bc29a2e10cd0bf3c031ae714a99ac8bbbdf9c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779335787, "uuid": "e130a99d-ba8e-44a6-a9c3-45181da93548", "value": "T16432E829BE810331E3A049B854794347957D2663E793E3EFF337A59E49A63488C41E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779335787, "uuid": "08868a68-9104-4deb-911d-3423204e1f02", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779335787, "uuid": "817f89d6-2b8f-40d2-b8ba-207d65b7021c", "value": "192:qIcofWXvy8BqOx+eEP9PFJxTEZmFhS+cHf:q3o2vyfOwLPFwZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779335787, "uuid": "e70683df-dec9-4872-81bc-6f69a20469bf", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779335787, "uuid": "82668c4f-0a8e-4bb1-96e0-503f148bb924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779335787, "uuid": "3d1c701b-e5bc-416c-986a-08719e152fd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe825a2f-5519-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1779370555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370555, "uuid": "e501ad47-dfbe-4474-bf60-123bc5750735", "comment": "Malware payload (RedLineStealer)", "value": "a74df657ca32438ddf0a45c10146653a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370555, "uuid": "2d4ca874-a2be-4dc0-8979-008da53806c9", "comment": "Malware payload (RedLineStealer)", "value": "1bccc89adf399b803740cfa06cc84c94720a1530e4c792bacdc796fec8fa99a8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370555, "uuid": "28d1f1d5-bef2-49e2-8010-28fc73382a15", "comment": "Malware payload (RedLineStealer)", "value": "05e8cb169e68db9dde1406228f68877e78eac2ac", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370555, "uuid": "03892e85-13d3-434d-a110-6100df897bb4", "comment": "Malware payload (RedLineStealer)", "value": "c6a10950390b435f6e133d6b00285287abd21604af7c35232c955d6330508dd2772e63036bde7b7e07afeb2a4e3f591d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370555, "uuid": "8eb0b14d-127b-4337-88e5-35fa2bf05278", "value": "T19B25332D846C92E50EAF2717CAF81391BF729421AD3849342F2D17DABF46D9CC24B24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370555, "uuid": "8dc1644e-057a-42f6-8704-b65fafec3579", "value": "24576:IdB8Vo4Qlsb9u9o27RNkzCQDEqK8cJRccmqyDlIu:0wQlsxru0CQDEfsC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370555, "uuid": "2f5dc475-25a1-4ca2-b060-cc4c3cd96b38", "value": 985640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370555, "uuid": "b5b250bb-6d70-4429-8b29-c0972697caab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370555, "uuid": "1bf30e38-5c07-4d4e-a00b-73a83a45416d", "value": "DRAFT_BL_&_MBL_PO_NO_ECM1D2403-29.TBZ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260e81ab-551e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372340, "uuid": "b0f25c1f-c6a6-49e1-9fc7-ff4b20164971", "comment": "Malware payload", "value": "b8d0a192337e21e06aabaed7e5eae0a3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372340, "uuid": "f86ea223-758b-425d-8ed6-2d95ab0ce2ab", "comment": "Malware payload", "value": "1bedfea95999dac93a343d8779b6d1ec4227993cb3129b2bf9225094e32b736e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372340, "uuid": "7c241e10-0fac-443d-b6ad-484c81281dd7", "comment": "Malware payload", "value": "3602d42f6b6b24c1554d71aee76dc326ba364d99", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372340, "uuid": "8890498e-55ab-4552-91db-24d26011b9ce", "comment": "Malware payload", "value": "ee91cee4a979f4f0e28077b60341288f519398cc8dc08ff108aafb52abda2ccfe6b562ae74d5a780fecccc6215f795e1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372340, "uuid": "ff48712f-97ab-4acb-a084-3354b6fe690f", "value": "T12E010277A1156660CC4DF2F462DAA771CAB5B8364622738693C04872BC0EAC07FD4DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372340, "uuid": "2436d5db-45a0-4bc2-9198-a1713873a138", "value": "12:5jL4Fx5S9rh4IPSRa+X1WRVCPz+TLgjzy8C3uzaqAz4FF5S9DYs7ta2:9UTM9qMbmMCP2sJhfM9Dbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372340, "uuid": "62b05eea-0a9a-4590-89d6-2555064eccd0", "value": 658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372340, "uuid": "f49bf138-068f-42c1-8843-eea9f37df57d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372340, "uuid": "8d952068-9d8c-4492-b39b-028f0a9bfb64", "value": "Ihre_-_Rechnung_VI2407464.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2827ad1f-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372343, "uuid": "d1ff5fc6-e1a4-49b5-89a3-c7618f28c5d2", "comment": "Malware payload (AgentTesla)", "value": "c0dd517a84f4dc86d1d78cf6194406f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372343, "uuid": "57ce089b-55d5-431f-8384-1b9d5a548752", "comment": "Malware payload (AgentTesla)", "value": "1c0a4a88079a54e4aa957119223d87768ad2a7260be1a9078852a4eba16ea0b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372343, "uuid": "992514f2-17e3-41b5-9080-7256a12c9e6b", "comment": "Malware payload (AgentTesla)", "value": "1e4310b240eab5a32afbbc33b2d421cd66f1457b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372343, "uuid": "0247e6da-03e3-40d4-b56b-5573c950aa9f", "comment": "Malware payload (AgentTesla)", "value": "c73aca7e47cf05254fd4bba78991851b275e6de81f23b8439fb6954507e2ab9fa3efe2a933f7b27157fd39db8173402b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372343, "uuid": "c5c73544-def3-4c08-9aba-0440fc04cd98", "value": "T1DB453323EA7CF85977D7082B31F9149A1F5B78E74BE3140B5365AB08435C08A9B38BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372343, "uuid": "51175240-3972-42a0-86a3-fb1cb9cc22b9", "value": "24576:LakTx1pyj/e9qbc2FdsLe1mS3gv6iimPaDmobtFts+miecKeTshBBXcZ+NF:LFi/i6wYmS3kyR5Fts+1KekKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372343, "uuid": "12d17b00-e77a-4b78-a894-e7a6662d228f", "value": 1216940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372343, "uuid": "c0ba2475-d06a-4d09-b75c-2f94f7852417", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372343, "uuid": "c7fd83af-1a69-45af-9c32-723e83ed57e5", "value": "FerrecsaXD701163.pdf.uu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00997015-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370559, "uuid": "77a645ea-c6ed-47b5-8656-bded190f18bf", "comment": "Malware payload (StrelaStealer)", "value": "fe5288adab36c798fcf973261613418e", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370559, "uuid": "053a7464-8cd3-45cd-811d-cda367d20086", "comment": "Malware payload (StrelaStealer)", "value": "1c4dd3ddb60f2f3f15ed01a97a539d6f67acbeb8c5ed7d563fbff4f65c636ec7", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370559, "uuid": "68b5c911-022c-43f2-81a3-0949303a3eab", "comment": "Malware payload (StrelaStealer)", "value": "3071952ef9602bbfd1cb28cd57ebc0b6308c0227", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370559, "uuid": "077e911e-cfe2-4df8-8fd8-541d2a47c300", "comment": "Malware payload (StrelaStealer)", "value": "d205d7c8ab243c59fa198356f780a8dbd967d6679567fb671b7a08efdba682644fcfdecb98b8f9c575d6c49263ab47e4", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370559, "uuid": "52af8260-7e54-49bc-b983-5964251271bb", "value": "T18C715BE68A08DF11F92548372B2E4F0ECD400C2AB0D5B186D27F4A7A6C63D1E3255B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370559, "uuid": "405a0451-96a0-4b45-9c6a-55308b994266", "value": "96:j7pbyPvnCM+qMHoAI+9yAFlDxh9RNF7u2z3hN7SwUvbOC:j7RqCM+qBAR9yA9Vz3hNOwUTOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370559, "uuid": "be41e09f-eae8-4c4f-9b3e-79574bbede35", "value": 3517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370559, "uuid": "316cb07c-b185-46b9-b330-dc992c17fc5a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370559, "uuid": "c9b5d51f-e427-4ca8-bcbb-fcd9181ce2ca", "value": "Rechnung135.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a35a706-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372347, "uuid": "51ccfdb2-ff3e-439d-848d-5c00f25ba4c1", "comment": "Malware payload (AgentTesla)", "value": "45f3eaeabe1f7487bc46dba6f56558d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372347, "uuid": "d3ab72ab-2cb6-46d1-9efa-bd73f1a82d48", "comment": "Malware payload (AgentTesla)", "value": "1c7ebd6287282be19177f3b46a8b5307ae3233f00c2cdc9aeecbd05b1dc588c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372347, "uuid": "9e55d496-96db-488e-a0e0-6add0bd9e088", "comment": "Malware payload (AgentTesla)", "value": "cd5f3a327072ff0eb06f0ebbfa00ae30b90ccfc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372347, "uuid": "56fb31da-9f06-4267-9074-83362636e97b", "comment": "Malware payload (AgentTesla)", "value": "10409073243e3c92f87ca3e89d3d7fa5317bd5067fbd8a7d40eaeeffd56eaee5b3248ec8f816dee934391caba104a50f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372347, "uuid": "215ccbf1-0df8-48b7-95ab-984a4b215f3a", "value": "T107E4126D62989B37DA1E477E85A124290374D0066363F758AFEDB0B51DA3BC00C64BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372347, "uuid": "2e6cea72-0c80-4b68-8305-0ddec0e5f206", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372347, "uuid": "c32a7230-322e-4494-a611-ce10f686358d", "value": "12288:9dhwoIc0vIqSuYR6+epI2QUebuOiqPZ0aSguU6OkjeqPBS12MhU4sKcKOLXf7BYp:9vwoIc0vIu5+fdXuV2Z0oL1kRPgTOtKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372347, "uuid": "539500ba-5924-4d29-a304-242dec33a35b", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372347, "uuid": "f6860f4d-840b-4e1f-be18-f0a03aaf979c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372347, "uuid": "052aad67-b5b3-46d1-bff0-dc52deb4dcb2", "value": "2024-0443_Scan_20240206_091510.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4f50f8-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1779372350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372350, "uuid": "67f19c8f-ae90-4b61-9b6b-1826a7ee8566", "comment": "Malware payload (DarkCloud)", "value": "8a971c5dae05348e12a865349cb8a409", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372350, "uuid": "abf053ab-9c10-4c16-812a-1161790d39c1", "comment": "Malware payload (DarkCloud)", "value": "1c7f776c0df1271f760c2fe07363bc32659dc2e9991fc1cf41f695ed7a4f3851", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372350, "uuid": "58ea3a05-8c54-4075-b678-82d093d4c510", "comment": "Malware payload (DarkCloud)", "value": "ee7cbfeb945691f888656be498e462e13360c95c", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372350, "uuid": "1623a42c-21cd-42ed-b6db-144a77051615", "comment": "Malware payload (DarkCloud)", "value": "1ba30a2260c11cbf016ffbac6c6d7e2b0dbe7978a271c91601c58b53a7a812d4a48b0ee7cbf869cf35f5f3a824f8a375", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372350, "uuid": "c884aeff-e0e3-46b6-bbf2-5e19526fa452", "value": "T1C5451285EBE289D3C80C3B78E1632B445B21CC17B85767C7356C321D6F663D6AE2A907", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372350, "uuid": "13abdc10-b016-4d06-9e01-6637b18600c0", "value": "12288:ydnDHMfQk+Nq0QPOfm8o3Iyu7ugeTIPG:ydsmq9PIDo3Iyrg+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372350, "uuid": "671ae195-9bfa-44ca-ad21-3d12d122201a", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372350, "uuid": "9ef4f1d0-3ade-499e-9dd5-37018136fb09", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372350, "uuid": "e3f68625-5448-4347-ac7a-3a2873b3f13f", "value": "product_List.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f091aed-5513-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779367738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367738, "uuid": "bdce8be1-acd9-4d6d-907c-dc5e27ccafcf", "comment": "Malware payload (Mirai)", "value": "0ca9bf82ff3627b11f8645ecb44aab62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367738, "uuid": "87f61144-7888-40c4-b48d-5c47648adfc3", "comment": "Malware payload (Mirai)", "value": "1c88c780a1b7689c33073c9a2297264e2edf4b97e05dbc871627e191f682e168", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367738, "uuid": "033c02d8-243c-4386-b905-cd6c35ee93e4", "comment": "Malware payload (Mirai)", "value": "b27986644326b1051ddd497a6115266872bd4568", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367738, "uuid": "d10f3fcc-402a-45ab-acef-52928dcb9c6c", "comment": "Malware payload (Mirai)", "value": "d53d71a7b7e6f260e36de21ee1d8b1dad4ae95c79e83c375e4f4aa4d74d6c2e3dbe5654a42a26cd0bd41b033e3e9108a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367738, "uuid": "1a459e7e-b567-4a4d-80d7-0abef90f6d5e", "value": "T183A2C07017897DB5DBD08476FE7C838733674BFC92F7321521005728A169396EAF960A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367738, "uuid": "d07577a2-a199-4e0b-96bb-4a98e4da4fac", "value": "384:Uuv4xDhnk7j+BjVQqhBWcRiHNGa81v1Gj89bAchymdGUop5hte:UuvMnWGjmqhBWcR8UvN9b9s3UozLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367738, "uuid": "868df653-6d6e-43c2-b335-2ddfe6dfece3", "value": 21980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367738, "uuid": "c7af383a-d865-454d-aa71-40ecfed8af8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367738, "uuid": "db9c43d7-1638-4bd7-bd74-82ed18724415", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0476a2e3-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370565, "uuid": "98bd727d-1689-48f3-9b72-64ed396bfadd", "comment": "Malware payload (StrelaStealer)", "value": "5cc79da29c98a4d1f558242df5497037", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370565, "uuid": "22ca25c2-b548-433c-904e-ea76e213b0af", "comment": "Malware payload (StrelaStealer)", "value": "1ce041dc9a63613c24e20a52b97ce738b23250635c3a187f1009ebf66a9278cd", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370565, "uuid": "552c0510-7caa-46fa-abe2-cdbbe6fb6d35", "comment": "Malware payload (StrelaStealer)", "value": "ed05b0eb953b9d50951ad813ea25c63682b1d18c", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370565, "uuid": "803b0322-cebc-4131-92ae-f2c7e08469e7", "comment": "Malware payload (StrelaStealer)", "value": "0a52e223525d25a02b7f26abc1c9563e122d141416772a2468952f35a25ab58d4da905d445acc8c59ade42159142951f", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370565, "uuid": "381c2937-1981-4049-bb31-ca6c7ed54ca5", "value": "T1066423493DB18EE5C1EA38B6B5D49B48872C4DD21DF93061AB2D35D347F299C2BC182B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370565, "uuid": "afc0c5b7-9f7e-4915-a328-16046552ca23", "value": "6144:gWNuYX0Y48CsOpoBjq2d0jLCUMP0YziFOzQ3F1PAXOpB6BSj5HRdK8yb:g0kYHCsoodSL9MP0K9SYXOUIX/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370565, "uuid": "66c5abf6-0bcb-43d3-9c57-57a0cb770f48", "value": 309031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370565, "uuid": "f05cf8e6-b1fb-46b3-8c29-aa774ea1c064", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370565, "uuid": "2213af3f-51d5-4a9e-8fc3-131cc8c3dd35", "value": "Rechnung_3422343.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00368645-5552-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779394610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779394610, "uuid": "a738b2a9-e831-41fe-855a-3f73b778f0cc", "comment": "Malware payload (Mirai)", "value": "a582cd7553c93b8acddd7a4610a5cadb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779394610, "uuid": "22e253d0-4420-4e2e-ae30-278b09caa68b", "comment": "Malware payload (Mirai)", "value": "1cf11039631b39d06400215e206a2d3d1f02d72a074914c785b923089772cf1c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779394610, "uuid": "7c4290f1-7e51-4b19-9ec4-f80d9a191667", "comment": "Malware payload (Mirai)", "value": "f33d88e5b4c7ddae48481ac682ad74819a62f102", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779394610, "uuid": "2a617452-e262-4baa-aa1e-0053322db623", "comment": "Malware payload (Mirai)", "value": "0a4b7590459a1410bf1a2bafecc458ed0ebe7fe437c6297e6dccd3da97eead9ecf329f286c95a21399b04f520985b889", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779394610, "uuid": "ebcd5fb5-4eed-41e5-a25c-ac3849292546", "value": "T1DB5191C723B159312EA7BA23FDBD8E0C31C0509AADF1BF0856DD34A57A9CD89B044A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779394610, "uuid": "104ac793-afc7-4e46-a14a-1bb42b5b4dab", "value": "48:i5VgVhml5VyVnEl5VhVCXl5VFVePl5VaWVazvZl5VacVaFvjl5V9NUV9z4gel5VH:i5C3ml5YJEl5rYXl5jAPl5EWEzvZl5El", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779394610, "uuid": "b8414add-59e0-43fa-b493-d2b2698ad022", "value": 2989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779394610, "uuid": "74c42272-be70-4269-a747-fd9e714c6ef4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779394610, "uuid": "94d88126-fead-41f2-8611-2dd7d6963b00", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01fe724-5525-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779375658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779375658, "uuid": "3e47a5ec-1b96-4cb0-863d-13a18acd2856", "comment": "Malware payload (AgentTesla)", "value": "a6fe039b25916f06936088242a64e838", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779375658, "uuid": "912b161e-7be2-4d65-b06b-03745fcbe3c4", "comment": "Malware payload (AgentTesla)", "value": "1d0834e7d4fe46aa143359a35c69bebc449fc1b1799af77eb96a4cbe320b6884", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779375658, "uuid": "0fd2fbee-0633-4d49-af1c-0e81f24ac6ae", "comment": "Malware payload (AgentTesla)", "value": "b721a350b5310158fc8d7084469bb915e1a4a394", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779375658, "uuid": "8ad18298-50a1-43e2-8e30-7b5a8e6f736e", "comment": "Malware payload (AgentTesla)", "value": "382eb63c552ea5b320693dacdc5acb0969b9c7709bbb3459a1855262a27a948d92b5f350c41d09764ef0afa2e103670d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779375658, "uuid": "369d1c43-378f-4c48-b2d4-0eeacc0ba8f1", "value": "T1D435AD0273D2C036FFABA2739B6AF24556BC79254123852F13981D79BD701B2263E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779375658, "uuid": "fc5f65fc-c6fe-43f7-92f1-6dae69e1ca6a", "value": "649f6ed9a4d576c154bbc0357156a4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779375658, "uuid": "485fec21-e4f4-475e-83a2-59882a93b47f", "value": "24576:PAHnh+eWsN3skA4RV1Hom2KXMmHawHfqUZDmRx9W4NKB5:yh+ZkldoPK8YawpZWH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779375658, "uuid": "aff4600c-5b9e-4fce-8e6f-2866c110546d", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779375658, "uuid": "d8035e65-ec7d-4b3e-b6ff-88884787c904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779375658, "uuid": "38ab2902-531c-4096-af51-ae24c793e577", "value": "\u039b\u0395\u0399\u03a0\u0395\u0399 \u03a4\u0399\u039c\u039f\u039b\u039f\u0393\u0399\u039f.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5ed93a-551e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372354, "uuid": "3abd5146-af98-44fa-81b7-2762b4b1c22a", "comment": "Malware payload", "value": "096dde717f576968fd32cf6318e2602d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372354, "uuid": "ad1daecc-f8b2-4549-930a-9e4fb546dd3e", "comment": "Malware payload", "value": "1d24df4e98c1150422c8019c7b50d33a9b9badd55824dc1d3393f367072b0156", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372354, "uuid": "7ae8a2a2-01d8-401c-9a5f-1830d548e63a", "comment": "Malware payload", "value": "95a61791706b882b14b4b15c5682e6ba2bd0e813", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372354, "uuid": "a83e7434-4fba-4e53-9510-f503be4570dd", "comment": "Malware payload", "value": "686088e44b0a881b650ed0289d7341bda48adf0279109ab3a3da143ca74c315c42f067f815f36dec2c9bc22209420e59", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372354, "uuid": "7b7ac8c5-dfba-4797-ad73-0eb6a62ebfb3", "value": "T111C4237778EB4B256BD5DA98EEA94FDC8F04BB224482CDC0E5D62FCC4B10542187DB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372354, "uuid": "47ea4ccd-1abf-4142-b93b-703c9929c6f9", "value": "12288:dMZwPJWyetE3UcyXEaXMK/sYMyRVwT37uQDgR9FCGix:SwhIt+BAM/YMyr8yQMR9F+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372354, "uuid": "8901427e-c213-4b28-88c2-07de7eee67ce", "value": 547684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372354, "uuid": "574629b5-b43a-4054-92a2-d29f19614dfb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372354, "uuid": "ac7109c0-5f69-4448-b1ce-ed9806182c65", "value": "Product_samples_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30797bfa-551e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372357, "uuid": "dd23758b-17ff-4739-a334-7afe45527c7d", "comment": "Malware payload", "value": "245feb7c260d5e40b94ac13837145571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372357, "uuid": "f7b6c4ef-89db-4b47-b92b-fd6866ba2241", "comment": "Malware payload", "value": "1d252d5278c9841158e73d8225dabddc1e37f0e1e6afd271b0f5232be407617b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372357, "uuid": "5d50e215-718b-4670-8493-b7521ebc4ab0", "comment": "Malware payload", "value": "45df6c6021715cd9ebec9ee0d45f880f67587edb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372357, "uuid": "442324d2-a94a-43f8-b654-d7bc788a91c1", "comment": "Malware payload", "value": "40784a97f55037adc488e328666c2c9068a8b5266ba7ddf6593ac6524e612089b4124f8bd1325f5d529ec4b3f9439959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372357, "uuid": "214d1fee-7821-480e-b1ea-a7d69079d0f3", "value": "T1BCF401A52BE4CE19C2AA03355032E33ADA705D9BA139C263FFDD7C877F1AB101527616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372357, "uuid": "54e455e0-6d74-4440-9917-5a5787a33415", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372357, "uuid": "42c7bf8d-253c-4ac2-9c02-d542e7bfaadb", "value": "12288:FqVPiZ6Lgwvi0/WIMiX+Ut8RgzToUlPPB1exkrgxxy/T2kR:90/WiX+DgTJeOgvy/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372357, "uuid": "186bc1d6-0e6f-44da-ba91-7d473a6a948f", "value": 745992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372357, "uuid": "fb9aa620-5532-4c52-b11c-eff16ecb8958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372357, "uuid": "89fcbc2e-35f0-4d6b-a4c4-e001232c2cfa", "value": "PURCHASE_ORDER-6350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afac799e-54e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779349378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349378, "uuid": "39a17767-96c7-4bcc-9519-4fd072872201", "comment": "Malware payload", "value": "2b431acb24b2275c34fd3bf7a14ce067", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349378, "uuid": "fc79a389-2c85-4497-bd55-cbbf3653b0a8", "comment": "Malware payload", "value": "1da32a2d7adcb23e676450dacc50b1e16389aa626b88405f5c69655711823802", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349378, "uuid": "51a40b6a-29f1-440f-bc1a-93f6026793f2", "comment": "Malware payload", "value": "5efadef6bcda4e1686841567743e09b2319c627f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349378, "uuid": "3ad3133d-3125-4d98-b939-e42df5c487eb", "comment": "Malware payload", "value": "6b4cb586530e1adbc509f467010ae7814e21f5ae80b6575530b37f22a59f192d9b593d03719bf19254d3e5e84d19c5de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349378, "uuid": "b950efc5-48a0-49e9-ae06-7c5ad3d3ff2f", "value": "T1CA536B4EBBC55325E3EF8339A8724A064231E0175E03E75E58D9616E0F72BC8875DBE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349378, "uuid": "05127fdc-26db-4678-a505-a9aad59a010e", "value": "768:QYylRznJP0BZPyUta07Hf65KGgHm4iFcSGmw3B4cef2vbnZLhdlrGiWqFDcg20k2:AF4yUt72Qm4ocnn3BbdbJHpGfqJqFzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779349378, "uuid": "331e909a-df67-4c42-baf7-90b26784f7f3", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779349378, "uuid": "c46c722b-b766-4c1b-b1d9-6d2315f9dd77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349378, "uuid": "b55e20a9-1388-4fb5-8011-d65c2c409d6c", "value": "2b431acb24b2275c34fd3bf7a14ce067.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34050288-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372363, "uuid": "8341af7a-1087-46be-ba14-f74edd347b94", "comment": "Malware payload (StrelaStealer)", "value": "325384f0ceccecb9a904f02dd00157fb", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372363, "uuid": "1c6eff44-eec0-4f47-a82f-799c9e05c969", "comment": "Malware payload (StrelaStealer)", "value": "1dcc02e9daf57369c9e0aa2a09dbc8e5ea25f518b163458fc25614f591a799fa", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372363, "uuid": "837fbc54-5240-490d-bdec-753673f670cf", "comment": "Malware payload (StrelaStealer)", "value": "72fc0143f38e929cc0618abdf6a653f4f3bb6c6d", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372363, "uuid": "52aa9f82-2695-422a-99f0-fd8c7d618ba2", "comment": "Malware payload (StrelaStealer)", "value": "d04bc7d176a7be6210af0eda7e8c1bc4c764be8d30d5aca2dba71e8ee302f8d11f7e9d1e6fcd306516c8a8c0e1ae8629", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372363, "uuid": "09d396dc-7b03-4000-82aa-c654b2843ef0", "value": "T19BE19D2D6844AED8D4822FE477972E5BAC37B22C4481EE9EDAD5C8411C6E5326D8C607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372363, "uuid": "6eb96275-397f-4229-89b4-c5344d4de0b3", "value": "192:OcDeImP5ah07txaKR5rrz+IXrq94p8PFzq34aRk2GcX:K5ahYtxaorrz+IX+bdzqk2G6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372363, "uuid": "c3553e86-5cf3-4eb3-ad4c-839b29db9a04", "value": 6998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372363, "uuid": "34dc9ff0-d7e5-4405-a13c-16afba0672a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372363, "uuid": "a28d50d1-0ca7-43cf-8b2d-b9ba46ea4f34", "value": "2407200618.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a34648-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370569, "uuid": "e904f300-1d0b-4e1b-b30e-782fd3576842", "comment": "Malware payload (StrelaStealer)", "value": "a1378fd71d11018d1fa05f50c2e5054f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370569, "uuid": "87bcbcef-0e1e-47ae-adc5-57cbff000f88", "comment": "Malware payload (StrelaStealer)", "value": "1dd0afa6b3f23b73942b3207dc057a4ceaf870aa6dac1abcb641aaa4c312c6fb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370569, "uuid": "01c0b25a-a57f-4bd6-a13b-4a92230c13aa", "comment": "Malware payload (StrelaStealer)", "value": "1e12f006feecc271f43d807af63d95af2427f3a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370569, "uuid": "b5a34c75-2288-4a97-9748-6d656917fb46", "comment": "Malware payload (StrelaStealer)", "value": "a6cc284cb866e4410f637f3eda0b312b3ddf8c3d4c8a7fd5aae5512e1ae1904884bfa62554f556ac4f19f3d9dd177727", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370569, "uuid": "ca4fd037-b962-460a-96ac-25266e6e2ae3", "value": "T18F55BFC7F142217EBE2BBC8D05DEAD7649240E6B3A368C611A9F0646C1487DF1786E1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370569, "uuid": "b1a026fa-8f05-4c8a-9bef-b2496b3db4de", "value": "12288:9rNPkP4P81frOFwt0wfH9CfVK5YkZtEQ1VTTTFSEEQ1VTTTF7Vq:NNK4P81DqwKyH9IMYItEQl3EQlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370569, "uuid": "cdce6796-1ddb-406d-ad8f-a9522dae85a5", "value": 1287036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370569, "uuid": "665cce1d-9181-48ba-b69c-8f9429150ba5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370569, "uuid": "28cf023f-18e1-44de-9381-ee5e5a2000f2", "value": "28374287001761930533.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3617cb3a-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372367, "uuid": "d709672f-348b-49af-b83c-28d94f86462e", "comment": "Malware payload (AgentTesla)", "value": "0493be47f2a67bc592cc444528f907d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372367, "uuid": "efcf7b7d-3fe3-4ae9-9f5c-a19de4b12d21", "comment": "Malware payload (AgentTesla)", "value": "1dd92c0a2d51b4de0f7c2e5f974ee7c606a465a65c826d0de98234bad40e2661", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372367, "uuid": "ebdd45bb-7751-42b4-9354-5dd1db839c42", "comment": "Malware payload (AgentTesla)", "value": "f5396d3c88ba7244f688e901edd234352129024a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372367, "uuid": "adac2788-7b05-4913-8267-670f13b285f8", "comment": "Malware payload (AgentTesla)", "value": "bb342490f898d590ddd08181ebd70858155910ec731548962c1c329047ccec707478dd8a7571074e59a24431f7d869ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372367, "uuid": "5ec9b96d-728c-474d-ae82-2b9c493a60bc", "value": "T110E42339EBC4798627342F9AE0511712DC07CC135E76DE2D82832C729BDCD657A26EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372367, "uuid": "b8574dfb-e4ae-4cad-a2e3-13742a50ea8d", "value": "12288:vND+k1NSWW35HneuvoNoCyb6T3YJg4UUTry2KVwTjt5gpIBpOXyKn26:5+lCIJNx0ut5gpEo26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372367, "uuid": "e7e9f022-56d6-476c-ba41-a575a7037ff4", "value": 666448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372367, "uuid": "786ed50f-da6f-4459-8b15-929eef5ecb64", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372367, "uuid": "cf57cda7-5c3c-4ec4-b96c-9b1b6b5747c7", "value": "Quotation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d755ef-551c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779371668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371668, "uuid": "e616639e-6862-4049-9a61-b5a7fc87d285", "comment": "Malware payload (AgentTesla)", "value": "38a4cad18a57fed67fd7b6c08b3e1fe8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371668, "uuid": "a30d4544-c3f8-4bf8-bee0-209ccf988ef8", "comment": "Malware payload (AgentTesla)", "value": "1df1306d0ea0e24a25b06b0cb18bfff56aafd7566370355b8f846e8a1f56051f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371668, "uuid": "527ede1e-82e7-4712-92c0-398e2ab85cbd", "comment": "Malware payload (AgentTesla)", "value": "a9864ef42369fbd5130c5da5233800729e244d67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371668, "uuid": "022203ba-4233-4cf8-b9b2-9acf1486aca3", "comment": "Malware payload (AgentTesla)", "value": "0e29e08ce065473d3620b16d216a9bf2cab3847a77a634604f617e54249b1c2df6035df2af0486c813940231aad8910b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371668, "uuid": "339b95d2-0c4b-4249-8efa-1dbcf703d43a", "value": "T136F423A3B829C17118203AB62E4E4F077A7A5D1EC41AF8FD798E50CE5FD72B58D94122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371668, "uuid": "4178d31c-640a-48c9-b4be-7dc6f7b9f993", "value": "12288:KeO5KJ5Yp/k5+B+X6wPGVzKBWzzOdbIvjk9JwlJrUpj3QyPeTe8rcBjSQaLGymU:wI3Yq0B+X656W+dbI4zj3Q8Em2QcKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371668, "uuid": "985b6093-da58-4c3a-8c21-8bb28427d0e0", "value": 747139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371668, "uuid": "9ea09330-78e2-4286-a304-8d552bf2e0cb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371668, "uuid": "b0ab0454-3a70-44ca-8eb1-c88c9f44017e", "value": "vessel's_main_particulars.uue.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa750e9e-555f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779400479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400479, "uuid": "2c0efd5b-585f-46cf-ad83-41d98c1e83ca", "comment": "Malware payload", "value": "7dbfea6fe66095f7826139b9685da666", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400479, "uuid": "ae8ad2fd-38bd-49ac-9656-f4c749461af2", "comment": "Malware payload", "value": "1e0ec7aca924733294c1ea694d745fafc4313e4e85119dccdd32dcd4f8b6960f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400479, "uuid": "98626382-bf3f-40a9-a114-8e85dcebcff4", "comment": "Malware payload", "value": "3c0c910661676ba64b77f7aff39be47968bc81b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400479, "uuid": "d5ddf27f-d7d3-4922-a9aa-578350357b80", "comment": "Malware payload", "value": "124b7ea69e0b7ccf14af9d33c764e804c908ba55158e2a8999990999d27b959b67035d52408e125e5a9a775b57371e1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400479, "uuid": "f267a4f6-12c8-47b1-9f7c-e3576cf1e863", "value": "T1BD25E00177054E93C4E33D70317F2219EB9F0E8B4A59A01E292FE72E5172935668DBEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400479, "uuid": "53f7864d-b394-476e-a3cc-f93de5aba376", "value": "24576:SCX8A3W3Ky9zjLMzMtqq8dpDKuFgLNHctiww+ZblSKO3rRp:SG8konLMzGaKu6L8rw+ZblrO3dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779400479, "uuid": "784413b7-e686-4ade-8c1a-7d06bb8d9a98", "value": 1012643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779400479, "uuid": "672e7a64-0922-412b-b4a8-33d1dab7d75a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400479, "uuid": "d8d30a17-fd0b-429f-9da8-fb196c482be2", "value": "tpprwsu.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6a962c-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370575, "uuid": "84c975b4-3176-4765-b583-817632e8f304", "comment": "Malware payload (StrelaStealer)", "value": "b96aaa229c8ed14bae68ba2ad5f6cec0", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370575, "uuid": "4091c413-193e-4807-90e4-3927e41e95c8", "comment": "Malware payload (StrelaStealer)", "value": "1e38cac12ebeb4fb81fee1fb4be1c0e73034e50b8278c75a5f5b2e50135fedc0", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370575, "uuid": "598dc4cc-91ce-4440-9611-718d9f424b39", "comment": "Malware payload (StrelaStealer)", "value": "3fc7099b3a95f40befa931424025c1dd0a3fd3da", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370575, "uuid": "fb74a36c-4996-4b26-b839-1a9efdd6cf17", "comment": "Malware payload (StrelaStealer)", "value": "0e9380987107fa327ffdf0d7391496dbd3b11184bab3b463348b9c5d0e2691b2de36305f51030124a9fcd614198f7242", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370575, "uuid": "44f61e77-3521-4c07-903b-884f8f5278b3", "value": "T19A6423E1B87C3ACE8E2BE72577211134E7AC5205322D8A0B65FCEFC1B4E35606D95AC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370575, "uuid": "389fa77b-88f9-4c9d-aa8a-9428726e9f6c", "value": "6144:EtUuYIADtG7ZMZLHnI3lsQGhmvF6VU+Z7vxDGobLOwG2zpCnpo8pkJJR6h9x:ePXADpZLylsQGhmtUUqVGoW9218pIJG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370575, "uuid": "f7b87deb-8877-4685-9356-02d0a0d6841b", "value": 330248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370575, "uuid": "bf13e637-fcd9-4691-aa02-ba6fa0c4e729", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370575, "uuid": "a0bb7935-8d10-428e-a04b-b5025650c197", "value": "Rechnung_5941839__255558.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381d56bb-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372370, "uuid": "17b2a930-1d78-40f8-a70c-c267f56669bb", "comment": "Malware payload (Formbook)", "value": "04b9e29546b1f4d7f73d4032b22fa1fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372370, "uuid": "652619e8-81bd-4960-9f47-b2cd7038d48e", "comment": "Malware payload (Formbook)", "value": "1e5bcefeb25537b33aa42e005a5fa97a0293d8f2c5e94dd6f4bc8ae2288736a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372370, "uuid": "8f15f59f-6be6-481c-b2a6-c3e3967dff5d", "comment": "Malware payload (Formbook)", "value": "53bcc2f8c5dffe685f94661644fdfe0aa10ec047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372370, "uuid": "2afe7c57-0ea4-4258-996a-b74b693b97e0", "comment": "Malware payload (Formbook)", "value": "d2ddcc92f5ca832d44ea9abdceb1923f3548898e32f46dd74a3989b6210571908e81c84aa5990d70517b7480aced2ce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372370, "uuid": "9126d0a9-774f-4a95-b39e-5382640d8bfd", "value": "T17355C0027391C062FFAB92334F5AF6115BBC69260123E61F13A81D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372370, "uuid": "0cc7aa08-697b-4c78-9060-e9172b07cd31", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372370, "uuid": "e2b65b77-000f-46b2-be30-08c4c79dfc88", "value": "24576:/qDEvCTbMWu7rQYlBQcBiT6rprG8al89wXnIGjk0+PTyCKC0ea:/TvC/MTQYxsWR7alX006", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372370, "uuid": "867fd9ec-1a62-4400-851d-dcf67a5337f1", "value": 1324032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372370, "uuid": "26228642-dad0-40ae-9d48-fbed0e81121b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372370, "uuid": "554220de-0efb-40a8-aacb-5de0e9e99bd8", "value": "QQ018252-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c796ce2-551a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779370579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370579, "uuid": "4b0f271e-e51b-4737-a72e-9733f5857b1c", "comment": "Malware payload", "value": "1534a4900e39a36a3c95192fcba312eb", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370579, "uuid": "6749df44-c6f8-4342-a9e4-e9bd0c19ba89", "comment": "Malware payload", "value": "1ebfcf871300be4b3eae19513c3054b75722ed81c204760f3c32f9532f6742f0", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370579, "uuid": "279d28a7-3ed9-4aa5-a3ef-93e86a2878bf", "comment": "Malware payload", "value": "43b51c370674ec3e0adafa3615d31b1af3db615a", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370579, "uuid": "416ba8e1-239e-46bf-89b7-68f839c211b1", "comment": "Malware payload", "value": "57ad6596eeb9daa83076c872f199543d60792559d9c5331f09cfe34997d1a58f29a4c29880a5ebc26a7ae6098f7a947c", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370579, "uuid": "7a3f1264-0bbe-4fa3-a93c-72799775fbe5", "value": "T1EEE16CA34B193B2894C51C1ADFC60D149FFB972511ACE253C54FFC8E6386718A8AFB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370579, "uuid": "2f41c1b2-4022-4e20-93e4-647a549e7f4b", "value": "96:tnrk9X5kF5+AKc6insqjy7ja4vzZGldhUpPF/8KGRHxIsVjXOc0O9e/r:5kdI+AKinsebFyOPHyrcRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370579, "uuid": "27fa862f-0438-4ae2-95fe-6e109f4ad58a", "value": 7114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370579, "uuid": "f6e4588d-6930-400e-89f7-99ab2a0a1e38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370579, "uuid": "5467ef0a-26a9-4402-aea6-6556fbdba775", "value": "globe_product_order_eu_buy_20_11_2024_000000000000000000.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a347eea-551e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372373, "uuid": "cf9e259f-6c11-4db4-b5d6-65a60da94380", "comment": "Malware payload", "value": "9f88f6d79809d19e66263271658cf2fe", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372373, "uuid": "bb98ab0c-ad7e-4c4b-ba93-503fd24e94f8", "comment": "Malware payload", "value": "1ec7afce120ab6bc29637db351b30c3c613cb76fc353611f73423a11f812328b", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372373, "uuid": "b016cf9c-1b42-41f4-8913-1a5d88258248", "comment": "Malware payload", "value": "b5a08b3f7f443c5ba4e4f4706c2af4fdeae83820", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372373, "uuid": "50322032-1f75-4d31-9d10-af9d4042bcf0", "comment": "Malware payload", "value": "771e1b18e387c8e56ad787fe858b437dbb365f7ebabbc7a813ab1501b69fe3fbd12bcbd46fa4991def1101b1fbdc9ce8", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372373, "uuid": "2bb65555-5448-4a89-b039-b3d26688794c", "value": "T1270533EAE79580D1CCE94731A597DA167DFFDFB250271A90D2FAC0183A621A5CCF8C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372373, "uuid": "a276e994-6dce-4f67-91af-521a634529e7", "value": "24576:2VQaN1yJ3/LpIZG6FX8hWeVJPvFZwyMWenNKubMoQlAlVO4paf:IAJ3NIZfFKVJnFZwytenNK1ZYO4gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372373, "uuid": "56c60457-e160-4a80-ba06-a1c7cf03e2ce", "value": 820401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372373, "uuid": "140acdbd-78eb-4d05-a3b9-5d2e595b67d5", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372373, "uuid": "16e7acf5-7be6-4345-9b58-1ada25ed1107", "value": "PAGOXX630.900.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c41abb5-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372377, "uuid": "c4122eff-6dad-4391-97eb-3fd3662478c7", "comment": "Malware payload (StrelaStealer)", "value": "ce2abd9444ffd16ffd51204c9825e1a2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372377, "uuid": "a19a2666-017c-4765-b659-5159d8d0e568", "comment": "Malware payload (StrelaStealer)", "value": "1ecbad02cae3bf622b0fd7192f062e309dbf0a13d1f5689993a73c83ddea9a81", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372377, "uuid": "54925b30-5f39-4a3e-a5f8-830c3a79e7bc", "comment": "Malware payload (StrelaStealer)", "value": "0349dba02734127bcd386d10eabf305a71d1e070", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372377, "uuid": "2f0c6fe8-86aa-4a2e-9799-a79233d1e03a", "comment": "Malware payload (StrelaStealer)", "value": "49b8b86ee08561b09b56b9ef1681227a831de1691a1272951f4280c569cf4b32f6a6c99badbdb6347e4cfa472aed0ac1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372377, "uuid": "cd18288b-633c-4680-9fb2-a900ce75ff01", "value": "T1BA718BCED1B2622C9EC463B3874EAD1A59C3C7653766781AEC44700D8CECD4BE56F868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372377, "uuid": "83fdf61f-75c1-4671-b9db-cf2e6611620c", "value": "96:9Ad94T6rEPu+xA1yQBUSTlAkb1USTl9s7:9ADvqiB9Ak5990", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372377, "uuid": "73a78e5d-0530-4a5d-b1cf-027c89051298", "value": 3541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372377, "uuid": "99ffcdc9-12b6-4096-8e42-5a68d49d9f7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372377, "uuid": "cc29d1f8-e9f3-40d1-b21d-47df2fd42661", "value": "13830113262974413181.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fea6cc0-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372383, "uuid": "6cc99b21-ceae-4d07-b7eb-86ad4aa0fbe5", "comment": "Malware payload (StrelaStealer)", "value": "2302bbca2822a91912b9a04043dbf97d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372383, "uuid": "e7cc1f6b-9c4d-4977-8c6a-5a0bf9b41390", "comment": "Malware payload (StrelaStealer)", "value": "1f2b0b03e1d3a0e1cb3fd8d0efe250e300adf0d47c3887455e480c6022b57569", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372383, "uuid": "60b301d5-4a79-46dc-8f95-42bd45b3cad0", "comment": "Malware payload (StrelaStealer)", "value": "3a6720cddfb1e452a420edb27108f0ffb5e20210", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372383, "uuid": "2e1abb83-d816-40e2-a195-a65b86a70faa", "comment": "Malware payload (StrelaStealer)", "value": "5e11053fc5f86730e919c181d26bdb4be6fd79c8be97302eb89b09cc32ea4d3f353201af69f475b7b8d88e6e4ed7e0b2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372383, "uuid": "122c4b3a-aecb-4d10-a191-63dd55faf012", "value": "T17B418DF634FFDBD910F264D3B21676FD950AE271C86680DE1A1B618CD88416C3EE7252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372383, "uuid": "6eb9b045-f414-47e3-8690-e935bbcc98bd", "value": "24:en7BUADROJzmGw8uDDDXEBAje8ZrZ0Z46uCWZMZTE3lwElFSWZ/:+NeqgufDUBQeelWNFQukFj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372383, "uuid": "be7de508-b274-4114-b30c-5da0bd76ab7e", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372383, "uuid": "703ed93b-60b4-45b1-8dc8-1dd227884378", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372383, "uuid": "2c594e7e-edf6-43d1-9efe-37d0e82d8041", "value": "31155263153238418073.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ed1f1a-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372386, "uuid": "db95f00d-dae4-4510-93d8-29cf570ef3dc", "comment": "Malware payload (AgentTesla)", "value": "7104dff20fc48b21411439aae7240649", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372386, "uuid": "bf026516-0a12-43cb-928f-8d16aa67963d", "comment": "Malware payload (AgentTesla)", "value": "1f416a031182bbda850efec4e50bcf58b457182acb38534810bcf16119b91ed1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372386, "uuid": "cb8f9f6a-df4f-4cac-bb73-e6668c4e5115", "comment": "Malware payload (AgentTesla)", "value": "b7261178fabe67d45fb0df89ec27270cc6b6ce64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372386, "uuid": "61a2c786-fe8e-4223-a671-f9e8a78653b7", "comment": "Malware payload (AgentTesla)", "value": "e6849a99a34315fa3d17f1e99f770bd3486aad679075144144e94294f58274d7eb8ecf0a5ac278e063dc519b14a538f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372386, "uuid": "c7bd8da4-d611-42bb-a762-ff93d2904c71", "value": "T159726D00B504256B629E2AC15C34A93BD69A97393AC3C8867D3E17076DE6BB73E14373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372386, "uuid": "62236592-db55-442d-b7d9-e89e8bbcb053", "value": "384:LAEun1QYG1mcBNqqqqqqqqqqqb9qy1BxDWso9k0kBB:LrHR1mcBNqqqqqqqqqqq8y1bDH0kBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372386, "uuid": "f4c9c975-3707-4652-b50b-d8ec33931221", "value": 16338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372386, "uuid": "a3a90213-5d3f-4cd5-95c1-5278cb463ce1", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372386, "uuid": "33669dff-d04b-4fc2-b155-70830f1b55a3", "value": "Arrival_Notice_10008616062024.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3083f7-555f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779400484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400484, "uuid": "047b9b58-d709-4527-8320-e1af954b1fa3", "comment": "Malware payload", "value": "a7563ac619e9d31b14736a2caace41cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400484, "uuid": "d00bd2e1-5564-4fe4-ba48-f32d157233e9", "comment": "Malware payload", "value": "1f6a887240b3c98fb658da553e4a404785f00f461255d972bb0c677ac28ff2b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400484, "uuid": "1497f8e7-cc8a-41c4-9d0b-6591184b444a", "comment": "Malware payload", "value": "6ae5786171e5065c5448fcef2a89dac2e2e13d8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400484, "uuid": "15e1bf20-8cba-47d1-a5bc-4629dfe168c4", "comment": "Malware payload", "value": "6c822cbb3a916c80a233e00752a60c432640da97caa9fe345b141ab660a1fafcc4b2e8f7f584eb684fbb3ac9fbb2b486", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400484, "uuid": "7ff05871-5205-473d-a7f7-8b7a8abb6721", "value": "T17B45F107FA7108A8DDAACC75825EA133E62578C98216F6377FD09F112B26B24EF0D751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400484, "uuid": "67b7ec5f-bea0-45b4-b42d-71fd7fa9d5b9", "value": "24576:ciHQNIoZPO8tw+BvrUWN3D34lPzbLEjD21BhUWvD7aUMRxxWGe3TeC:ciatO8/hU4T0zHEjDIhU6D7NQ2GuTeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779400484, "uuid": "c4c7776d-8136-40a7-b2b4-89bc9080cb41", "value": 1242901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779400484, "uuid": "858b7294-59f7-4e73-87d6-aebb9194261b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400484, "uuid": "7ce08b68-db74-4b8d-af89-1b45d874e867", "value": "ljwqgms.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fdfc28-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779372390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372390, "uuid": "7753070d-2c1b-4c58-ab6c-b6894e6dd613", "comment": "Malware payload (RemcosRAT)", "value": "5b0591f13950573f12dee93fbf764e10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372390, "uuid": "bc2cf21d-cb8c-4190-99fd-55f94a17012e", "comment": "Malware payload (RemcosRAT)", "value": "1f81e485b3bb69df1cb3661490e4430c7098892e014e1481a48b6fec1d41b7d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372390, "uuid": "7fe18bda-58ee-4e14-9e05-cadc0ef24fc3", "comment": "Malware payload (RemcosRAT)", "value": "48dc0ac8565dbc5eb41c29c40cf84503b6828f47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372390, "uuid": "61f54164-ee17-4540-9ae5-16c6fdd8eb91", "comment": "Malware payload (RemcosRAT)", "value": "ae46a354ace8815b62b2a034bde4085930753f29dac8c9b4c93711c0bc5d0e0737d199e55427b1a95e7904f1946e328d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372390, "uuid": "cb866690-c97e-47d8-9c98-37694a0ca5b3", "value": "T18EB41211B65AF61FFAA22E74085780FDA75ACD0C20B55D02337D7E4E6E3931AAB3510E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372390, "uuid": "3b3356cc-5ad7-499f-a8ba-1616b9ca80b8", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372390, "uuid": "36c1703b-b8de-411e-94c8-248183cecd10", "value": "12288:JbqCHN/Bjg07yBPDZa1E3iXXUpuqiYoENzMhHXfhBotn:xT1p8rZaaGXUp2mVMhHp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372390, "uuid": "21359629-5421-4f2c-a330-4328e4162cb3", "value": 518059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372390, "uuid": "5bde01bc-1b15-4ec2-9e6f-69fcffd3b2a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372390, "uuid": "ea3b2975-7b90-404b-859a-45b7aa14d439", "value": "DHL_Receipt.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4645ce8f-551e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372394, "uuid": "62632a0c-fc8a-4ddd-8829-e82445c96277", "comment": "Malware payload", "value": "5af699bec7969d1066c75615844148a2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372394, "uuid": "907dc6da-e655-426e-91bb-409fbc2f188f", "comment": "Malware payload", "value": "1fba8019e42601cb22040ca6689fa55a9741cecc0aea84d17d0621b644af77a5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372394, "uuid": "c0b6f1a0-a657-47e4-97e5-363f2a26fa0b", "comment": "Malware payload", "value": "81c3d8d13ca3282d062bf66467a912d37bd5a0ef", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372394, "uuid": "3108b081-988d-4913-b466-2517ab288466", "comment": "Malware payload", "value": "18e19008b59e0d1f2268f6d4858b3ce64ad928f052a48d4c23705b1baf0e7395fc78d4c76629d51c09c52d5b4d68c802", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372394, "uuid": "56be7977-53de-4ce2-92c1-15eb424a9e73", "value": "T107763170F20BA0436F588727FBA5FA112D0537A90B518B17016DDBF227079DFAE0E969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372394, "uuid": "1685a3de-d3bc-4d1f-a20b-90a69c634261", "value": "49152:bMvMxM3MRM6MZMOMNM2MHMDM8MlM5MeMPMzMYMcMkMOMyMYM0MV:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372394, "uuid": "bdab6e1a-7758-42fa-87db-ff60785cb49d", "value": 7659694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372394, "uuid": "02a0ac10-d167-4906-a3f9-25033c18582e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372394, "uuid": "f7e169a4-5f5f-460d-9efe-78a06682f9ad", "value": "Quote.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e504c9c-54dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779344409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344409, "uuid": "7154df1c-7179-4f12-8fba-3d48bc1b21cc", "comment": "Malware payload", "value": "eb3408938ea753e474a1fec2b1f0ccdb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "TelegramStealer", "colour": "#414F0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344409, "uuid": "685eb48e-d891-46a2-9e26-b1b4e4695a22", "comment": "Malware payload", "value": "1fcd76aba39621c66c834538fc37a8d9249b4004e62343d594334ff40d9269ab", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "TelegramStealer", "colour": "#414F0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344409, "uuid": "e943b888-a37b-4509-908a-787205fec561", "comment": "Malware payload", "value": "e061a4b28bccb11764699d3daacedfd76157ff51", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "TelegramStealer", "colour": "#414F0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344409, "uuid": "89e110fb-6cbd-44a2-9bb4-361ce1f900ed", "comment": "Malware payload", "value": "9a5169a809c0df2d7eae8892ce9baa26ef5bdd342fbfd27025e901e1d4b657616bb91bf5a7ea57da19db4663553fa3ea", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "TelegramStealer", "colour": "#414F0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344409, "uuid": "257fc2c3-9050-4549-bd74-a2dfc3993ad2", "value": "T17E745526ED875CA39383DE63D6E7D21CBE6884EC801B5EC4F5B8C68254B0D2A0749F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344409, "uuid": "03ae59f1-9214-4a05-9dfb-3d78f5cebfdb", "value": "1536:3DrdVg7Xu7GKU5dmyEBoKFhxORRHezxW/:3nzg7Xu7+5dmhBoALORRHe4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779344409, "uuid": "04991376-93b8-4f9e-9f87-0badb4066a13", "value": 361366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779344409, "uuid": "d55aefcd-4e8f-4c1b-b948-c3cb7a266747", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344409, "uuid": "8fb2d031-9316-4931-a128-b7f5d856162c", "value": "run-home.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8d368f-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372403, "uuid": "024805d4-015d-4896-9f65-9782976bbfbe", "comment": "Malware payload (SnakeKeylogger)", "value": "02473241a7ea7c842fef649fab0ab92d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372403, "uuid": "90d84f99-164e-440b-abde-ab9451af6d2c", "comment": "Malware payload (SnakeKeylogger)", "value": "201613522cbdb98d9293376a097b118060d58f2c66a16e8572242e519b175581", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372403, "uuid": "0aa1a987-f368-4f67-8307-a3235f87185c", "comment": "Malware payload (SnakeKeylogger)", "value": "b5074068897c9a103c112d2cebaf5cf9f3af89ca", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372403, "uuid": "a5f7e6a2-d01f-44b5-b159-a5c3ab2080e8", "comment": "Malware payload (SnakeKeylogger)", "value": "7762e1e9bc8ad4704c2d5a0b6793985ec99d96096c1c88b50cf7b3fc9fd10f87108b573cde746d1283f81ae1232742b4", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372403, "uuid": "b9ccf04f-818e-42ae-a876-d72b11119846", "value": "T151B42388859C34A8B344BA7FF69D3D4C544681C84EBDDE99174BCB420AF69FB5688C07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372403, "uuid": "bbcb30f8-0984-4e90-8d24-7e5254531410", "value": "12288:ez4EnLXPmbnwz8J++rBdCmsDBefjccVRpPKRCOqQfwPzFHSUcNi6:wJXPswzuYNyjJRsClQ0zyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372403, "uuid": "7d4169c1-85eb-4436-9241-05242e8ad8e3", "value": 536465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372403, "uuid": "fffbe079-39ec-458d-a2e8-1cc7489aead9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372403, "uuid": "ce291366-63ac-4cab-8db3-5925ed43b44a", "value": "PurchaseXOrder.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9b771e-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370582, "uuid": "b4ca7af5-ee54-4cbb-8588-72f03f6bb381", "comment": "Malware payload (StrelaStealer)", "value": "1eb320ba8eb05280c9ad39f6971f8995", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370582, "uuid": "5ef4af5b-b080-42bb-aad1-892ced9788b6", "comment": "Malware payload (StrelaStealer)", "value": "204921bf8403ffaed8041a7eee14344b5c6945570c7fb449946e5bf846a1ee51", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370582, "uuid": "531148f5-b6e9-474e-a21c-7b24a731e76c", "comment": "Malware payload (StrelaStealer)", "value": "239c30c16dc8443a889c288e529f3960ba2c8a7c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370582, "uuid": "0198db9e-5628-454d-a904-5ec667acaa8e", "comment": "Malware payload (StrelaStealer)", "value": "7346f2da95f100f05e79ca8956d5c4420323479907dca851862719f5a8a489ebbd5c2bae88250a88a1857686950c79fb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370582, "uuid": "dd646430-bf8f-4656-b80c-bcd3bf008168", "value": "T17ED43A4DA1962C666F9A6C6BC43B1BCE6DFFE46C12E40814764F4EE06C2FE55A874C30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370582, "uuid": "79e923d5-6c5d-4639-92c7-a637f676edc1", "value": "1536:5s0v+N7E6RMLw6b1H0o3NDbv8pWZ8ILIZaeox/XS7X9NoJy+yXFyojVma9vXniMw:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370582, "uuid": "14dd136c-2c81-4f84-b07d-134b2cbe8d2f", "value": 598429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370582, "uuid": "6146feb2-273a-443f-bbed-51acdcc5d07b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370582, "uuid": "4611d850-1eab-4b25-8b5d-98ad959749d8", "value": "306147882303278190.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050190db-54f5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779354675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354675, "uuid": "3bf1ebf2-06de-4c62-b97d-d2faeeb9cf7b", "comment": "Malware payload (RemcosRAT)", "value": "4dea15c8fbc6098cc00c7897df438631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354675, "uuid": "847c3b90-fee7-44c1-90ae-08e48ed4315f", "comment": "Malware payload (RemcosRAT)", "value": "2057608245306defa9245057b806573afd270232805f2cf7d03e6b447132386a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354675, "uuid": "31c43080-d935-47c3-86d6-9c449fa06f5d", "comment": "Malware payload (RemcosRAT)", "value": "213b32b49dfe0123883792ebdd53254c62862687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354675, "uuid": "c34c5606-10cc-4508-872d-7907c5389369", "comment": "Malware payload (RemcosRAT)", "value": "0a85fa55efd424ccf1eae6971657d7f5d91c4c06074f4c215642c7a30a2545a2a4ee4e117ed3c05c6dae022943c932dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354675, "uuid": "b3d6ffa3-9e74-470b-aad9-798a1d1c5638", "value": "T139667C0A62EA41E9D0B6D138CD5785ABD673BC554B3297CF0171BA0A6F3B2D08E39731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354675, "uuid": "c06735d9-a4ac-4bf4-991c-772d7949d270", "value": "257670f56ff8877f9177ae6446e88b54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354675, "uuid": "b13176e6-600a-4098-bc89-31a22f0499a3", "value": "98304:w61805aSyfU2a7bzBNTzPuAryNyzp0BM6:bGkyf7a7bzBJmQyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779354675, "uuid": "9a12a2cb-e971-4e15-87dd-df14cf731fa6", "value": 6891576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779354675, "uuid": "cf800762-221b-4bbb-83a2-89e5c227833d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354675, "uuid": "fd21024e-584f-4147-b780-f9df0ceaa282", "value": "2057608245306defa9245057b806573afd270232805f2cf7d03e6b447132386a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4925e1-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372409, "uuid": "a6711923-213b-409d-9a22-d61bc0d85662", "comment": "Malware payload (Formbook)", "value": "16cceed135a8469c5dfb49e8beef180b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372409, "uuid": "93c2548d-f351-43ae-b724-bea10b79a4f9", "comment": "Malware payload (Formbook)", "value": "207a07e528ba10074e73eb72ba55c04bb95622cfbed0d7948d3f642a67ddf78b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372409, "uuid": "a13b6c97-5f06-41fc-9558-3607069ef3b6", "comment": "Malware payload (Formbook)", "value": "83d421d125d5574befb2ca974ebbbaa32ca3abf2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372409, "uuid": "dbfd7b17-f90e-44b1-9b25-39feca6685b6", "comment": "Malware payload (Formbook)", "value": "c7bed46ed8fe397ff6c76a00db46d57946d17028116d7363a85186d0b713671f70379aa6bddd3d7fc5964c7930ac89b0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372409, "uuid": "31a1585e-5813-4331-9289-37214183ac59", "value": "T17125339D65C9FB67921D8900A07202A937BDE68B81BC7A30F91C05AC53F9DE13CDC5B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372409, "uuid": "c2ceaf45-513f-4665-a3a8-74977e03db21", "value": "24576:4drjoyesAugh8OYNFIdsmsr+o2NuVOgErd7yOdlR:io5/bhk+ZuVOgErduOdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372409, "uuid": "00bb22fe-3ede-4d65-af54-6e2fd4f2b359", "value": 1047200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372409, "uuid": "c31fb515-87d1-4f13-9a26-2f379327a924", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372409, "uuid": "60ac7d4a-8a29-46d2-999e-bd5dbec8b819", "value": "RFQ_urrgently.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a52f38-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370586, "uuid": "946e80e7-bd73-4aa6-b1f8-25bc2fe047cb", "comment": "Malware payload (StrelaStealer)", "value": "4c722b31ae784e595b7a5de1afb46c75", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370586, "uuid": "7acbc0e6-1ad7-4bec-9170-90362746e05a", "comment": "Malware payload (StrelaStealer)", "value": "21f350b8fdf9ff6da456856b1ba7cce51a63adc8b81524e3c14c6d79aa98cbf2", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370586, "uuid": "d9f37ed9-ce99-4bb0-8d31-e4a16cf3eebc", "comment": "Malware payload (StrelaStealer)", "value": "f9e5dd39a408851ebf090567f9c404ca6de6bbea", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370586, "uuid": "5a968678-e7b8-4ad3-bc5a-83b8f12d9aee", "comment": "Malware payload (StrelaStealer)", "value": "77dff66279d3f39f6dfe29db02753d8ab9bc01003cce03cd160030310b6a5a70a9e7b335cb366856ecd80ccf97803dd9", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370586, "uuid": "7f08b591-0a95-49d5-bccf-08329b310484", "value": "T1B86412B26EAA745C9E2BBBC18E78EF5E498D30481C07F21C4A2A55D8F9F9E5F0713054", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370586, "uuid": "48909613-ffa3-4526-8198-603f2be40387", "value": "6144:yg2D1xcHkyUxNmEjIwOvCRYNu+fvjJe7ORXjYBIUZKdEFqIpAC9+x5:ygkcHkdNVEw5AfvjJMOqBI3mqjb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370586, "uuid": "c89ffbe4-af33-48d4-8fd7-b04f76081049", "value": 325228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370586, "uuid": "55f193d6-438a-4cec-bbd9-059280f9ae9e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370586, "uuid": "68b1fc73-1633-465a-87c0-9b1cf240b8bc", "value": "MB_0018942533_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae0fb4b-5512-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779367543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367543, "uuid": "8400a356-7a28-472d-b6a0-9cba09a9aa7b", "comment": "Malware payload (AgentTesla)", "value": "c1d88ff32801cd5e786ecb35615f5b97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367543, "uuid": "3529e05d-e628-460d-b389-6162d77dbd34", "comment": "Malware payload (AgentTesla)", "value": "21fe1c425175f711d65ef911d8ba29425dc6149110cceef896901028e6aa9872", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367543, "uuid": "aafb5635-6018-4637-8d8a-48d8f5c7cd21", "comment": "Malware payload (AgentTesla)", "value": "4c5dbe02ee9da16422ce130ce77e8eb6fe92c31f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367543, "uuid": "d3a9eec2-7aa3-449f-b2c6-101b594b7467", "comment": "Malware payload (AgentTesla)", "value": "982a18084d626fd5630b8788d74e331c6c794ba9565581879a3d27384392428d2386536c34471535666233934bcb9d43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367543, "uuid": "95368a76-3d88-47ce-9e0e-600bdf9236c0", "value": "T1D28423FE1DDD4AF5457561B12371B903FEFF0A40CEB8942988E31943BF285538A225EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367543, "uuid": "1d1ca295-39e6-4d9a-84a5-97389b30ffa1", "value": "12288:05zHdAqyyI0JdMfnNSXcHMdPXSvfZrG8kH:057ycOEXDqRG1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367543, "uuid": "a45e1121-c355-41ea-b5c1-2dc6d2d9abf3", "value": 395509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367543, "uuid": "5a7a029c-4dc7-4e87-9857-2fd4726bd015", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367543, "uuid": "8bb46201-f3f2-49de-ab05-4fe3b60d8604", "value": "21fe1c425175f711d65ef911d8ba29425dc6149110cceef896901028e6aa9872.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c32a17-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372423, "uuid": "385e0616-81d5-40d7-a608-9fe11340ba27", "comment": "Malware payload (SnakeKeylogger)", "value": "658a7ca383752f79b413ca88ccfe3c5b", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372423, "uuid": "b6eaf06b-e864-4866-86b3-7385d154482a", "comment": "Malware payload (SnakeKeylogger)", "value": "220d7eb3a1f0ef44cc9e4927d9169f44da933eef5931449666cf68d8193b16f8", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372423, "uuid": "af00a201-396f-4a81-9754-24289476ac14", "comment": "Malware payload (SnakeKeylogger)", "value": "a10d7583788d494972a70d5527f5fcc24d9f3576", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372423, "uuid": "981848db-ca3d-461f-b3a4-a6c1f8babe4a", "comment": "Malware payload (SnakeKeylogger)", "value": "f35eadff7ee1e0da9de4ef05eb6e623895be95071d0a249ae836532330fd626c0737b5b645fda5b79f888875a5b4748b", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372423, "uuid": "64921017-6175-403e-b8d0-fe1902bfa8a6", "value": "T1ECD423C3E60D610EC0A658E55CDDE79EB03F042B95AA910C4273D332FE64DAE4CD9AD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372423, "uuid": "d32f1fd7-4a68-4360-9d1f-62d9450b5add", "value": "12288:2ZkEy541Wqe94l7En/7qzLYJHpss4nbynjk1XvNG1qdvbbT0ZVoS/JjQF1VCL:XEb1Wm6Hpss4nenw1VPY7f/BQF1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372423, "uuid": "9862a7ae-a4ba-4c5a-998b-e646910d7892", "value": 655929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372423, "uuid": "9ea9514e-4132-4dc4-a3b8-a927bcaf7edd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372423, "uuid": "11e8cae3-eb16-4c00-be17-6187cc93ec15", "value": "payment_Slip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90c4f04-5514-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779368372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368372, "uuid": "8392cf7f-c98b-4800-b630-6b12f64abb6e", "comment": "Malware payload (AgentTesla)", "value": "9e25fa33a104f0fa905a4b7c523e58da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368372, "uuid": "538d997d-5664-49dd-af99-f964c941e883", "comment": "Malware payload (AgentTesla)", "value": "222a27cb19903a101d7a9c08754a574b2a6a8625d08da687f210b02d4a0ee5c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368372, "uuid": "bbedf3bf-e04c-4958-80a7-b5b9c1c0596f", "comment": "Malware payload (AgentTesla)", "value": "29cef79c10531452ab1ddf332cb37cbc24214d1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368372, "uuid": "03594780-0647-49ee-b347-6d2b5f3defce", "comment": "Malware payload (AgentTesla)", "value": "7ae1333a4f0e2954e3376361b0395eb98e0cbd5ca0c9aa9dca5ca4a4ab41596827f202f268bfe04496c12089870ae659", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368372, "uuid": "9c614932-64e7-4826-adea-5dc9e196e02e", "value": "T1E845022589C85FB5CFAC4A1C80FE161E93E04B8F452AB98DFB2BBD46AFF79444107194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368372, "uuid": "b253c56c-d754-4e01-80e5-31d141597629", "value": "24576:HV74NZH/TO8uApqdXYY+qzETVspkL/3w92LZPZR2L:1cZfJqzFmpPZR2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779368372, "uuid": "cffffe79-3bbd-4c16-b5d4-3b8bae00da90", "value": 1261555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779368372, "uuid": "0deca018-15d6-4989-b7f8-d9a3208f0209", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368372, "uuid": "5b4b2ef1-5199-4cd7-a60c-55e8f8e26fd7", "value": "8947679000102425.PDF.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d633b3-551e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372426, "uuid": "b5dd656a-67bd-4638-8c03-641ff5f9e171", "comment": "Malware payload", "value": "6ad6d4487604188428dabea546a52962", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372426, "uuid": "dd85cbdc-b49d-4242-837d-454f6a6e3573", "comment": "Malware payload", "value": "22f6e53454dadbd4c3de0ed9592aa81377893da257ffee0c74951a3db8265a33", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372426, "uuid": "d48b4b5b-ca5a-45db-a29a-aed03f8d120b", "comment": "Malware payload", "value": "4b36a56433abc7c276743105515c2823d90a44b5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372426, "uuid": "4e3fa851-3c5b-4d85-b793-e59c1aa73685", "comment": "Malware payload", "value": "72f5787a47a8e74314f1745a930722fbf390f619cc803d3b2b7457dd1d8e6a2377421f6dc38739b209b3c7e7e5b401d5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372426, "uuid": "2311bf62-7adc-4bd0-8f6f-8dfa21e8626a", "value": "T1DC8533B4037D289262BB1C1ED9099BD88273D44975BA49683BF6B577BFB04E1D1200BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372426, "uuid": "e2c37db3-3f14-4431-bd9d-0cd61648737c", "value": "49152:wlUlyAmucvq5RaU1UbNYp6VoN92gkx1nzG:+GmuTa+ipSegkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372426, "uuid": "3edccb67-8934-426d-a0a7-56b7934d88b0", "value": 1865554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372426, "uuid": "63fa6059-b8ee-4c90-8266-d2f7134614bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372426, "uuid": "3013e455-ff72-4275-ad6f-4ae2c5fb3b81", "value": "RFQ_818-2024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5becb256-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372430, "uuid": "1408e589-80e7-430b-a475-9ec61d6f01bf", "comment": "Malware payload (Formbook)", "value": "f6baefb9650c490d425d6d0297211fe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372430, "uuid": "11cb0dd7-3ef9-4a0d-8fd1-8ee50840e911", "comment": "Malware payload (Formbook)", "value": "2306569ae53954b8bee076cfb80432410510932168046b66920494c953b17aeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372430, "uuid": "576ad339-40cf-4e2f-80eb-2ad2dda0694e", "comment": "Malware payload (Formbook)", "value": "fa80d707d148de8e827575b8b925edcc10ea2ee3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372430, "uuid": "263f5224-48a9-486b-9b85-7090ac4c5b6f", "comment": "Malware payload (Formbook)", "value": "4d3d0f7a0d5edca727d75c84e20428a7b6db978b34612a9dabccad8f571f4d954bf8423b773eda78d21683d62b9f8725", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372430, "uuid": "44afdf7f-1495-4b42-b2f8-40abda6882cf", "value": "T14855C00273D1C062FF9B92334B5AF6515BBC69260123E62F13A81D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372430, "uuid": "a55ef8de-b7da-42c8-9ba8-f39c4fe9e226", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372430, "uuid": "0653a36c-d2e0-4184-89fa-6361cf0a64c0", "value": "24576:aqDEvCTbMWu7rQYlBQcBiT6rprG8aIFarBCBzvWRJqbwJl:aTvC/MTQYxsWR7aIFxBzOmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372430, "uuid": "9443605f-13b8-4dda-8f48-90499ffed911", "value": 1318400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372430, "uuid": "79d55742-84b0-4819-9bcd-a674ca3a3ea1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372430, "uuid": "a321dbf4-0d48-4e59-80d8-153ff75746d2", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c4d3ba-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370589, "uuid": "ea531084-26d1-433e-a201-408a0e356d12", "comment": "Malware payload (StrelaStealer)", "value": "25d6c6c4a565df0a3532645099594cb3", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370589, "uuid": "b077e38b-56d9-4af9-9367-40a20486b300", "comment": "Malware payload (StrelaStealer)", "value": "23255870030600e27a9ed6066d70f8055776e77bf5ded4864151efab6bdc61c6", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370589, "uuid": "8c55bc1f-0e93-406f-b336-82113dfba0f5", "comment": "Malware payload (StrelaStealer)", "value": "326d51d523800bde170daa0de665a561f429bff2", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370589, "uuid": "0cbeb529-8f3c-45dc-8fd5-267b4d806bb9", "comment": "Malware payload (StrelaStealer)", "value": "d266da803983eaebfcfe1a432915a692f48f0b213255e499ae260cb4c29c277c7baf43613a16ea618c72ba4b867e5012", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370589, "uuid": "7a5abbe9-4c94-40c2-a520-2170c7263245", "value": "T143D31269AB91E27BA0A899B8F933E4410732F9EB571861077FB2D75600A750C73037DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370589, "uuid": "94048fed-1d13-4d9e-af80-b8d004d5216f", "value": "3072:k/5Uy+BJ1n+hJIeveZ0/OiHvTt3h2VyAjshwUo:khUzF+hJtve/iHbtx6LVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370589, "uuid": "b1688c55-8b16-4d61-8f46-91982ac86062", "value": 130454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370589, "uuid": "24990d83-3130-43ce-a847-f828dfc627ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370589, "uuid": "8dc392a4-b737-4516-8968-9f58a32a2ec3", "value": "Rechnung-02S24033636.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d1bcc5-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370593, "uuid": "096fde64-317a-4857-ba63-8369e2beaa1d", "comment": "Malware payload (Formbook)", "value": "c37a1c5550a2fe3c3fc299ca3328fa4f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370593, "uuid": "fe3f00db-0a2e-4946-a90d-ce432488ac29", "comment": "Malware payload (Formbook)", "value": "2325be67b392c2b517b916de5832fe5ac13381ea97f0750440c01a0576721e98", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370593, "uuid": "5834b3d1-9899-4389-ac44-e813abfd81e8", "comment": "Malware payload (Formbook)", "value": "eb86a4b314b2340f7f41fe15d60b1b4501b05b8a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370593, "uuid": "5a2585f6-0b8b-4084-9d5b-45bd598754eb", "comment": "Malware payload (Formbook)", "value": "aeff65476694eea3630aadf64e6161fe93fc9c9e44d3049b4ce2ab669e310b7f7e7afe286a7efa256221203a3b8fbf0e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370593, "uuid": "7d5d2293-63ec-4425-b387-7b1152c71121", "value": "T1D8C423B17022A555AEE26364E53A358B47C79EF2253CEEBFEA44F440BCD0754F6802E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370593, "uuid": "f62a200b-70d9-4c8e-86c5-c6e6cbd7bd66", "value": "12288:OWXmriEaiY/V8A6D2mIUC9Swl1pIveW70guwopt9wYvcCVjVPGo3rSm65b2v79pX:OW2xaiYNukTH1pceW7gwoH91So3rK5bE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370593, "uuid": "ff381b3a-8694-4390-8ef9-b509426d4f64", "value": 593628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370593, "uuid": "e38ec42d-bae1-4540-a674-27200559df59", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370593, "uuid": "f4189be4-1d62-4205-9324-1ce2bfed274f", "value": "New_Order_List_Nov._2024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9197b1-54b5-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779327518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779327518, "uuid": "c347202d-da22-4155-9397-442db484ccfb", "comment": "Malware payload (WannaCry)", "value": "018ecce9948e169d7c8402078f051f2c", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779327518, "uuid": "b7e686ec-a99c-44d6-a886-05fc9655740b", "comment": "Malware payload (WannaCry)", "value": "23888151013d27bf9128a5add0182e7642029d850a2be60a57cbb7ae146593c9", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779327518, "uuid": "33b155cf-a3c1-4115-92b2-ce82b10ec932", "comment": "Malware payload (WannaCry)", "value": "b2462dcc775fdef15fea8030e327e5b5fa7d7b48", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779327518, "uuid": "04cddb9d-189c-4f17-afa0-fa27eb79d332", "comment": "Malware payload (WannaCry)", "value": "a49a2d1f53c131e8687d90027283bdfe98117ac4b1669ebe878a24eaf833d2a4341a75abf03853c9a6a6ad8fa57d3450", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779327518, "uuid": "92286253-b0a0-4ca0-bd6c-709d73202237", "value": "T139363349317891BCE0450AB880B78E57F7B37C5A67FA5B0F4B80866F0D53B86AF94742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779327518, "uuid": "3a8780a1-7589-4fe4-8d9a-1a632781a2ca", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779327518, "uuid": "b5b67182-67e1-4658-94b0-75c21814a0a0", "value": "98304:DyDqPoBhz1aRxcSUDk36SAEdhvW3R8yAVp2H:DyDqPe1Cxcxk3ZAE0R8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779327518, "uuid": "97457532-a9e5-4610-a8de-10a11f1690b7", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779327518, "uuid": "a58917e2-fa43-4540-b31f-066951a66e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779327518, "uuid": "9078691d-26a9-422c-bc35-f5f922ede60f", "value": "23888151013d27bf9128a5add0182e7642029d850a2be60a57cbb7ae146593c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb09e3c-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779372617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372617, "uuid": "2bb7f22b-f989-482e-b99d-51217ab28d42", "comment": "Malware payload (Mirai)", "value": "00c2d3c2a10d2eb7b27c51e769308332", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372617, "uuid": "c987c3d3-abad-434a-a621-29352f138c84", "comment": "Malware payload (Mirai)", "value": "23cc09cebfb47562889192707bc13644fbf7d89d9c65ebaa36024dc1d4fb67aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372617, "uuid": "38845b52-041d-4e04-a853-5d2ef74d3428", "comment": "Malware payload (Mirai)", "value": "2bbf3f59f452191533cfaa6dcada7b8afe7f2f42", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372617, "uuid": "d43f538a-9bee-4407-9075-987e0c6fd031", "comment": "Malware payload (Mirai)", "value": "9d21bbd404e17b4a2db81c483a2b6d43f51d6209fed6908352e58176b332a61431c854085b7c6392ec8e6f0de1781a34", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372617, "uuid": "d09858f1-9d6e-46fd-9f55-d374aa4fc107", "value": "T1FA73830E2E619FBCFBAD863587B34F209248339626E1D545D19CFA011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372617, "uuid": "e3949073-e1e9-43af-8b31-45ea9adc7c1c", "value": "1536:T4psVUay6+vl/B1aIuy8Umx9ECYHXwOda7F+Iz6jM0Do:0aZy6+vdmIuy8UKWa7F7z4Moo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372617, "uuid": "e2714a60-39db-4737-a04c-29d884c07d2e", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372617, "uuid": "2889030f-a9d1-4751-9320-a7a09009ee15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372617, "uuid": "2bb889b3-c63e-47e8-9385-727ef290e75f", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612a87f9-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372439, "uuid": "f0b81804-5aae-4092-bb29-5104bdaf1137", "comment": "Malware payload (SnakeKeylogger)", "value": "2f77a6b8df7703193154ed636b3985d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372439, "uuid": "03958317-026a-41c8-aef6-8d16e573e939", "comment": "Malware payload (SnakeKeylogger)", "value": "23d1a139f79b2b7c5e09725333cd5a254aedd9192a735b68b379fd2c7509e388", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372439, "uuid": "22c54734-1e30-4f2b-ac54-7da3500129e1", "comment": "Malware payload (SnakeKeylogger)", "value": "8565f181cfb088268b27a355d8f4277a0f7b8e2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372439, "uuid": "aee7e5ea-5d71-4d8f-8ac4-3ca4e3d821c2", "comment": "Malware payload (SnakeKeylogger)", "value": "e7fc1890fc37047bc80949ffb5d0fab0fd1affc49cf8bea92870cb4b37e6e251db05f5c2c7b797389c134c1795cdf07d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372439, "uuid": "46df5db2-d9b2-4690-80ea-1551e00012ee", "value": "T19FD4F185B25C4FEAD2EF15BBBA4258BF4B76936292CFF2DE5881E8D09CC37418950470", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372439, "uuid": "8327ab98-735c-4f3d-9772-45cc303bba5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372439, "uuid": "baee83b0-ffdc-4642-bd20-5230f6f51201", "value": "12288:58G1KBscH8IPUYaJvPnq2P9zOxRdNeq6ylf4QAVlD7xrjZovH5UPy:ZYBXcJBvq2PoxRdNeq6AQQytVXZs5U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372439, "uuid": "0ae4b81d-f0d6-49bb-a2e7-3f5c219d12af", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372439, "uuid": "b51ce41f-e01c-453e-9a5c-8a7dbf1e0988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372439, "uuid": "e5bffcd6-4055-4449-998e-60ec2cabd0bc", "value": "PI_PAOO8368.cmd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681b9a86-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372450, "uuid": "c3f3f98f-9fa1-4fb8-84f2-be285ee847bf", "comment": "Malware payload (AgentTesla)", "value": "01377d087021e1482cb2bd1010d303cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372450, "uuid": "c4c91dd9-4d90-4ac7-a3d7-6c4c9e28a355", "comment": "Malware payload (AgentTesla)", "value": "245c82e44b02bd73b4c0268c140b4732602a9bf7ede53519076178c6af7b2855", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372450, "uuid": "aecdcc49-191e-4b74-8c6c-9dceba7e1cce", "comment": "Malware payload (AgentTesla)", "value": "5a7667637d6709cb2b3d89c46762faf39857e2f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372450, "uuid": "48ea1f49-0f32-4715-a48f-65871871d3b1", "comment": "Malware payload (AgentTesla)", "value": "b24f9d77836ccfdac3b6808f5962e7502ca80faeefbca708e098322493c2a9c6717202e669b0af1adb04d5c30b66540c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372450, "uuid": "785f5252-f430-40c5-810e-119e564e67f9", "value": "T173D4121073759387D97A5BF02E21959207F2661F7665E7687DCE80ECAB22F020321FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372450, "uuid": "4311ca33-d8be-47e5-ae8c-89c217de9728", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372450, "uuid": "036fd056-02d2-488a-a659-5de277a08339", "value": "12288:x3KLY1MN62qZaSjVO3VSQsnzGfay6QyhDydiYJ7AodwOZcw4WPVXh4:rSUZaIqS7zG/6vydiwAoVzvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372450, "uuid": "0c124500-8a97-4f42-bb85-4e607ffbbd94", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372450, "uuid": "a0d741f0-a247-4277-90ac-510b7f21acc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372450, "uuid": "1c1582d4-8a4c-4614-8717-217b4bef9b56", "value": "PO89100541.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdee984-54ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779351655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351655, "uuid": "a7b9964f-0b9d-4b49-913e-f68a529ff820", "comment": "Malware payload", "value": "f38e284f7e9b1daab58cf725405e63e2", "object_relation": "md5", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351655, "uuid": "007ac508-72ea-4f89-8e0f-3d7aed8bdd8f", "comment": "Malware payload", "value": "246f85198a30d838fe2c522c1ac68b04d033886d19573bd7d9f271f86aa76283", "object_relation": "sha256", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351655, "uuid": "b76525eb-dcdf-4366-b7d8-bd3e8d38a7e9", "comment": "Malware payload", "value": "c32c3a916c56630ce06b36aaf07db3d762f4e891", "object_relation": "sha1", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351655, "uuid": "c2a3ab8f-23e4-457b-84a9-78702ae18c04", "comment": "Malware payload", "value": "e12845c7afe4f9996aea2c1de4c5fed9b2eff866c3e1ae78b8251d63c3277f5c07d4148864aa7241a803eb18fbb2025d", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351655, "uuid": "cf054ea9-ae82-43b0-b5a7-a3912d18684d", "value": "T12E71DB06C3E84666E8BB0B386DF703A333B4F8549B63976E2A60025D3CA47245A31B70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351655, "uuid": "bca7d7e1-341d-4602-a0ce-bcb85db325c3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351655, "uuid": "023f5155-2d6e-42a2-ba06-58ba3688dca8", "value": "48:6nbB+bfSx8SjcAkH+kihkvAUmFicx1ulga3sq:WB+bfSKC2H/i+vAieK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779351655, "uuid": "e25ec5e2-afb8-4f2a-a393-d98c142062f9", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779351655, "uuid": "ceb9044e-452e-4b01-9596-cd76967b9320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351655, "uuid": "7ba0627a-d10a-4434-b439-f9c6c356e5dd", "value": "qwh55zfb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1d7263-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372454, "uuid": "ee2cadf9-ce3c-44fd-b45c-fe8d10d1d49c", "comment": "Malware payload (StrelaStealer)", "value": "ac04488518036a935e89a96f7ab9ad59", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372454, "uuid": "eca525b3-a162-4192-aa23-a82793363987", "comment": "Malware payload (StrelaStealer)", "value": "2472d160fbf4a3e930b6ab530278da16933029b6c3ca7eed9fe3790878cdd584", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372454, "uuid": "4cd2cfbe-1436-45f2-b285-a85e04e3c56b", "comment": "Malware payload (StrelaStealer)", "value": "5b7415462ae2e101da94d760d39f232640694218", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372454, "uuid": "568f8764-d1df-4811-a9a9-d4cdc2f7b34f", "comment": "Malware payload (StrelaStealer)", "value": "3fe52dba79ff5ee222508f21796f778b567a192afd3312953cb10b435e4c69d86f8e91ff76f94a8d058550cee9f070a2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372454, "uuid": "89640a99-270d-4b43-bc25-4d1f008231f9", "value": "T16B423B05B761244B0CE6D3EFB00A21EBF6144133A35572B8B0EF425EA2664BD456EB7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372454, "uuid": "0615b35f-74db-437a-82f7-a65f8a986ad9", "value": "192:1fiD2GhfMscccb/TBscccbE496Ex9aUpIPcnU1YWOZPq2Yyab5VGDscKskKF/b:1aGscccZscccY4962alcfC2Yxb5VGDsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372454, "uuid": "0721f459-a020-41ee-a04a-538a9741ac7f", "value": 12142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372454, "uuid": "e3196787-03c0-415b-9c4e-5842774739a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372454, "uuid": "35a51913-a9aa-48d8-b137-a38a5217a35e", "value": "124721192952728033.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c15927d-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372457, "uuid": "467512c3-21c9-4acc-862b-08080a32df11", "comment": "Malware payload (Formbook)", "value": "34c555b474376cbb44730a44d09ff0ec", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372457, "uuid": "4cae633f-4c49-478a-86cb-2e05f71fbb6e", "comment": "Malware payload (Formbook)", "value": "2481b017dcb8b75d071d2e0e1530166bfc98b5fa99b72054519f3ba8801b095d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372457, "uuid": "28e07ba1-d716-4cfc-b4f2-96c3fca0c474", "comment": "Malware payload (Formbook)", "value": "566553f0f0383389fe1db0dce973cdb649d14131", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372457, "uuid": "8de39cc0-72b2-4e17-9d2f-caf8fe225a31", "comment": "Malware payload (Formbook)", "value": "e97d6622fa5445d51089c6c6e5ab30f2cc6661f7cbfe99368411c3a4eaa074d62446def730a4028058f0d95e61318fbe", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372457, "uuid": "ca7d7b98-067d-46a9-abd0-02d23c475eb6", "value": "T1A0E42335716FF67F088024F28290D7DD3AB85AC05AD8C8945E85F4BE85393EAAE6181D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372457, "uuid": "9cd6b3bc-e44b-4afd-83d5-7107b5736539", "value": "12288:qnh4eprh6++7UU5z858GjV3VoEEnM1+FU6atxBeVGIRyOLrY25JAy+2:GLH6+FU5z4vBSDk+FNaBEvRxLU25JfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372457, "uuid": "2312a8d6-54b4-49d5-ad1e-913c79f6b782", "value": 665134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372457, "uuid": "1a8b3a78-e1b1-4233-9646-3f89e664b602", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372457, "uuid": "e9d53544-8d9f-4735-84d0-d15152d7ba18", "value": "GSTPX-XK3E0035.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179cdb09-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (PythonStealer)", "timestamp": 1779370597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370597, "uuid": "9582699c-8b5e-4c55-bd8e-122d9b669103", "comment": "Malware payload (PythonStealer)", "value": "a0044986eec99f4b05358f1457be6ee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370597, "uuid": "7acb9a62-38b5-41b8-a87d-df65619635ea", "comment": "Malware payload (PythonStealer)", "value": "24c7c6cc3124b20c717ac485e263193e351f0ab2e672b353b38688ba218bda9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370597, "uuid": "13434d14-f8f2-498b-9c67-e3898ce1e508", "comment": "Malware payload (PythonStealer)", "value": "bed5076d966b94c942487fd04e7074e861235ba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370597, "uuid": "a20ec91e-0bc5-4bb4-b775-9c46ea0390a3", "comment": "Malware payload (PythonStealer)", "value": "e6460529fc838df6e75eb4e5fdc11d3acee74e583dbe86e6c6d49de4b2dc812527092e00cf50d7b54aec7f8ae884cb34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370597, "uuid": "d057194e-26a9-4245-84f3-cc07321ccf98", "value": "T19047339952E90CD2ECF5413AC22AC109BB32FE656BD0D54F9BF988471FA72D01D39E81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370597, "uuid": "5f71a126-ea9e-4dc5-8a4a-83ba1b2fcaf1", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370597, "uuid": "af17ef16-1127-40ed-8fd4-70b17eb2c448", "value": "786432:i9YiJVl8ZMj3hr8AW+e5RP96R+c+U4VdF5Kd:i98a3hr8AW+eHPgR6U4VdXKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370597, "uuid": "1789ee06-2be7-4ae0-ac85-2d2a2cdad9f0", "value": 26241148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370597, "uuid": "9422d7c8-da04-4320-9774-ccc16fe52aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370597, "uuid": "e3a78ad5-1883-437d-99a8-74bdef41b044", "value": "transfer.whalebone.io_7BlhQsgOfX_Payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac98adf-550d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779364992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364992, "uuid": "afa8d06f-8494-4664-ab68-c22fd1545694", "comment": "Malware payload", "value": "0c2a4a7a9065444ee549c0116d30f132", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364992, "uuid": "232f31b1-f037-495e-892c-5a3215df610a", "comment": "Malware payload", "value": "24d409627bab5b40ff90556fd076314d302c8ff4c2c9f95024cb5177221652c6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364992, "uuid": "e67ff381-3d87-4a4a-841e-6fc668d82f06", "comment": "Malware payload", "value": "266c94ad1724dcae1fcbe1803d5e0d5f126d4678", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364992, "uuid": "fe94c7dc-036d-49ae-8418-58037d67f9a1", "comment": "Malware payload", "value": "2e73da8cce1b77103225520dd3251d6e5b13fd2cede81fe65ee75edfc763566db24e217b8c8e7f1421fcfe6d42af91fe", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364992, "uuid": "850c4343-8f30-473c-82ea-f0fd1a098bc0", "value": "T1AA91E9F4F86854D1D79EDB4BF2A6A8AD722219FA489714CC11AC53822FC2381CF7D846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364992, "uuid": "18c57699-3f12-4752-b53d-d582f321a6fe", "value": "96:OeAQ8Q+dGZqsiu33/ouHQX+3U7vZ50m+0zCQeJKVVo:TAQoGZL/obfZ2QsKVVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779364992, "uuid": "ca16fbf5-6fc3-4220-aa4b-5e88201af428", "value": 4244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779364992, "uuid": "9a7dd3d5-4a92-4d3c-bdd3-47ef42db3ce5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364992, "uuid": "7d425d8d-a53d-4b1e-8410-858df1617acc", "value": "file01.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcce2f5-551e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372463, "uuid": "492d0a7e-49a1-47d1-b320-7ec8bf80579a", "comment": "Malware payload", "value": "572ad5f4c848c4630487ef4f8c21dedb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372463, "uuid": "08a907fa-1c78-4429-bdd3-3481a851b4a7", "comment": "Malware payload", "value": "253fde80a0399d6875945bed3b0d783ed12752bc497a04ce6af73bf074c78db0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372463, "uuid": "f8904a5e-3c71-471d-bc77-9243981ab144", "comment": "Malware payload", "value": "991acb763fb74eaafaebd1515b3f39cc57c52f62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372463, "uuid": "1ecb5a17-32d8-43af-a00a-ff24b26f00a3", "comment": "Malware payload", "value": "115c9e2ec9b5e6c11f106adaeef45233cfd4ad3eed6e5805e563057095f040ded277dee159ebd5489148c82df146b400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372463, "uuid": "9d64b34b-756f-4bd3-ace3-cb3e380b1fde", "value": "T101852348A7E149ABF3FE2B79AC7005518F3CF445B533E70A5BF598F80DA379449042AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372463, "uuid": "0ae70409-7f12-4e09-9fbc-aec6360e74e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372463, "uuid": "4742d263-7bf2-43bf-bd01-de643055cc59", "value": "49152:5hUJo0QJ/lb8qxR4neNJf8AR9AzaZ9H8gFiv39HEjQcQzjs:Ko0GlNxR4eNJf8G9AzaIgFw9wQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372463, "uuid": "22e50188-7704-408d-818e-18e81a4ab839", "value": 1774592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372463, "uuid": "ddbca25b-36b6-4d5f-977a-7e5a4c995d1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372463, "uuid": "a16bb094-be16-4b21-9b10-dd17db14756b", "value": "Ua.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cd70d5-551e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372467, "uuid": "be7e3fab-4196-425f-9737-5af6d375dc2b", "comment": "Malware payload", "value": "e02198e209f9f8bd99c0c75400e77610", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372467, "uuid": "3185512f-aa37-469d-b9fc-4766d2fc14f4", "comment": "Malware payload", "value": "2568e8b5cfb818ed171320d3a5e0bb53f059404891467958539ba13982dac7bd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372467, "uuid": "3bf1a2af-f8e5-4589-a61c-81454e34656d", "comment": "Malware payload", "value": "bd5cd82693e01259a7cf304a75a58d8ff3f7943f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372467, "uuid": "35fc69ba-0dd0-4d41-8283-82f48083add4", "comment": "Malware payload", "value": "1cb1090fd38b2185e3be0fcc9a2669153751cd0f1b6fcbe29571e8a6ea74d29e3068b375993fb608902aacc96077c5f5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372467, "uuid": "d0a4a6e3-fcfb-4468-b7c9-542729bf23c4", "value": "T13E853328F1986D57D2FA3767830952245FFADAD52520A04F0194ED5077FEA3F02B0EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372467, "uuid": "df6e9625-5130-4ead-aed3-90f4cf08eb5d", "value": "49152:SN3WAuXAiBV1MFMA+z+NFtfg+IQfmU4ZdAA5n6nj:s3W9QCPsm+pIPQfwZdAAJcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372467, "uuid": "69eff1f7-482e-443d-96ad-a88a43fafa46", "value": 1808196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372467, "uuid": "e92d7fa6-adaf-4fbb-9db4-f8a368655e59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372467, "uuid": "967bb904-9570-48ed-a5f8-7853b63964ec", "value": "RFQ_818-2024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b03afae-54aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779322526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779322526, "uuid": "0aff81f5-3554-4eeb-87d4-bd60b75a63b8", "comment": "Malware payload", "value": "69c5050366ff5915f17c2c8fbdde8332", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779322526, "uuid": "12e2bc62-16e3-409f-aa58-80aaccba04df", "comment": "Malware payload", "value": "257f942650afbf14f40b45a7ccfee3959d7b59dcf7030ca9a246ad8fa3ca925a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779322526, "uuid": "184e0cf5-51a8-4fd6-ba35-d9204b33c90f", "comment": "Malware payload", "value": "4891c0b401d23599c70d8fc386aeacf2ddaa21fa", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779322526, "uuid": "f82b469e-6685-492e-9add-ee30d2ac5243", "comment": "Malware payload", "value": "306b15f80697bc7d80453f0c94a860dc6c88753c2efe2f95550b9caad7f8e84a53c3a5cb5eabecadd3b3adc35049a87e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779322526, "uuid": "18b5afe9-feb0-43cb-b09e-7c076fc4fbcd", "value": "T1EF517599EC5F3E40D72423E201CF48E4489D17DD7AD399DD231AD0485F8632798E8ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779322526, "uuid": "350fd19f-e87a-41d9-9eb7-25fbbd19aa55", "value": "48:A3q6XuS3H2Oe3jqYzf5xzMYA1r893qNKVywwS2/Lj/iu8xl6/tXqfw19:A/L3H2OeHTzbA1r8qNC2/Cu82/taf29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779322526, "uuid": "6f86721c-0d38-42d3-befc-3364bb66afc1", "value": 2730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779322526, "uuid": "8ab7acc5-49a4-4be8-85ab-45b8d3bbc588", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779322526, "uuid": "1ab50da1-6ea4-466f-9a7f-37e4bacc8a1a", "value": "gmail.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7581803e-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372473, "uuid": "51ccf5ce-3db7-4b1d-8ee7-5931908eceb6", "comment": "Malware payload (Formbook)", "value": "96308856e9097d0f46ff7e6c82548ee0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372473, "uuid": "1a43a2e3-925c-4f83-a255-85a92233bd79", "comment": "Malware payload (Formbook)", "value": "2581198306a6ed0925947d12372b82c22be6bfbc258d625037f7c28c87843803", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372473, "uuid": "699dd929-58ac-4665-9a5e-07fbb5b9f2a4", "comment": "Malware payload (Formbook)", "value": "fbf4624c3eda28e3624752e4b44831859f2fc6a6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372473, "uuid": "f07ca349-3a38-424c-9419-65c337c03d73", "comment": "Malware payload (Formbook)", "value": "8f62c595c12edba16ce00d6479c405950fe70c5c13a670fc7f61ad617c3cb654d66fe035cfafa4740646e65657078fe0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372473, "uuid": "b8a4d931-e2b9-4daf-bc91-22b029c4728f", "value": "T18135336691C3FF22089CD9C53B39126A6771A1286D1FBBCC4DED9B30212F7513D788A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372473, "uuid": "8e2c5e62-527a-4139-86e3-191a10cbf61a", "value": "24576:WzWY0Bca9EnQpJXORlcIwWgDjbxE+cbt2/E23haIUh:g90HEnQjXqlOhE+nbLUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372473, "uuid": "42f62fee-3fd0-4997-b0ca-26477a82f27a", "value": 1071465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372473, "uuid": "82fb5fb4-5a9d-4557-bc41-0cc25d7fe708", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372473, "uuid": "06df0c72-dc80-4f43-bcfe-7b160f87413e", "value": "Hesap_Hareketleri_16072024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22dc04c-5518-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779370025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370025, "uuid": "e710275f-3119-4ff2-aa7d-1beb1646fa09", "comment": "Malware payload", "value": "72dcd99cb1a19f2605af9de513b9230c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370025, "uuid": "d5ef2278-a932-4a00-8f45-3dc06940a998", "comment": "Malware payload", "value": "258f05139061025f142797c4b75e9f71252aef1c018f965b09a4d946bf8b309e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370025, "uuid": "1bf98dcc-197a-41cd-8e1c-f38ffee49178", "comment": "Malware payload", "value": "cf61ab2fe236c32b3f7b7dd80b5f30c9e1c7bee0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370025, "uuid": "96b8cea1-8955-4671-bb72-c8ef6913e487", "comment": "Malware payload", "value": "292e44aa7cb62f0d3b0acd37253028e49446a783ef2670a19bf25e0026d4e34738827aca6582aeb0987732c3a6ed179b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370025, "uuid": "73c5de7f-ac17-4bd8-bc4c-3cf791f21804", "value": "T15541BDCA7AA3D97197C7C4381FDAE501E35624430995A9D8B08EBC303F69520FCB1E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370025, "uuid": "59c79346-34e5-4273-a588-ba38c0e84dd2", "value": "48:rVdxxzGG1eCFeZdzVKN5Q1f/neHuDmmlBFInKIYgQAul4N7vGxQ:ZdnIu2mQlGaL2nKI3QaTGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370025, "uuid": "9b601e78-3734-47d6-a18a-6baf5a006d59", "value": 1967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370025, "uuid": "8da4d0e8-b07a-48e3-9eea-7449a1f3865a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370025, "uuid": "d42b3684-5655-44fd-817f-05c7d555618e", "value": "258f05139061025f142797c4b75e9f71252aef1c018f965b09a4d946bf8b309e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7915e72d-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372479, "uuid": "4c651245-e675-48ae-a463-bdc7b7070af5", "comment": "Malware payload (StrelaStealer)", "value": "e6759078328729f34d55c3bc6cb1ead0", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372479, "uuid": "ad8aff84-a1bc-4fe5-b6f8-8faf3d26758a", "comment": "Malware payload (StrelaStealer)", "value": "259395842b4545997d1489f9bfe60422057f3f81f195938ccda22b001a2ce049", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372479, "uuid": "756d5c9f-71df-4736-ba82-89a431dad469", "comment": "Malware payload (StrelaStealer)", "value": "860012d7084f59fe4973a775123ebcb7e1fc9bed", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372479, "uuid": "2e957fa3-9d12-4921-844d-fceb72a11dae", "comment": "Malware payload (StrelaStealer)", "value": "16f63adc16a3b54874db6cd34ca82af3a707ce236cdb884692c7013cc935b6bd9ec3fd942b5740fe36f2e6a22554465a", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372479, "uuid": "7767aea5-c0a2-4e81-8387-fce747f82cff", "value": "T18831292BBECA3C0CD33F8D3475404C7A802F95D74861BA27FD34E2E0E5D0D45416A88A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372479, "uuid": "aeb72d14-6fe7-4637-a8f3-2e2ce3328513", "value": "48:9vGbCDayF9dV/l93ol4deH7mC9X5gB8pQK9LWF6veYWWSzNOyq:wbCZL/PVdeF1udK9YM1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372479, "uuid": "aa2afaf9-6419-4f09-987e-d7d5d94e738a", "value": 1807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372479, "uuid": "0a31a7ac-5f59-419b-a30d-71dd3273c294", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372479, "uuid": "29e9c73a-0bf2-4b0d-b769-cc75c551e01b", "value": "7731002231.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9a8194-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370604, "uuid": "a16c688a-d541-4b75-833d-baa464aadacb", "comment": "Malware payload (StrelaStealer)", "value": "c739eb39e437501d23f5ec5b9b698af6", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370604, "uuid": "769e0aad-5bfa-49ee-a36e-6059b6cc465b", "comment": "Malware payload (StrelaStealer)", "value": "25ac598d6cca2e36dda9afa75b0a36bd996bba5dc490d90a769bb49f52e16d29", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370604, "uuid": "df127f7b-4425-49c1-80be-46b2aa973c3b", "comment": "Malware payload (StrelaStealer)", "value": "b90f928eefc5b9db551430ddddacad55dff60bff", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370604, "uuid": "27460e1e-a1ec-46f3-a505-4d323b4f1d8e", "comment": "Malware payload (StrelaStealer)", "value": "f9ff09775f53730df36bc6c56a1b17a3c952fe3faa6643c57c310827b7a05e7cad6106aaad8a718d58bcdcf5e7df257c", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370604, "uuid": "aaa79241-e080-4934-8828-3c488bd9467c", "value": "T17B31CA7077432495EB2CE5B8790195AF674C2D98F11871470C1587B97A5D4051155C9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370604, "uuid": "d11292b8-6e8e-4d28-a8ec-626b2910752e", "value": "48:9jdQK5944/uraFZG0jBI5V+z4ejX1uF67:RdQi944Xw0ezY1CW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370604, "uuid": "912c82e7-acb4-48e1-9c2b-426590b6438c", "value": 1635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370604, "uuid": "f13a7580-6a35-41e8-840d-add0523415ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370604, "uuid": "094f583c-ba34-4756-b066-7ce93847af25", "value": "RE_2024-1043.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d92c49f-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370607, "uuid": "bb26ed51-513b-465b-9c74-60c6ea245215", "comment": "Malware payload (StrelaStealer)", "value": "1066143159f465acfe6a008e67d5a084", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370607, "uuid": "38f5d36c-d0f9-4f90-bda0-1681cc71da63", "comment": "Malware payload (StrelaStealer)", "value": "25b576b755738447b7904ca25d337a9cdfd299e8cfa6f3316d03da55a56cff1b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370607, "uuid": "417923ff-c6fb-4f43-84da-c13ed0b58426", "comment": "Malware payload (StrelaStealer)", "value": "b31ef39bb4dcc1ee7d13b55ce49379bba4d2d279", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370607, "uuid": "bd199ccc-d21b-4af4-aafa-cfcab3485a99", "comment": "Malware payload (StrelaStealer)", "value": "870034519027178972a2a5e5d2cc879124a45b767695c39653a5a20890b2e20ab0eafaf0a8de99a3620fc4349eb48585", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370607, "uuid": "d72d9d91-271e-42d4-b426-72c14d502d11", "value": "T11C328E228618993B0CD6A8FDA48C938FD6110B856B8165F1E94EC441DBD3E4D07DBAFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370607, "uuid": "0f7faddd-6e01-41c4-aacd-b688b346330b", "value": "192:0oFCNOFCQg2n2L8MiGQbzN8/2Ls8MiGQbzN8O527NR31G:jFCNOFCQg2n2L8MA8/2o8MA8OGNRlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370607, "uuid": "64984ddd-aa99-4a5e-9811-5918c6731789", "value": 11656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370607, "uuid": "79d0ab2b-db4a-4dad-acd9-ac39eae4214e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370607, "uuid": "f56a6857-4a49-4c22-893e-6482fe88e76e", "value": "2509126074683225040.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b28d6b7-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372482, "uuid": "3fc4455c-331a-4e79-adfd-191ba5b71ee4", "comment": "Malware payload (Formbook)", "value": "7c729bb5fed61a3233c663818289c090", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372482, "uuid": "a0c6a636-cff5-44a4-8458-4b42e0f35da1", "comment": "Malware payload (Formbook)", "value": "25e6e577528339139e36344653b892bf5de21ec1968fbf9966080eac65986cf6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372482, "uuid": "95eefea9-3fb4-4e36-9945-149f928b332f", "comment": "Malware payload (Formbook)", "value": "5d8a0539c58576bc14aaad706689baeed076b463", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372482, "uuid": "0e503caa-6c93-42a3-942c-807db65c21a2", "comment": "Malware payload (Formbook)", "value": "c4a5b5d6bde41a69c16f97a4cf5389489f6ce020853617629af0c8e90beb3e8aad9255a677905428eb29e787535a83bd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372482, "uuid": "17763bfd-4ec4-4cee-8405-b65d53696335", "value": "T159E423609D8C90B3708F2F4585B3449750F5379BBCF6667C90A2EB9BEF836C24146B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372482, "uuid": "b8a0c046-08de-4615-99a0-f60a3cd61c21", "value": "12288:DWCDJWGQ+Rx4ved1mqu187M4RJ3q9UVjLTPpb6fyH4hipcg0UGe1yykMkX9mDr:KCDJLbT4vRqu1FByfPPYhipSe1yyc9mH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372482, "uuid": "65f0c88b-f32a-4e3b-af6f-614bf297403b", "value": 697812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372482, "uuid": "99520280-9db6-4e9f-98e8-e1adfed6ab44", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372482, "uuid": "a74ddc77-f837-4c04-861b-0ca4733c56fe", "value": "RE_GOVT_OF_SHARJAH__UNIVERSITY_OF_SHARJAH_-_Project_0238.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f93e120-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370611, "uuid": "7c8d60ee-35d0-4dee-a756-c91686ee6ae2", "comment": "Malware payload (StrelaStealer)", "value": "7edfeb23950cee964d0828986b1f453d", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370611, "uuid": "75d34fd7-51b9-4590-998b-4f77b6b002cb", "comment": "Malware payload (StrelaStealer)", "value": "2604589e733dbd4ea6e04db4183092e598e1bf31e394d06ebf69c66c1ac93883", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370611, "uuid": "a2aeb2e1-57ce-4164-b1c2-9b72f3abbffe", "comment": "Malware payload (StrelaStealer)", "value": "393ba41e4bde8aaa2969a85c22dbc3c6da554aab", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370611, "uuid": "c290e7e0-25d3-4ab3-b398-39c0c4fe8d78", "comment": "Malware payload (StrelaStealer)", "value": "c40f29681906c0d13ad0c48a6fadafb37a87a8a897378c61faa88b8491ebbbd88226664e14048304d0df0ff133553675", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370611, "uuid": "58829f0e-6ae9-461e-83b9-34b40d3ab426", "value": "T17D3413324747407EDDFFB8EB2A58A794D0FBAF3739940CB05284CB58754ED85A5B8A20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370611, "uuid": "281da514-23d5-4290-b5f2-5ed7ed1e56c0", "value": "6144:y/fhk3O74j1KA4XrEpe7Po5o/MQ0xkKKKKKHs3NTTuQTxRdOYB2:iKe7bXbEQ7Po5ot8ERxd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370611, "uuid": "09e82bfe-db02-4c97-b71b-fbc4180212a7", "value": 247801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370611, "uuid": "8e5dc6c5-9d56-4ef9-848c-089ff6ab1926", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370611, "uuid": "cfc5b4ae-34e5-42ad-af9f-71507452adf5", "value": "382424_(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d260a5d-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372486, "uuid": "4bf9580a-8238-4cb4-89dd-f1aef1301131", "comment": "Malware payload (AgentTesla)", "value": "48ee34d8083b53a59fec54cab4d22b8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372486, "uuid": "700fe615-2862-412e-9565-902ba45edd0f", "comment": "Malware payload (AgentTesla)", "value": "261f17368a1a16ac2a4c8dced38a5cf2067c6aee0e385f2571780c8ed20090d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372486, "uuid": "184a5e20-564a-4e1f-b13e-b540c46400c3", "comment": "Malware payload (AgentTesla)", "value": "6bdeebefa0a78649323653e84b1313c53581ef2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372486, "uuid": "158b8021-1d47-425f-9743-03d665079c78", "comment": "Malware payload (AgentTesla)", "value": "a70ae5bf1c84977b9bc47552d667a16cece57d3c78179ae0ee6b9ddf4d0872e4f3c3de12789e182f780c74c8ebaaaab8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372486, "uuid": "8f87f6f5-e8b1-4f90-8326-47e6d46d26b9", "value": "T1C8F4238D5227BC49E9845C3CB9748FEE3340C4BEBB50E664866266A56CFAC61DDF01CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372486, "uuid": "421542c1-cf28-4a80-9ec4-7328d44827f1", "value": "12288:ZkeQmGbxOM8YITXhtOojYvSoroAULtncyPh1+RqEDGqnE0KgwbslyLBHjG3/mMk3:rQmGbxOnCJvvr8tcy51+k0znE0K5glwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372486, "uuid": "1fa34f35-4767-43e3-a0ec-4859ba3a9d2a", "value": 733999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372486, "uuid": "f32a13b3-adc6-4f6f-bf5c-7b720a74b0e1", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372486, "uuid": "de77757c-e888-4f22-bd09-c1f5e5f80cb4", "value": "PO#86637_copy.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21acfa5b-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370614, "uuid": "b46c4dec-cd0c-4edc-8ced-11cedcbaf355", "comment": "Malware payload (StrelaStealer)", "value": "3bbf37ba9fc9076ff84c6322de29e847", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370614, "uuid": "33db5585-4039-469c-b741-3376ba106f75", "comment": "Malware payload (StrelaStealer)", "value": "26666aa20903faa5a1c72b35c4207121fd3e924ad8eecb5d25dbd4cd3b3b8694", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370614, "uuid": "b657b279-4a88-42c7-932c-8b518052b2d2", "comment": "Malware payload (StrelaStealer)", "value": "641dc2bae5265407732929422c1c07428243db1b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370614, "uuid": "b3daeea2-bf9e-4a50-8114-6aa356875658", "comment": "Malware payload (StrelaStealer)", "value": "31bbd0f65950aa21a43426a3053d8b4ca9add33b829948bb8126cc516638aca3e9b9545ed7b546a35793307e96a1eaaa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370614, "uuid": "feff58d6-b2e9-4ec3-8b17-aba35d67a351", "value": "T19055C7EAD2B17598B5FE58C2213B1A6C7A8F79661F00DC3C99F538705628FF02376864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370614, "uuid": "984788ff-8bb0-45d5-bd0b-73c00e3a455d", "value": "6144:OQoTs5EBgjNfLoznYjYsKA0f9I1onfWHfnfqBPToKwAoECoTMVQwAoECoTM+n78l:OQoTs55fL4Yjc/cNKBoLorBoLoSmS2i7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370614, "uuid": "ab0c6e87-778f-4a69-a7cc-0a0f053a3b5c", "value": 1283894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370614, "uuid": "8aef7ce4-334a-48de-acd5-587597659e2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370614, "uuid": "a431522c-cd74-4f10-8088-8109fb6db636", "value": "393214924199898922.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25633a04-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779370620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370620, "uuid": "d58243d2-246a-45f0-8265-92caa1045910", "comment": "Malware payload (GuLoader)", "value": "e157f42eee8e9515468a12d449a514fa", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370620, "uuid": "cac92470-f5f9-4202-be41-fea4a8f4e3b6", "comment": "Malware payload (GuLoader)", "value": "26a28dac52985b93c1d6d962cf819c1efec38768d67cf18c12e27326f0c440dc", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370620, "uuid": "b447b489-327b-48e3-b0ae-cacc0dd0acaa", "comment": "Malware payload (GuLoader)", "value": "0a0a00e2f8a6c4deb153885e7147c2444c98d793", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370620, "uuid": "43b2683a-6da8-48e0-b69d-3686420a2ae9", "comment": "Malware payload (GuLoader)", "value": "980f1fcecbd99b7b073132d1ffb2fa05f8868ca19d1302ed5c16c4725d16dcb41bfaf8a1ad057425f66671c127ea35dd", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370620, "uuid": "ab281d2d-af71-4443-9214-f28091bf5fa1", "value": "T124552301DA90A131CC224572A95E12BD5FBDF82159809663336C3FAEFB3BA8777B4744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370620, "uuid": "387c3f67-36c2-4520-b4b3-95971527928b", "value": "24576:dbDc7+iLqgCBLqNATwJe9YESd4+/dD+l:dbDceDLOSBdSd4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370620, "uuid": "39bc4ba3-1c33-4490-a180-0ef99c66f712", "value": 1398784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370620, "uuid": "1761762d-6e41-4aad-a11b-60d3075f355d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370620, "uuid": "a08e8872-4baf-4c5c-b727-07efb0d62e2d", "value": "FacturaXHonorariosXX2024-11-04.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a43f27-551e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372492, "uuid": "18b999bc-6d3a-48d7-9045-dd844ec0f12a", "comment": "Malware payload", "value": "b8e45076ab46a7333f39e8941dba1206", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372492, "uuid": "dba22e60-14d0-4445-a764-1cba9120de25", "comment": "Malware payload", "value": "26a8df25759a15a511c4533146d1cb5e4905358c51a28526a72c284667723f16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372492, "uuid": "9b55b40a-0539-4a06-9fe9-904872f8e61d", "comment": "Malware payload", "value": "e71140220e983bacc650ef0ad906303cc77c8bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372492, "uuid": "0983e443-2c21-4986-81a6-2295ee713fc1", "comment": "Malware payload", "value": "9dfdf4096f49789cb81e9997d64bf6e762323536f2e4ed5a059b15cde473a108850f35331f2bee6f33523cca14926e16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372492, "uuid": "88ddf15a-8ed0-4283-a71e-c758b1c4fd8a", "value": "T121C33B209FDCCA6AE7ED1779E8B107058B79E986B457FB5B454420FE2C13780AC207A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372492, "uuid": "46a6ca14-0f36-4e63-95c9-94de09b20d14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372492, "uuid": "83fa6dd4-108f-49bd-a40b-cc4b6aeacb89", "value": "3072:kRe1KeaqiV0SKnFW31M9GhPjo9JjNNL4wd94:cexaqiV0SKng316T194", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372492, "uuid": "0347ac4b-145a-4a58-a306-1540fbfcc248", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372492, "uuid": "e8c0b874-e9cb-48bb-8324-a2423a48dfbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372492, "uuid": "c3ae7129-9f77-4bd8-9bc6-3137f7512aff", "value": "Product_&_Drawings.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d2573f-5526-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779376067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376067, "uuid": "9928604e-917a-4834-b517-6615a4ba66b0", "comment": "Malware payload", "value": "2c3f58efb055605f0f1b821aac8ee31d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376067, "uuid": "21bcd9b6-400d-433a-8753-581bdf53247e", "comment": "Malware payload", "value": "26afa8d11ece77de51b54648010198884238cbddd4230cf9008903e2d4f1352f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376067, "uuid": "45ee9eed-5e72-4bce-9773-eb3be5c51381", "comment": "Malware payload", "value": "af71e207c0ff77d479d3536edb7032bf7560d49a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376067, "uuid": "4add8447-9044-44c4-87d2-d0cf09e0c4fd", "comment": "Malware payload", "value": "7b52d7aacbab2f7ab9c82857449ecb3a768c4de9cebe4a23253459c80cf82a9b8c3d8f97902a3d879e0b4e7a7e4a3ef4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779376067, "uuid": "f9046d22-10ce-487e-893e-35f3b4e4542f", "value": "T1E2F06200681080987222F7CC9824B35EC2B1BAEAFA03E8EE8000C784BC286411AD893F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779376067, "uuid": "f05a15d5-b571-4915-b06c-066a0f6bd5dc", "value": "12:YUrRGK1vZrgLqqkaiUkfYVK1HXvQkxpXblNWdh1kf:Y0kK1kiNSKQkPlU0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779376067, "uuid": "fd1495df-d7cb-4080-b765-08712ee01153", "value": 612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779376067, "uuid": "1ef8e7ff-022e-4774-a08b-e80c046e8ad1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779376067, "uuid": "a5869231-eda4-4d28-bf7b-da31bcd606c9", "value": "26afa8d11ece77de51b54648010198884238cbddd4230cf9008903e2d4f1352f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a46cae-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372495, "uuid": "0b4d7b7e-1c52-49b5-828c-058b7058cfdd", "comment": "Malware payload (StrelaStealer)", "value": "ea7407fa618dc1d70d5c149d6d0f626d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372495, "uuid": "3b743375-e149-4188-804d-17fbc33f7fd2", "comment": "Malware payload (StrelaStealer)", "value": "271049e4b43bfd2bf14abb8f87df702b34b77fafb7e292ec5fb7718d9e75e5cf", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372495, "uuid": "2bec47d6-538d-4d79-b3f0-9d73ec15784d", "comment": "Malware payload (StrelaStealer)", "value": "ac8736b6bf836418ef2f174a5d9a7c1c37b5ffd0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372495, "uuid": "69105a35-91b2-4699-9eb9-64c19d378522", "comment": "Malware payload (StrelaStealer)", "value": "168020baf242acc792ea7954eaba07955c148c933926e366783a7af21ae543ac4f1018f495c0d70b3df001621a0fb5e9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372495, "uuid": "fb252c7f-981f-412b-a44b-364aaac7ebbd", "value": "T1F051FEFF78750B1F346A4645EEDCE9D9A0C28DF9B155D19C406701A2C13806E42BBE2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372495, "uuid": "4ca8362d-a14c-427d-9b9e-48ff126a666b", "value": "96:Tvpje3kjmBvQvwN1OjsgF3wA3vNF3wMXBNq/iH:Tv87QIN4jVwAvnwMC6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372495, "uuid": "9fc5a346-5200-4e13-a633-1b0124d9d4ee", "value": 3082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372495, "uuid": "264718b3-9ee0-4670-8e82-bafef482e818", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372495, "uuid": "4561b298-87f8-4e3a-bb01-1865ae93d61f", "value": "872523563412618419.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e6a502-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370626, "uuid": "6576f078-e24e-4cec-baa7-25e453dd4e3b", "comment": "Malware payload (StrelaStealer)", "value": "06a5e2e103f602facf08e5347e56cb15", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370626, "uuid": "14a4ecc9-4141-4f8b-8587-821c6dd00559", "comment": "Malware payload (StrelaStealer)", "value": "2793165ae90a237f88d118795564056baf7fcd29c528eb00073b0b7c54976d93", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370626, "uuid": "a8f49a80-98bb-428f-95a8-b0501fa221be", "comment": "Malware payload (StrelaStealer)", "value": "ddf1e71c3ad321586ea95d78e69caf7142ff8210", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370626, "uuid": "57c7fdaf-e4f7-44b1-96a3-1172d2f8387b", "comment": "Malware payload (StrelaStealer)", "value": "03f272cdf2de8f3a48a98b7b59168495530be0313ec327d58ac22b111f47cefb8978931222b073078b49bf4a8d35cdc8", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370626, "uuid": "da28edaa-4efd-4f4e-a498-047221128949", "value": "T19B917EE1C4E46AE5C07D3AF25E948B2D57F63B1B9B984A1180B6D4E7BFD41D94359000", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370626, "uuid": "712ce1dd-71bb-49dc-9512-89aa6dde72a7", "value": "96:ZHneQt62VmyVfNvQIUJNU6v6uXzIH3pQDnGqujkF7z:RZ62VlnUJ/7jIZQDGqujkFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370626, "uuid": "ebcfc6b8-4913-4d3a-9412-adc9e6b270f6", "value": 4511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370626, "uuid": "f0d906f4-d3f1-4a7d-97cf-3b55e01b7c2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370626, "uuid": "12e910bd-14b2-4f32-b406-4336660e3878", "value": "R24377.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afec336-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370630, "uuid": "95cc6b90-322b-41cc-8aa9-813cd74bf3f3", "comment": "Malware payload (StrelaStealer)", "value": "5037db5f8409e0c548c06a7153bf2933", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370630, "uuid": "5e7610b4-4167-42a8-b702-b5811dc236ea", "comment": "Malware payload (StrelaStealer)", "value": "27e35f3c0ef769b366b545186e8dc959273fdda68839e3fa3ed99a02b3fa4b55", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370630, "uuid": "6adae12d-adad-4c29-af12-ca34f1f96c66", "comment": "Malware payload (StrelaStealer)", "value": "0e2039f21ee9bf6b29b582b5caf7f50b36ac3c64", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370630, "uuid": "bbf00694-87eb-44ae-bc72-d32038975a0a", "comment": "Malware payload (StrelaStealer)", "value": "3229b60de12be8b271648cd2188f77f081c41e17249dbe58742ac8211e5df388964737bf2a62bbafee08355a6779fc5e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370630, "uuid": "bfa9f91b-90df-475a-b98a-19f920e0a596", "value": "T178857D00E51F0FDFBF1C3B8A598C99E748AE99717E36F4B2D10B150ED478E4A699043A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370630, "uuid": "1a9b98df-bcf7-45e2-898a-da3c92d5da58", "value": "12288:cFucJpSVocoxj/DXStV3yUMUFmnro4v1nw3eld7iVVPRI3jmsEK3Yx7xPKuNxmcT:DWpyx7VXKKP2YN1OQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370630, "uuid": "d75f3245-2fb4-4fb4-8854-ef8ed68fd2c7", "value": 1787048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370630, "uuid": "11c95bfb-ec57-4e8d-af7d-330e338d150e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370630, "uuid": "2b2536d3-90b7-4df9-89ba-165182a6d31e", "value": "52337241538421809.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ad249b-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372498, "uuid": "8e46ef7d-e828-4119-80e3-9205acaea19a", "comment": "Malware payload (StrelaStealer)", "value": "de0961745020de04a82258cbf54cd66c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372498, "uuid": "a2c4046a-a96f-477c-94d7-df9bb070f9b5", "comment": "Malware payload (StrelaStealer)", "value": "28481e3fb106d125e1e71ca8821bca98eff87d8c0294c01a91d2e27401f7c0ba", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372498, "uuid": "ee817d35-413b-4e2e-b78c-4a30933260ea", "comment": "Malware payload (StrelaStealer)", "value": "abe40dcf547b5c8c764e605544e95119eea205b7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372498, "uuid": "cf2c9fab-8789-40b1-bcfe-880e52b1b660", "comment": "Malware payload (StrelaStealer)", "value": "0479112d72591102df55b98cfaff9359e3e424188d67d5e9e257368afcdb6e2aabc0e8a78d0ab04d2c684107eb7ecfa4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372498, "uuid": "96e1d04f-55a2-4ff8-83e5-9b3d8be64d23", "value": "T1C5323B6AB9A212072DDB0387E04156D1EA68D0728716F37CE4EE917EA54740C527F73F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372498, "uuid": "9c88dcf9-0ace-4484-b107-8e5dc869d8d2", "value": "192:SSmkHHdFpZd5+31KvvPlrxKqk00k00wIDbO6U:zmknTj62QP00k00wIDxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372498, "uuid": "7f63ddf3-ff13-4841-a0e6-93bc3f2a1c64", "value": 11492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372498, "uuid": "e80dc26f-4caf-440f-ac2c-85faf35a8516", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372498, "uuid": "ff55a276-e7c0-483f-8eee-afaa2bd5d400", "value": "2314330640230814721.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0ed6a3-54f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779353690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353690, "uuid": "204692b8-ab9d-46ec-bf1e-d57b34b1bb88", "comment": "Malware payload", "value": "f99f1fd23427e34bc148cef041ee6b54", "object_relation": "md5", "Tag": [ { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353690, "uuid": "42a0dd70-f1af-4dcd-aa25-6975ae047b6b", "comment": "Malware payload", "value": "2858eea059aea9789fb32ec31c284c54030114649f29daf78a2a1bd6516092b5", "object_relation": "sha256", "Tag": [ { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353690, "uuid": "88bd1f6d-eed2-4ca5-af03-c8f224e96ba1", "comment": "Malware payload", "value": "ea29e53092b54fa3b3fdfbaee13f656ae6015eae", "object_relation": "sha1", "Tag": [ { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353690, "uuid": "8faf8171-c9a0-40d5-a35e-768493ffe250", "comment": "Malware payload", "value": "27ca5dd69ad98b5fe358f70ea411863161ae8b68fb835ccaf27584dcfbdf96999c8f9646805f92474560b9ce47a475dd", "object_relation": "sha3-384", "Tag": [ { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353690, "uuid": "fec7fc5c-7e07-429d-b757-095705a0c1d4", "value": "T1F9F0D420D74A523BD9122775C0254F77431482D490174BCF158874CE79FE5E73D3466B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353690, "uuid": "ef453712-36f4-4e67-b2b4-b1ad8f5ad577", "value": "12:5j0IaL2oLg2rcBKEP929usSqJJKFiO3Yyo8aWjta0:90fLPLRoBtE9usSqKhYjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779353690, "uuid": "3248b07f-5fa3-4eb4-a123-5368b64f663a", "value": 481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779353690, "uuid": "67c7c65a-3b19-4608-8de7-766b8c258045", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353690, "uuid": "8963ab5d-df80-4a79-83a5-64e86d895518", "value": "NotepadPlusPlus.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d067452-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370633, "uuid": "1b0506a9-f8e9-4f22-8e12-35180a7240de", "comment": "Malware payload (Formbook)", "value": "68e44596962e8ab6e9f69f7750eaf8ae", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370633, "uuid": "6d5f55ca-fd0f-4902-8e75-c43f0ab6fc3f", "comment": "Malware payload (Formbook)", "value": "285f1da1080c2d080ba05cb72b4d88816463e307283718500380a45171c3310c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370633, "uuid": "f0f5016b-b80e-40ca-8ca6-91b8a19adc6f", "comment": "Malware payload (Formbook)", "value": "7fbe0a9267c59053c6374f135179cce94fe0a496", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370633, "uuid": "ea62d36b-d556-456b-889d-9f5d22cec9e8", "comment": "Malware payload (Formbook)", "value": "8378d9fba12f7c3e3ba5b63d0673b62a5cb58ef067fe0592f5d61afb7a1e5fede485e8ba262e7a7e7e5e5232348cbde9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370633, "uuid": "a74bae15-354f-4ece-b5d4-d8534a300881", "value": "T110E4336C49AAE5E3DBBEEE2B1C2103E995F01D731B1B732EB48C207D9DF2254119C54A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370633, "uuid": "2f4dea43-604b-4fb1-8903-755378e6595b", "value": "12288:u63MYGpDzcg/2l05+oe7vLNCZJ0Ic6T/yELG2H81U6YD8GbKN7Ls4KF5e0Y7igQw:u61A4Hw+drLNu0Ic6TaE62HS9X1ATL2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370633, "uuid": "9e105108-0bf5-4633-b7d1-e11b12b6dcd2", "value": 702334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370633, "uuid": "3edc0dbd-c432-47c7-b650-77fcd0d30c5b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370633, "uuid": "acde0d99-a614-4c47-90db-4a789ed5668f", "value": "Quotation.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88484998-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372504, "uuid": "24a542a2-e6a6-49ef-8c0f-ccc85063e176", "comment": "Malware payload (Formbook)", "value": "1dc7243a7fa16c6d1fd883eb72a8a97c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372504, "uuid": "d4194572-bdc1-40b1-8a2e-04cf3939d74e", "comment": "Malware payload (Formbook)", "value": "288810717d4686df7187a42b54578e82671a5ccf9e7b9172160dcce30998897c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372504, "uuid": "9db27fa6-e89a-4b59-977d-34561ed8192e", "comment": "Malware payload (Formbook)", "value": "2a52dfa1c3b16e8b6836b3d78e4cae469ebd745d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372504, "uuid": "a71d694f-fefa-4aa9-a05f-7046a2883ce7", "comment": "Malware payload (Formbook)", "value": "9ff94b7a80bad3331e940dbb2d1340ca71924de5be43920977d4f07f9cd1fdb1204133a5a9960168f15a97a6469f21ad", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372504, "uuid": "53227ffd-348e-4d4e-a12d-ec6d6f97ace3", "value": "T1A50533C1A769299B2F8BE7751B40E44D3FBF41744F0E9374B89DA802B090A7662B51CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372504, "uuid": "80d259e6-1103-4294-8970-6238e3071a8e", "value": "24576:GdyNcC6kc3Dn2IZfrYQUdhvAtAA2nGyush643r0uS:Q9C6H3DZB8hvsouc66y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372504, "uuid": "8b96770f-9468-46f0-8876-08debec4cc00", "value": 848508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372504, "uuid": "87ecda21-4166-4f41-bf5c-64ed5c9acc00", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372504, "uuid": "570f188c-81af-47ec-b81d-ddc4fb0f7abd", "value": "QUOTATION.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786d136e-54e6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779348426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779348426, "uuid": "4b79fafd-437d-4923-8f8a-9f0ebb51d275", "comment": "Malware payload (Mirai)", "value": "71db43e536cdb1bf1a39dd9b7c696a85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779348426, "uuid": "8f0e31e0-3aa5-4680-98d8-bde96c1e5a46", "comment": "Malware payload (Mirai)", "value": "29250c2ade1e479452c41d664878a9870a658af6014acde565c86e50b44d5cb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779348426, "uuid": "3936653f-a328-4aa5-8248-578fb549dfb2", "comment": "Malware payload (Mirai)", "value": "f9f1fab78d1267cbf260f5e245c3bf0e9cdd107c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779348426, "uuid": "58100b31-eb7f-4bc1-836f-2edacabd58cd", "comment": "Malware payload (Mirai)", "value": "4711632a0dc501ec0e685e0bfc82c1de38662f4731cf1b44951b01e9c00c01d933254d30b4847e018c4cb003b0603301", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779348426, "uuid": "d1aa5aa8-5750-4d68-b9ca-23a2e77cd345", "value": "T172B33B41BD418A13C5C21BBAF7DF47983B26B668D7DB3302AA187FB42F4768D1E1A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779348426, "uuid": "3dd7155a-c5ca-47bb-982a-25ec1caa438d", "value": "3072:OfsilIQXJAB8RiuymjJmk0O683mFRzf4MQ8Bs0Z+x:cpJAAiRmlmk16Zzf4MQ8Bs0Z+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779348426, "uuid": "71abc7f6-adc8-49eb-b06a-493af7c3b052", "value": 115150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779348426, "uuid": "2f5d70ce-9aca-403b-baa6-b88ca10943d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779348426, "uuid": "348ea309-8b83-4033-ab5c-9e91853e45d3", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9097d178-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372518, "uuid": "391ab3f0-09d3-4ad9-815b-ee8f3fe122c0", "comment": "Malware payload (SnakeKeylogger)", "value": "3bacb934b7b94e7c33c12a796e3cb694", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372518, "uuid": "565057eb-35bf-4739-8d54-46b00312dde2", "comment": "Malware payload (SnakeKeylogger)", "value": "29946d471d2f4cbbbd832d7b512251e1f7b06db4307adfb96a5fcf63a66f756f", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372518, "uuid": "a1e520d3-ec53-45d9-a910-2c47d0672711", "comment": "Malware payload (SnakeKeylogger)", "value": "cc5a77ab06c317e21d2dda4b5ae591a1e35508e8", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372518, "uuid": "36417a9d-7f55-4119-81d4-6dc05e53a3e7", "comment": "Malware payload (SnakeKeylogger)", "value": "cc86a1176c18ee9e8a6b57a021d7506ecd975849b01a0ec47340e6c495168a8e4eb564084c9a6e2f0e17260f738ece27", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372518, "uuid": "3f612e29-d282-435d-949b-d83ef815cc87", "value": "T1C2D43388231B5E83F34BAAD71BA42736C4C47CA2CC2E5B38F41D813DB15A9B0579E479", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372518, "uuid": "c84e6d79-c68d-4f14-8f2b-89e7313f5f88", "value": "12288:sbumHT8Wn0+kdN5Iwy8SZ0lgzWpF8v9ebGo42xsJkC1sEVYMZS0T+U:sbT851LCmluWgvCdsVyExaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372518, "uuid": "a74e22e7-aadc-4410-8117-d6d2607ce41f", "value": 616187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372518, "uuid": "873b43d9-c7ef-40e5-8547-be596b2a8f44", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372518, "uuid": "9cfaf93c-d49a-4fab-91d8-135a8fd9baed", "value": "BankXDraftXCustomerXRefX1001809X.TAR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feac5b66-5529-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779377427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377427, "uuid": "3c8e8ad9-cb01-4362-b1c5-d058efb92a12", "comment": "Malware payload", "value": "8173a6c19be3b9a3de9df95cb3f76036", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377427, "uuid": "e66c712f-eb8e-4109-934a-aa24eb668d7d", "comment": "Malware payload", "value": "299d637461aec046a26d4a66553fb8da1e08173e178944818b4e21a2b478c00a", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377427, "uuid": "9a384c0f-cd12-4f9f-9b80-76153603bf8c", "comment": "Malware payload", "value": "6cb85321a35590ac526051e0aab1ba357b46689b", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377427, "uuid": "3ed2e9d2-aedb-4ec2-82dc-8bb5530cf23e", "comment": "Malware payload", "value": "0b8c15d235064b5aff5647dd0f7d653897f28981aef101888ed6e72c8db5e2f62e8e2b3e6fabda1e1a5f90e7845d2612", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377427, "uuid": "5531e652-0e0e-41ab-b960-798436cb7e48", "value": "T19E07D321C5733DC9EA63A1FFA1B91FC48040B4E0A418EE6E73787BF55A9031A31B6957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377427, "uuid": "6b60d8d3-8436-4657-97c2-50bdefe79e87", "value": "393216:7LccgIojOwG1yEmEl1QQpqpmEgVOy3wCbpWyFNzX17I:cchoKwGPm81D+gViMzF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779377427, "uuid": "f0430805-ec45-43ad-95d2-4a7354761017", "value": 16793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779377427, "uuid": "8bb36dd6-1f74-4fe0-8766-bd0101f55efd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377427, "uuid": "bedecc0c-4c91-403e-bc15-ef3367d5407b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93690d7-5512-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779367513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367513, "uuid": "710bcb0a-54f0-4a48-8069-0d83cddce880", "comment": "Malware payload (AgentTesla)", "value": "dcdc2aa1b55e854e8f2efcfec699878b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367513, "uuid": "d55b062a-bca3-4201-91e7-4c396b319ca6", "comment": "Malware payload (AgentTesla)", "value": "29a3064ba89d610a2d583f0425c20cec9ae10e6ea5e8db3c6b2d7938c11ba771", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367513, "uuid": "a2639bf6-9dd7-4c8f-b3e9-ab7725e7b86d", "comment": "Malware payload (AgentTesla)", "value": "31745458f45ded700a3a7e23ecdaaf4cb695e364", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367513, "uuid": "38374d91-20c4-4c9e-8c77-c415d4565478", "comment": "Malware payload (AgentTesla)", "value": "e5b86139c4b770451fc6c3e87d637bd39a6fd3e4f2aa3b9c3b702ad664ad8c44e0b91af22e8672ad922bec88b1bb5efe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367513, "uuid": "82c2c78c-70c0-4e5e-84f1-8fe672c8d9db", "value": "T11B74234C60A8BE63459D2EBC1FE778192DDD7728FB6927D0C01160E670A35EAC167CE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367513, "uuid": "d987acf5-9584-4fac-b086-a5f17288c091", "value": "6144:NXnrg5lE7TSQS5TFTNjKtopn3lku4zUEhp6L/1DXwuzKcDdJcLpywY6z:xrXTSrKi9lEhG/1XT75Xwzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367513, "uuid": "3cc80c9b-1042-46ef-ba21-66ab4b69e83e", "value": 344662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367513, "uuid": "84162524-945e-4c64-8ca3-c5868db727f2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367513, "uuid": "d601e7ef-b9f1-428f-a232-822c3eb0f0e6", "value": "29a3064ba89d610a2d583f0425c20cec9ae10e6ea5e8db3c6b2d7938c11ba771.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9421d6ba-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372524, "uuid": "aae3833a-abe1-4bdc-a009-3525db181699", "comment": "Malware payload (SnakeKeylogger)", "value": "cce1702ceaf971b1c26623ec83c711fb", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372524, "uuid": "1f25be22-5759-4be5-96c6-484291863983", "comment": "Malware payload (SnakeKeylogger)", "value": "29c2ac40db1c1e38b7093b790c8efb2e1fe0fb9e0f0e2b23a83d97e33b5cdafa", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372524, "uuid": "80a76c05-979e-482f-a275-a845b210380a", "comment": "Malware payload (SnakeKeylogger)", "value": "f747cb1f094fcd96b6391d58a348c219d0d70963", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372524, "uuid": "54880f36-33c4-4997-8c2a-014055ea0413", "comment": "Malware payload (SnakeKeylogger)", "value": "6ed022ab5c596f5f26d4ffaec123d5409605a5230111f13e73b464da4eca7c37698589faa5baef25b020a569a8c41de1", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372524, "uuid": "311294db-a4e6-40ff-bc4b-6e60a41797f1", "value": "T147D423A301DC54FEBC65BA2533CDD7109DBF6C1F9C92A6B1234CD4722CE26A904B59E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372524, "uuid": "c8235fe4-b90e-434b-97ec-552e576dc378", "value": "12288:+h4m7k6KlI1ly52LpQsVaUUWgvSx3743oM4OBo04f6hv/zb9wcDEkO1+UUNN8jX0:+Tw6KlI1lyI1Gulxr5/wqO39jEeBNWjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372524, "uuid": "89e37d49-3f36-4ddf-82ef-c71c9075a7ec", "value": 637126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372524, "uuid": "b5d9bb1a-65c7-42e3-abc9-335091c570a3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372524, "uuid": "b83e7fb6-dbcb-40fe-971f-75e03813e044", "value": "CF-INV.X233348900RFP.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962331ed-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1779372528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372528, "uuid": "50530d85-3a7d-4a96-8da5-faec11e00fcc", "comment": "Malware payload (DarkTortilla)", "value": "7c1d677ba9d1ac8c9c9524029a607584", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372528, "uuid": "1902e474-6cf0-490d-ac45-9c19df40cd98", "comment": "Malware payload (DarkTortilla)", "value": "29c448bdc2c15ab16866756f1bcbda9219330bcb3a99c61bd0ddf45a2b4caf35", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372528, "uuid": "2aba37be-7253-4ce8-b0f9-c92f9a5c0111", "comment": "Malware payload (DarkTortilla)", "value": "c167051d952f41edda3c26490ff4fd654ebe9a5c", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372528, "uuid": "832b83bf-91d9-400b-a6b8-0ac4f6c2ca98", "comment": "Malware payload (DarkTortilla)", "value": "03c6e45a2b3f1ff365e9fbfeddcb3b723dbbe42131189372b3e20f585c210b47b370acaf0791ff0866195592f2c4c6b6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372528, "uuid": "b06dfc88-ec47-47a5-8501-358badccab12", "value": "T1FD25AE4E4ABB72A1D89B063E5BBB021823754B671941E9D900C301D9EB7E3E7BC934D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372528, "uuid": "77bd75f4-5b0c-4de6-9c4f-87d22688a7dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372528, "uuid": "0ab7e7ea-2aaf-41f2-85c2-7bdb71bbea8a", "value": "12288:iIOwmWI4cvgKU3nVH7R6CMc2gPwzPtT2jZV5jV+sg9fCJtED3eauI+f+NPv:YwtcIK+VHHdIz1TgV57gf8Y3kuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372528, "uuid": "a8a0702d-9120-4581-bbd9-0de64cdd1177", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372528, "uuid": "62f790ba-41eb-4bbc-bea8-c30e9ab0cb71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372528, "uuid": "d78290c1-0240-48d9-b0d1-1c6beaa558db", "value": "RFQ_New_Order_-_57m\u00b3_LPG_SEMI_TRAILER_7_NOS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983d90cb-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779372531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372531, "uuid": "72911d29-3950-4540-b51e-16601ac18628", "comment": "Malware payload (RemcosRAT)", "value": "c3c8ab9a0057957e12d835e4e719642e", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372531, "uuid": "f60af773-3fc4-4e13-b082-1f75b59c304b", "comment": "Malware payload (RemcosRAT)", "value": "29c7c64a28a074fbead3d5e2c13fcfe3c8ab4123fc7c9b03cb535c0a2b330cf7", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372531, "uuid": "54f99fb6-b543-4e1a-ada9-7202d6b5a1da", "comment": "Malware payload (RemcosRAT)", "value": "094d2fb1fe11d650099a6c08a7a396dcc248d0da", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372531, "uuid": "1e36479e-1542-44e0-85b8-dda82c18ea65", "comment": "Malware payload (RemcosRAT)", "value": "ec995b066fba4171e8db5fd856329910108ba4b5ddd710d10affe7b8c0d7bd32453130549b6e6fbbab424c709bd00381", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372531, "uuid": "9227e488-b550-4a43-8a0e-2c76aeb32f45", "value": "T1909533DE24AEB5DEBE183C6257FEF7692ACF07AF892914758C2DB8844700139707245E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372531, "uuid": "6083ea03-aa1c-46d5-b0e7-9ccee031ff74", "value": "49152:YtIMkkIaQP8V4wx1uB29bs2p2SUbHNzVJqIswno8iD1Xk:YdI/8+wx1y2aFSoHIDtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372531, "uuid": "4bce6097-d7ce-497b-84b1-d192ba5a5eea", "value": 1996086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372531, "uuid": "bdb1ee42-b6ef-494b-a0fd-4779d57d036d", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372531, "uuid": "0b11279d-7238-4f67-9ffd-49205141e906", "value": "Duclot_Collections.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f147e71-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370637, "uuid": "4d5daa4c-0619-49b9-b9c1-f7b1e100da05", "comment": "Malware payload (StrelaStealer)", "value": "b82fd94513f1ecf8c01f79af414162c1", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370637, "uuid": "a6f3eb82-bef0-402b-a658-cfaa2f6dc5bf", "comment": "Malware payload (StrelaStealer)", "value": "29c84353e634d6772974a775c45e1dbfd73c3d88500d327003cb6fbfcd4ebe75", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370637, "uuid": "ab317fa7-d027-464d-8ab5-7c68d44bd1cd", "comment": "Malware payload (StrelaStealer)", "value": "6264cfc6c9438edfea4cf53b85eccb59feeec5ce", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370637, "uuid": "014e7e1c-7e6d-41b7-805c-d8fced8c43d8", "comment": "Malware payload (StrelaStealer)", "value": "11ce44c41df7971191d4fa15b5383618aea1838341c75c89a1043fd8f7d25d72ccc10b472831167ecafa374e160828db", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370637, "uuid": "7c19b12e-21c3-41aa-87a6-fd090b5ba70e", "value": "T1FB5423333805F7D798B31B58419A62B476E0E2D08785C143EE9EA586B1FACF82FBD415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370637, "uuid": "b583eb24-2f96-4e66-990d-b1b3a3e56178", "value": "6144:ETnAzMK1tWWkNyc4w/7Alua3N0uZgONoaWUAYLPNq:U5Hq1u4JWUAYLlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370637, "uuid": "611d45bf-3247-4639-9247-acf259c605e0", "value": 282991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370637, "uuid": "2d9ddcc0-c6ee-4531-a5df-b08724949f90", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370637, "uuid": "58329278-c84a-478e-a384-15dbdf79016d", "value": "Rechnung10754-2024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0832e9c9-54f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779354680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354680, "uuid": "51059cd2-10ef-4b02-a0aa-2c8c04b04234", "comment": "Malware payload", "value": "f12c8897546682557096185aedc11c23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354680, "uuid": "75a48e6e-74de-4a43-9d2b-5664fa53c635", "comment": "Malware payload", "value": "29cf552bb9d43c9e2a102756f15eeeefb423bb2ecc1182a6505654da79bf1dd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354680, "uuid": "8eba9a54-9547-46a2-8d9c-d46006f86d70", "comment": "Malware payload", "value": "67708907bfec69756b66c01175eab5cbe51ca5e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354680, "uuid": "86cd1510-f7ef-4f9f-93ca-05fe25d84e3e", "comment": "Malware payload", "value": "eda22105db7278296e608b5ba5536da16cbd0a404917677d4374dbb314fd42cc45977bad18d7d95d3cb2c5a21f8b7acc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lway-Firmware", "colour": "#0A87AB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354680, "uuid": "50fbeb88-9b6a-4a7b-a5ab-c5d8bddab192", "value": "T1CBD4D05A53A0815AE0CFF2791185D6639DE3BB102F106EFB44F85A9D2F2598E2FF4231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354680, "uuid": "a0a54696-9c72-412e-a556-e62a659f4b5f", "value": "12288:mNu+stEAe3jGAVmGrM3x/6xprnfobz0uz4C2UoTm3EBsotyQPnz:mNuxEA2GKnG/q+z0uzZHvoQQPnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779354680, "uuid": "ce0a833d-3d1f-4e8b-9d3d-ecd791c25159", "value": 649280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779354680, "uuid": "f3294a11-9a01-4dc5-bcd4-e0508fc74d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354680, "uuid": "5d09bd78-30dd-4512-b508-912cfb038c81", "value": "29cf552bb9d43c9e2a102756f15eeeefb423bb2ecc1182a6505654da79bf1dd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313a6606-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370640, "uuid": "5a839657-1f92-4b48-9496-eb19a144b133", "comment": "Malware payload (Formbook)", "value": "6d570a4555b07e65e1dee913f34385fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370640, "uuid": "8a6013e1-6bad-4c65-92eb-bd266a50ebda", "comment": "Malware payload (Formbook)", "value": "29d3d47167a90e599940a605dae6fae187d462ec2ab515e3f2b3506af3c28450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370640, "uuid": "6cebc736-9668-477e-881d-8db432ed3b7b", "comment": "Malware payload (Formbook)", "value": "093f1feba5e92c78e781970105d93f81ccfd6824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370640, "uuid": "f6ff9d2f-ba64-4f17-8ab4-2516fd706ed1", "comment": "Malware payload (Formbook)", "value": "adef93746a76640d0ec7e9fcdd1d54c3a78a30eb4298dacc62bf0e924bc9805529a42cc3a58c0e6006f817d364285384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370640, "uuid": "3b26aa85-8777-4bb9-9d45-217b9a4379bb", "value": "T15A45CF1373DDC361C7B26273BA167701AEBF782506A1F96B2FD4093DE920122525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370640, "uuid": "6b377b86-b4b4-44f8-b671-61b7a452ccbe", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370640, "uuid": "4309c5df-2ad3-467b-a66f-5720d04f4168", "value": "24576:ztb20pkaCqT5TBWgNQ7a/JRtMHzHdEUvzi0AUYPV6A:wVg5tQ7a/iHzHu/N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370640, "uuid": "b90b060d-6011-4fc9-a4f0-651535d32b59", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370640, "uuid": "da3abcb9-92d8-40f4-8a4d-3975aca9784f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370640, "uuid": "e7739ce0-d810-46ef-ae6b-4d0fc4a3a6ba", "value": "Revised_PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3353ad5a-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370644, "uuid": "98bcde39-802d-49a1-98ab-64adfa619b0c", "comment": "Malware payload (Formbook)", "value": "a6650585e7fd4c869004d96df9653d52", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370644, "uuid": "d399d6bc-a752-44c0-84e2-70b6c2286c21", "comment": "Malware payload (Formbook)", "value": "29d9705658b886d5bb3ddd9ad10889077aaef1474a65041e90744f9c940f15c2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370644, "uuid": "27c0ee02-fb18-438c-9592-b483f3fc2f88", "comment": "Malware payload (Formbook)", "value": "cbf5c2af325507eab1e9938fabdad157e3133442", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370644, "uuid": "bcb18bf1-3ef2-4f53-8d8d-3dfcfbfbaa49", "comment": "Malware payload (Formbook)", "value": "e6c09411de9e2dda3ad98a995e980dc20e007a3ca08f6614ade91c9e6c67939e2408d022d088b3c55499f6fbe48c9d62", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370644, "uuid": "84f06a56-b293-41f2-8bb1-ff65b2dc9635", "value": "T114D423CC339C995929351910CBD501733D7ADB6DA86CAAA61FA901CCED8EF12E3DD2C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370644, "uuid": "98f67f2b-3510-47d8-832b-3fa188df65af", "value": "12288:8u3eq1lKZq2SS40lghp0LuEIh7zRrpWNBTyoA4YIWk7bA62J:8u3cZq2V1l8pFr7zRcPT/Ab7k7bAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370644, "uuid": "67a90695-0a3e-453d-97e2-edffe4e4985b", "value": 612924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370644, "uuid": "cb1a9566-075f-459e-9312-3d149a8feacc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370644, "uuid": "d350f745-2cf5-4813-89b3-f98f91913c48", "value": "Quotion_For_Product.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3e18ea-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372535, "uuid": "02d4de3d-19ec-4c2a-a633-4c58cffb0355", "comment": "Malware payload (Formbook)", "value": "ac1384599e26142ae59d9fae33450433", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372535, "uuid": "f567bbb3-4fb9-43e9-ac31-df0eb89ba39b", "comment": "Malware payload (Formbook)", "value": "2a1b76690138d3b1fa916ab7e6901c273188a7c0bb8156699703f1c7fe1d433f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372535, "uuid": "78d1e8e1-bd5c-43d1-9905-840e9d7b94c1", "comment": "Malware payload (Formbook)", "value": "30d60a7d1aaa7ff5b6e63cd0cfaa167c8e427dbc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372535, "uuid": "7e3043ae-f6b3-4312-a25e-0a305e2a42a5", "comment": "Malware payload (Formbook)", "value": "275fe0feacb581dbca3708cefe6dac3b19c2c819a663e0356ba61b39a2a47a63297ad3d1c988954fcc7614644a3a7165", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372535, "uuid": "76736d05-942e-4a18-a500-11a799255b19", "value": "T1B6053350189D6AF88511C8F97A7A3246AF0922EECBF57DBB20CDF4FD101B9026BD1947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372535, "uuid": "85e13d1f-2ebe-4f66-91f2-0dce32565c12", "value": "12288:LVr4cFWanUvq+DrMiYy/IpGHx60xrc6hPsXNdlny/54SA4K/Ruap9KqM27Fn:LVrFT8MiJJwuc6ts9S42apIN2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372535, "uuid": "e22f5dc4-c35a-4a9a-b7ec-eed6946e6ea5", "value": 810873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372535, "uuid": "aea3b1e6-ec4b-468d-9f2e-4cc8af8a69d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372535, "uuid": "95a63a0c-50c1-46b8-81e0-1a94b5de7f21", "value": "RFQ-20240826.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8268048d-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779373783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373783, "uuid": "573c29a8-1eda-4016-bb47-d4900089e481", "comment": "Malware payload (AsyncRAT)", "value": "e35d94e0860d9f15b95aa6aefb08a2ee", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373783, "uuid": "fa3d50ba-b49a-4f7d-ab17-c3673d2a4143", "comment": "Malware payload (AsyncRAT)", "value": "2a22c2bff087873546c324b7bd9e8e40621700c3b1fd0538c95e0e413999e389", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373783, "uuid": "e006a74d-78a3-4a66-bb25-6fa2845549fa", "comment": "Malware payload (AsyncRAT)", "value": "1bef66460f4298b697d31127359f775eefedcfd2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373783, "uuid": "15cc7579-050d-4b08-8e8a-1ad880ae5df2", "comment": "Malware payload (AsyncRAT)", "value": "0668f5a7198c197ffbcfd319503812486252c03ae01d26a15d8d6268a0b81d2a1c5ffb36aee64afd90cf529d54fe955d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373783, "uuid": "4c92bb57-5ac0-459c-88a0-030a865e7a46", "value": "T1021412498D258F3812991E2C24725D462BA488DB509D9C9EFCBE1DE73FC322968D2AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373783, "uuid": "190c9a33-2db0-40d8-b4d5-28680711b123", "value": "6144:zwY5A3LlUo7wwPkFz5rgJ1/fLFLpN8Nqc:zw4olUo7wh3QDNpWNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373783, "uuid": "8ed16c4b-93a4-4d76-902a-c7092ca0a714", "value": 197756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373783, "uuid": "9bb56b18-105f-4055-b931-957c7d84c3cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373783, "uuid": "ac2ee41a-5267-4726-8690-2262b6e6b273", "value": "Interface_LIB.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d80034-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370650, "uuid": "78526b07-c8b2-41ff-af80-8082c0086030", "comment": "Malware payload (StrelaStealer)", "value": "464515dfe4c6289530ebe4fa7abeb924", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370650, "uuid": "34f9bc11-2a80-489c-aaf4-87913c8efbe8", "comment": "Malware payload (StrelaStealer)", "value": "2a336cba9aaf25ccde6488e36ba7521c7ff3892e1d6ed05ee123ad98966a5764", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370650, "uuid": "45404a49-216c-4ce1-923e-3331c988deed", "comment": "Malware payload (StrelaStealer)", "value": "f2b42e102a63469bfe925cc6bf7647bd213916f0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370650, "uuid": "a590ead1-f2d6-4287-8670-cd78ee3c4c81", "comment": "Malware payload (StrelaStealer)", "value": "c95f45f473b54c4a11caf6944aa20c180bfe34f514fccd8e73238927e3184703d3805a3ce375038a7317b8bedf42dc9d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370650, "uuid": "1004394e-3aa4-4012-9771-13342797141b", "value": "T17553ACA090B28F0751FBC18F825CE283919EC498876D0B9E79364C635796E2D87FDB35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370650, "uuid": "2a564032-a956-4d40-bc6b-537e4f4bd68d", "value": "1536:5OxKHc1cA5oI/eBALpevK7E2QOdLMolC5OqwcdAa/ytoBMTZLxAPfuPD/VZ2qPdu:HBALsvK7zQOdLMmCoBcdAa/ytoBMTZVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370650, "uuid": "5652d739-523f-4511-901d-5a75812d9084", "value": 65205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370650, "uuid": "4c75dbc8-b40b-4e4b-b4ad-9e6050c603c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370650, "uuid": "8c2feb8a-2496-47d7-8261-c75df503127c", "value": "1015526925273687526.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2fcf88-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372538, "uuid": "e06119fc-fb44-4f4b-970e-cf3746977385", "comment": "Malware payload (StrelaStealer)", "value": "8e994156872c7d7e25593c6d9965aa13", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372538, "uuid": "96fe067e-243d-4a91-ac24-dff3a9c1657c", "comment": "Malware payload (StrelaStealer)", "value": "2a43dadcad4056bb74449c21c64001e1b3abfa095f6636290d05c86ed9c02edb", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372538, "uuid": "542b6aa2-91f2-445c-9b98-1b1da8500ca0", "comment": "Malware payload (StrelaStealer)", "value": "72ad3fca68f5675ae12baecff0329b5ca2159691", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372538, "uuid": "f72217f6-ad15-4666-9903-feb15b8a7877", "comment": "Malware payload (StrelaStealer)", "value": "60f352189d6ef23500a842a08b50d02be6896c07be2f8c92bccc1aad9b1e853684d9a0ddbfb5fb4dc83ca2173928c3e4", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372538, "uuid": "4dd0cf17-22b8-45fd-98d1-990df5eaf119", "value": "T100311982E8FAF635D36ED0B26ACB1600EB8C554601FE6207AB0866B1C283C326B05349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372538, "uuid": "a8e7c7f1-7882-4c41-9921-10e0eee034b8", "value": "24:9sylWiYXb1dH48s1MGZVZT2PB6oSW1K+W4b1WsQDlYZRKIZK4H5rwin9Q24AKgGX:9syRaPHi+qnT2PhW4bws6lY2IZK4H1w5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372538, "uuid": "9d5a7229-ecb1-4122-9ae4-0b104dbc1bd3", "value": 1528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372538, "uuid": "0e8f563f-cc6c-4904-a1a7-6fdaa55688f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372538, "uuid": "6559efc5-c39d-45b3-b380-1b6250d5b64e", "value": "Rechnung_1018520.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3dc621-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1779372541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372541, "uuid": "1607cc96-05c1-40b4-a416-7b42533f994d", "comment": "Malware payload (RedLineStealer)", "value": "cab8033cf297a0c817707ccecc16ceb9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372541, "uuid": "fe0f153e-624e-4f2a-b958-d776f754f749", "comment": "Malware payload (RedLineStealer)", "value": "2a65f5a5caf37aed793eb3ae38f08d5631dfe084aba59873150e271b806c30bf", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372541, "uuid": "735e2e9e-61bc-4050-8ded-b97df875d08a", "comment": "Malware payload (RedLineStealer)", "value": "0b0519edba91627515e82eeaae1e8e7e423dfc1b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372541, "uuid": "1ff3a9fb-64b5-4cce-8183-c06143e0e7ff", "comment": "Malware payload (RedLineStealer)", "value": "04e7519d549089d368bb29670cb25aefe8e4b2f8debb38ee56f90c83b6e44cc6c3062c926d204ed7a497ab0b7be4e3a3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372541, "uuid": "d4f839f1-17d7-4940-bad9-6dafc3d84cb4", "value": "T18AE4230CA57C249516A4D68AA5FCCBCF1A9357CC34BAE188BED411CF0E6D9CBB811B35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372541, "uuid": "69629065-2b19-42ac-8e60-e469ea424730", "value": "12288:VZDX/tUtrGooK3Miggrdc4jWxt9rBk+3tbj+DM1cmu2y/3cA8t:LlUttoCM5Kdc4qVBk+9bj+oOmu2y/mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372541, "uuid": "e27080b9-e2de-41ed-a54e-26e8c0523364", "value": 665061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372541, "uuid": "9c17e777-3648-4cb8-81e8-64f14114702c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372541, "uuid": "a5e60c7e-1f8b-43b6-af9e-2ac9575b3a60", "value": "Invoice.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38dca65e-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370653, "uuid": "22a3f1ab-7c2f-47b0-8587-fab1025a13c8", "comment": "Malware payload (StrelaStealer)", "value": "157b25c65153c65e4118aa9f5a850fbd", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370653, "uuid": "12fc6305-ea8e-42a6-b4a4-b04a2dd8e07a", "comment": "Malware payload (StrelaStealer)", "value": "2ab761152efce992206af5ae6bf279dcab82de5c323ec7aadb347ce936b93afe", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370653, "uuid": "d76d90a2-43e8-410a-97b5-1e62d8fd165a", "comment": "Malware payload (StrelaStealer)", "value": "3a335376a1f05b0b451bfbacfb44cf1549e05797", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370653, "uuid": "8907fae5-3e06-467b-8183-30db692e6b11", "comment": "Malware payload (StrelaStealer)", "value": "e2422c0c4e2bbe03c027cf9683a2618ef4fc5cad0f8993fc28ccf7bbb9172e519ab366bbd18c48a9ad28438d89d899ee", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370653, "uuid": "0fae4fb8-f8a6-4ac3-a0a5-4f850e543e11", "value": "T1E9542340877308FB1CDD64B5D79C2D224B0E269EB38C679815619BFC706A3AF964BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370653, "uuid": "8a8947b2-84f9-4552-93a6-d3f175708dfb", "value": "6144:+n7qD/iBXTIIyGm36EEAAa5P9fA4ncBBhKqa2S5:+7qDeTI4mKEEAASPTcB8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370653, "uuid": "a9128aa1-d61e-427a-bfb6-226a703b5e0a", "value": 298537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370653, "uuid": "d5c4b963-5e7e-4ded-b035-a80fc6da6f32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370653, "uuid": "025e8885-e46a-414b-bc59-63f5c1b477a9", "value": "Netto_-_Rechnung_-_Nr_20243341.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f7bfc0-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372547, "uuid": "3abd1032-1d2a-4df7-a210-aa5e9ca5be6d", "comment": "Malware payload (Formbook)", "value": "38b9756e740721b08ebebdd18630dabc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372547, "uuid": "e00c6d79-6d89-4786-a097-477d40fe3ca6", "comment": "Malware payload (Formbook)", "value": "2abe34a359a0780dca38eaef6fc39347b6d82a3ad5ff15aee116366b47b71455", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372547, "uuid": "26717068-2cd8-4efd-931d-6e8062e43013", "comment": "Malware payload (Formbook)", "value": "737656d131bfc3217a0be577442af0061ada2f29", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372547, "uuid": "70db2419-128d-46cf-8306-64310b916709", "comment": "Malware payload (Formbook)", "value": "64585dab1534d8fb83ef98d8e9c47f58e6033bd370deaa01265668c920068b2688ac17fb890cce866d5c8716d83ae330", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372547, "uuid": "535f1856-9a47-4774-8c48-c03f455daba8", "value": "T12CE433A9CB8E47F3C5008E1723F2B002EF9C42DD44FEE4AC618436D1E25942A96FF694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372547, "uuid": "b2280d25-6186-420f-b5c4-ec357b1e7238", "value": "12288:H7r4cFWaQ9A+/SeHHkBCQh/mIw7GxcsXNdlvNhFoqGwoPUmyg/fSUgGha05:brFD+/JnCCQh/mIw7GCs9WqGpPpfOGhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372547, "uuid": "37d40a3a-fc4a-4cae-a861-d2c4f3b6d4df", "value": 667372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372547, "uuid": "9b983e7e-2242-440d-8e1b-04a88b6fe329", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372547, "uuid": "48cb01a2-d333-4f90-9f3c-f6278390da8f", "value": "Quotation.arj.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a403ae6a-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372551, "uuid": "46960886-e19e-4ca9-8583-494834f1f2ae", "comment": "Malware payload (AgentTesla)", "value": "bfed56b5cabcf033eb945b308ff72eb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372551, "uuid": "915f9c78-3a64-4341-99ec-ba0c1b6c8f3e", "comment": "Malware payload (AgentTesla)", "value": "2acad170a44111e4689a0cd5bc8eca651a069383d96f2bd20a343190435b0f7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372551, "uuid": "3983a532-62b8-450d-a634-798140664175", "comment": "Malware payload (AgentTesla)", "value": "826eb32cfda9c3c646968723ca3dc6788c4bfb26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372551, "uuid": "960fbf42-047e-4a8b-ab9e-ab1428a6c6be", "comment": "Malware payload (AgentTesla)", "value": "1edf2649f059ee39f840f9d3757f2d44e6c7d472eb6570c22aeab398e85cab624542c427810b80c7ab9bb89b4125621a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372551, "uuid": "210097aa-6f16-487f-839e-518db6927a41", "value": "T1D9E4330736625D0ECF5270342D6213DD7F086E02FDE369FBBC80B7B52595E06A6B9209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372551, "uuid": "8d43ca1c-c7f6-4b1f-9c1a-89424ec267e5", "value": "12288:1n4DOxa7o3h68hOqwEUY7TCuGSHbYv5/fMt0nXSsDgpdEcfZcsscKG2RqAuvMDNf:mDqaodrCuGS7YxX7t4xGsX72RsvltqsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372551, "uuid": "0b62b437-04e8-4891-bd56-f797f59fa909", "value": 707596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372551, "uuid": "464fc9e2-785c-4abf-8a81-7a422b1bd8d5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372551, "uuid": "6b595da0-ef03-418c-a68d-5d966253b805", "value": "NewXDoc.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d258c367-5554-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779395821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395821, "uuid": "e0706be1-3bef-4516-92cb-b8711a5a237e", "comment": "Malware payload", "value": "f4905416bc8f4b875557a96c96f21d95", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395821, "uuid": "3a43bf5a-248f-4d81-bac1-734faef646cb", "comment": "Malware payload", "value": "2adad5b44392d48249cfa557ca9a1825102d90cdf966a8acc8e96d6592ead4ec", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395821, "uuid": "810594b7-c695-40b8-85d7-70b571282005", "comment": "Malware payload", "value": "ffcf99f7aa43491d7329d166a9f85b769452aa84", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395821, "uuid": "f7cd9af0-8996-4d84-91ca-a6a580824af5", "comment": "Malware payload", "value": "a42ab44335d6d7abb8331209adec9a8a5fcf50c463d2295256fd91e867c724dd34412439f24d72c884e5ba5761f965db", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779395821, "uuid": "d906f889-1f3a-4c56-93d7-6d39dc5c6111", "value": "T10CE5121ED27D4927C83A733EF430F48208DD9BC1B162F469BB6D8489ED574B683A7219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779395821, "uuid": "c56c28bc-7c61-421c-bbdc-ac5eb9ecd867", "value": "98304:GUeuf0QqRMF9AQgKYR0qs6CkvwTQFv8Lv:GruMmA+s0l6CkvmQJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779395821, "uuid": "dd11f238-5508-47c9-8173-9b0e16a4c87d", "value": 3208307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779395821, "uuid": "0c865a12-39bb-47d5-ae18-65d105684a1a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779395821, "uuid": "20e261b8-87d0-4a86-8ae5-93d2a9cf2c78", "value": "mindfabric_agent-1.1.362-py3-none-any.whl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6008aeb-551e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372554, "uuid": "2db654c2-14c6-4613-b1a4-1119171986a9", "comment": "Malware payload", "value": "b1649b723fc4af47564ca4fe97aaf199", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372554, "uuid": "7e7fdd33-23e3-4644-8d3e-b1d7a1f072dc", "comment": "Malware payload", "value": "2adf3e8363b0fc3003996f61fe5c882c7d37d509f51e6dcdbfe1874a085bd833", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372554, "uuid": "8294dd32-fff7-40d1-8cec-7f40c5b34a7a", "comment": "Malware payload", "value": "0d38cc80f7d539d8074188a040085f4483af1f63", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372554, "uuid": "0a23852b-94a0-482e-ba20-0536e9abc417", "comment": "Malware payload", "value": "f7d45121dad980efd78fe209d64b1994cb059e7b6a3a436148ce1c57947452e357fad867e0bb97807d67ce8d0e3f1950", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372554, "uuid": "172e2ba1-f724-4ae2-af36-3d639f572f7e", "value": "T10A42C046292E03DB694785924838E8BE7F802D7E0AD70971FE1DAAD51B7AB2489D04C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372554, "uuid": "0036a553-f8c4-4a90-b390-9ec09fd95c48", "value": "192:fGj02CfSx87jVYWfCBZoEZhQcmP1dRYNMuOzJQzJKvQ3GmUfmng9mxqAJRWS:fb2o7qWfGPZBmP1TYNMuO14R3WS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372554, "uuid": "2fea53af-08ed-40ac-998e-16f297543617", "value": 12768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372554, "uuid": "161b9761-9fd0-4b76-9ae8-887030af3d7a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372554, "uuid": "05368b3b-7898-4a3f-b9fd-358411511490", "value": "ORDER0922.7z.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a815c60f-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372558, "uuid": "bd4d525b-f7f1-40c1-84df-f50de72fcb73", "comment": "Malware payload (SnakeKeylogger)", "value": "517445c45fe90bc81c4bab955a08b352", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372558, "uuid": "f8e2406a-d62b-4113-af01-cf1340a9adc6", "comment": "Malware payload (SnakeKeylogger)", "value": "2afdab39acd40c2cdf04b698a3f58f30866a8a9fab5831c35176e2608c5ff854", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372558, "uuid": "0ce8ba64-b1c7-41ae-81e0-123176f35f8b", "comment": "Malware payload (SnakeKeylogger)", "value": "545df6ab0378b4c87b4b4f5aa81f389d74e24b7f", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372558, "uuid": "005eafd1-d472-4085-a0b7-dddf038f881b", "comment": "Malware payload (SnakeKeylogger)", "value": "49b68cbedfd51eebb19ccd46ac3a05feee229c0f43feea60e33ff69855164dc63dced6b6f743a0162c1572d307281ba6", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372558, "uuid": "85eca499-d430-4e77-a3e6-a58f14e8e950", "value": "T18FC4239D873BDBB514DED17D29B3107D1077AA86B193E08A6032E9C774F0E76A8D2D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372558, "uuid": "48abe0bb-d6df-4ed1-a281-e04cebc40665", "value": "12288:ZP0PcRl0zlwzSP8pqDyS4JtfvBs6FrBQR9CtM:aPM0zlwzSQqDyFJsWBPtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372558, "uuid": "0c1fd83a-29e1-4fe6-822e-33df3089b49e", "value": 552736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372558, "uuid": "8950568b-ff46-4482-87e0-49ee45b1f01a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372558, "uuid": "4390466e-f72b-4ab8-83e6-2e4ccc0fa69a", "value": "Product_specification.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c558ec0-5549-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779390980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779390980, "uuid": "7ab88f1e-d4ec-4cf4-bfc6-748d76c64467", "comment": "Malware payload (AsyncRAT)", "value": "5a0a4b6e16b83284358672c9a31a2861", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779390980, "uuid": "8b513873-a23a-42f1-94b8-79766cd330c3", "comment": "Malware payload (AsyncRAT)", "value": "2b125840b1f69be0cd1652e051dca93eb9ee54a3c86494054fd061bca877492f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779390980, "uuid": "d180bb06-7198-442b-9582-c047298d6c1a", "comment": "Malware payload (AsyncRAT)", "value": "fa68217a02ceae00ed8e27bf540b5c21422ca018", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779390980, "uuid": "faeb74a8-6b01-4796-a826-acb1b0150208", "comment": "Malware payload (AsyncRAT)", "value": "8247618bf46880e9810d12b30ea09af88c0841fcea30e4efae5afc9f768105c93fb61f0b146f31ec724ad481e938b02d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779390980, "uuid": "ccf00754-4d19-4c17-9780-97c738e9e775", "value": "T186A39E117BE9D12BF2B94F3468F32242C27BF8A76503E54A1CD034961B33BC19553AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779390980, "uuid": "7f5538fd-9d8f-480f-b3e3-72d5a29793bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779390980, "uuid": "63997131-cc0c-43c7-bea4-0c72f23dfab8", "value": "3072:iuMuT0sn2HBMr3bkiFCdetnRPF9EVnb43jaI5grK+:iuMu2g3ba8tnRPF9cCGrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779390980, "uuid": "c7ac8380-3176-469c-b359-f02c273b840d", "value": 101888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779390980, "uuid": "a3838e40-f96f-4e81-ba50-15ce6e4898ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779390980, "uuid": "3a71adea-7ceb-44d6-9a0e-0bf50dd8739c", "value": "EddieTest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af2b609-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370657, "uuid": "6086cd28-4673-41f3-8d18-069ee9b0a345", "comment": "Malware payload (StrelaStealer)", "value": "2038a8592f928c23397437640678f2cd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370657, "uuid": "d44b6f2b-e32a-4a74-b3fe-1747ea164dd2", "comment": "Malware payload (StrelaStealer)", "value": "2b1c59026010851ed1b303f3db9e2ec71d5f6d19c382db4734c798ca6cc30007", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370657, "uuid": "e6eec7c5-3758-4540-851b-27821405b101", "comment": "Malware payload (StrelaStealer)", "value": "1acaa7fc70ef6b13e5766a43f90d6e13a256c760", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370657, "uuid": "184b2cc8-0b92-4350-9a89-1c4b054bd6f5", "comment": "Malware payload (StrelaStealer)", "value": "c11b70b365c3964dfa55e641649ef41d6a58fda354d79bdbda2b0af6d3cfc5cedb77dbd00c9bdcc07cf0c7b0cc5fb4cf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370657, "uuid": "6efdf745-2cd3-445c-beea-e919256b45b2", "value": "T1DA7365AECFFC98E50CEBAF6A9D2110C943F45BE85E12D088F066298DB1479CD5791A70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370657, "uuid": "4073ea53-6afb-4315-98ce-7298dfed2142", "value": "1536:VyTkWG7IHdwKG7KILTcbGdb1tV0bpmd5fR7D3Df+56fPt9ffDMAowWaDK9Z5FIfF:VyTkWG7IHdwKG7KILTcbGdb1tV0bpmdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370657, "uuid": "818e834c-3dbf-4245-870d-2af055e0876c", "value": 77980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370657, "uuid": "92e457c6-d5b4-4ccc-bec8-5b21e5403e07", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370657, "uuid": "9f5a6ed7-e310-4771-b92d-8327cc401855", "value": "442929261103923161.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa26eaad-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372561, "uuid": "c1f80c94-67ee-422d-a99c-b849e5588853", "comment": "Malware payload (StrelaStealer)", "value": "873cef562b629993965c4a949e665407", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372561, "uuid": "92aab372-4502-44f3-b706-f6b1578f75b5", "comment": "Malware payload (StrelaStealer)", "value": "2b5b9ca393ee8fda94b5de5b36dbad8e15fa2daa1b2b89e230f316d1d12a2edf", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372561, "uuid": "abe18f3b-d32b-4ae1-acba-7f6406475055", "comment": "Malware payload (StrelaStealer)", "value": "8938a9deb9cb6e372c7b57c6642ee435dba0ec7e", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372561, "uuid": "239531d2-c0d6-435c-98e2-aebfca13f16c", "comment": "Malware payload (StrelaStealer)", "value": "300f8375aa0c69ed7ec60d95c34cb58adbcc5c26b5b2b52424302630685fab5532289a14de80c1d0f0db4292351e5c76", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372561, "uuid": "16bd6764-46cf-4538-b6e2-2a82337d148c", "value": "T1ABF0C8CCBD29E2D0DDBE47B742D6401E2427E8C808F274C50140FB03198126247080D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372561, "uuid": "4b4e31b6-4d05-4027-af7f-3752819c406c", "value": "12:5jnWO9ZDJ3w+lS3hhcogd+s8Wy31N3mkdMnIg2IiVkkL2AwXBYFZmT7taVn:9nWODJVttUssGkdMmqNAweOTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372561, "uuid": "9099cd9a-8e34-4133-92a3-dad1df2477bc", "value": 655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372561, "uuid": "58aa096f-3dbb-4825-a091-be930b75480b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372561, "uuid": "774bdf76-a915-47d5-9989-14095b25fb0d", "value": "Rechnung-RG156741.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6c995c-54f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779355014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779355014, "uuid": "6eab2795-5e21-428a-8410-5dc1a006ef56", "comment": "Malware payload", "value": "c3786f7a267143566d35c2c4a3ff1e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779355014, "uuid": "8245727d-1469-4b82-acce-04dbef5d046f", "comment": "Malware payload", "value": "2b68fb1e38e1cebf314c458511cd4825b27cf4ae35fead00337e64249f1884cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779355014, "uuid": "47b506a7-9a97-466f-bac1-fdf5e2ec42c2", "comment": "Malware payload", "value": "1f8db8b06464a89cba83a231c292f2c92c61e6ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779355014, "uuid": "6b7daeeb-1f3b-4827-8315-f61691419430", "comment": "Malware payload", "value": "3013ab2765488f7e8b869ad0f7cdbc0d4ecd9c01e6fe673d6d369a986e2eab03089960162b8c0e89f65e555bbbc9f259", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779355014, "uuid": "37f9ea56-7b6d-41b8-b87b-6c66d748f021", "value": "T14175AF067CA458B5D4EAD3318D7691917A31B8440B3123D33F15B6BA2F72BE05F7A3A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779355014, "uuid": "cd100267-83e4-4bd2-a097-5dbcb2e3463b", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779355014, "uuid": "22e1feef-5380-468e-b024-ed14ee7bb078", "value": "24576:fev31GEY06qgWlNZ9Ki3dzIH1nSdLsIbyet9UHmRMqpQsUs4Jg+vzR2Y:fevbY0SWHZA4dkHxCmet5MqCFg+vV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779355014, "uuid": "5f72dda2-ebb4-4183-af5c-2041b146c991", "value": 1687176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779355014, "uuid": "f72ca74f-75b8-4f56-9074-278b8ea9f7b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779355014, "uuid": "ea684412-0b09-4c85-a5f7-1ba3330863e0", "value": "L_ng_it__64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db15d398-54e4-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779347733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347733, "uuid": "e4015271-d134-4ef8-9d82-cf83c7799b5b", "comment": "Malware payload (WannaCry)", "value": "7c21e866b366f2e3f2bcc9f1a06f6d20", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347733, "uuid": "232856ab-9062-47b7-a5ce-bb6c9edadc95", "comment": "Malware payload (WannaCry)", "value": "2be0decbcae882119bbb64f216bdf75da6fe840d593d69fdc1ee3c2d49a30563", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347733, "uuid": "3348345d-0afc-4489-805e-c32e92ea1cea", "comment": "Malware payload (WannaCry)", "value": "bd79f046a39c9fc856723fdcb4f211d81e288f87", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347733, "uuid": "4dcf18f7-b5aa-4f5e-8d5f-fc984200320c", "comment": "Malware payload (WannaCry)", "value": "1467777df59caa392165b7ed72f3730db7b735621be9b9c41353b34a9339ccace7979c5c082057dd11a0eb1625887301", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347733, "uuid": "ff504365-7763-4b60-b9e8-02d3b1d1310c", "value": "T18A369E0AD3D90614E7F299B933A6A310B2777E45816691BE2615C50A0CB3F2DCFB2F1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347733, "uuid": "0219471c-5eb5-4a90-828d-fc75a1980282", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347733, "uuid": "0aa05b36-7d84-44ab-84b8-26ac0ee4c207", "value": "49152:jnYnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:DI8qPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779347733, "uuid": "2d7a6dd3-9836-4361-89d6-17827cc0effa", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779347733, "uuid": "fc988e3e-d6b1-4b5c-afe8-40e537a9b820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347733, "uuid": "a5454500-3b30-473c-83a7-ed9e747be87e", "value": "2be0decbcae882119bbb64f216bdf75da6fe840d593d69fdc1ee3c2d49a30563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc202c29-5513-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779367974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367974, "uuid": "5f8b309b-cd80-4116-acb0-9e96427abc31", "comment": "Malware payload (Mirai)", "value": "76fd0caf224a974870b7473385449d7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367974, "uuid": "0b84929f-e09a-4d7c-a47c-f7dc08283c89", "comment": "Malware payload (Mirai)", "value": "2c304f1d002b9716577921f0ade51418e18deb7a8f87471f8384c66d2fe9de4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367974, "uuid": "f177be86-9618-4d27-8c63-9df128d96800", "comment": "Malware payload (Mirai)", "value": "bb24a7f6f7cb0e5225295d042c31bcda3e22056c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367974, "uuid": "11fe930d-de26-4c25-8891-43c236bf5517", "comment": "Malware payload (Mirai)", "value": "38457922a831dd3c759d8e341c60b13030a5ba9b22e02aac21ed41fa52ba62e56649a80f913b29be0e6c9f1c76d55b21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367974, "uuid": "ea7c32a2-d4b6-4bc0-8527-6815d1e196f6", "value": "T11643F1A29217E9B7D5631C3B4A4F08957D263A4EA01F477F3CA663FF1CA59C20D02E84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367974, "uuid": "208568a7-bded-4667-b1ed-d9743b04a8e2", "value": "768:kD/ql9wUwB0cjUo5WuRAOYebpvaE7XgMRDz4ftD/74ValteMlzT7/dMoyicx0HV:kjqc7SEUAJ+MpsftTUcqMhV7uMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367974, "uuid": "8bf7d519-fd7a-4d28-8bf6-cf77db35d73e", "value": 55492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367974, "uuid": "96eebeaa-9848-46f5-b1fb-a50643cc81ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367974, "uuid": "5cd3b2f1-4df1-4569-80ac-598b36515c36", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1ee1dd-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370660, "uuid": "27e855b1-7a22-4a12-84db-ba688663c1d4", "comment": "Malware payload (Formbook)", "value": "09120eaaf3e75b40e6b00ac2621832d0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370660, "uuid": "1740cfcf-e542-44e8-938e-beb73aff6c15", "comment": "Malware payload (Formbook)", "value": "2c421363b0537fd616c01e695ed190ddf31c0e6cd3336777f61e1f8f026fb470", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370660, "uuid": "43b974d9-b2e0-4e9b-9afb-5aef51fdddc8", "comment": "Malware payload (Formbook)", "value": "d839b38651ebb78c904c1167ec1c635500471fbe", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370660, "uuid": "c270ccb1-2666-4679-b3de-768e2174e95c", "comment": "Malware payload (Formbook)", "value": "37d8025af44bf3bd1fa1d6d208d17e22a7cffaada1c51698d4f3b25088c0acad4c6691196a346d898a75f6e9b90b9109", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370660, "uuid": "5a647c38-2ac4-4da3-ac18-e4860021bbd7", "value": "T174A423377633977A4EEFB04BE77670A7E0101AF5607DCD8797A6C26A9012A903C14E2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370660, "uuid": "23bf3e52-3957-451f-9e88-d2f737e0d57c", "value": "6144:HEjHk3X8WYyRhvFfQPAR4zhhBCrypBW7E9FRh/H+KjjJ3BQoxlyCkdMNpPbDwTye:HEjE8Wpty9hfW7M/HrtC+T06wiJj1tWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370660, "uuid": "5520a0d7-2a3b-42e9-be3e-9bf71ac8eaf6", "value": 491208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370660, "uuid": "ce26c5e3-07be-4f2a-8859-3d0843b3d413", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370660, "uuid": "cb58c970-a138-47ee-a040-611ba70dde99", "value": "justificantePago_es_180218627117.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f30d938-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779370664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370664, "uuid": "a316aecf-ab6d-4f40-a372-1824588fdbc6", "comment": "Malware payload (RemcosRAT)", "value": "447babab02544ee7acc92e33af7852ef", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370664, "uuid": "1dcc5329-37b9-4ed6-8c61-e2144b0977e6", "comment": "Malware payload (RemcosRAT)", "value": "2c4c11e6ba8eefb63bb0ba44926ea4c7fa62115bd6d3fd5d41773ccf8bf2badf", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370664, "uuid": "2d62cd9d-14f9-4823-869f-91e9c311a44c", "comment": "Malware payload (RemcosRAT)", "value": "c7b38d5cfd57ffa3810f380f4fae758829eba67f", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370664, "uuid": "a7d19eac-3b29-4ff9-98e3-95c9021a02ee", "comment": "Malware payload (RemcosRAT)", "value": "0372a23bc910cab38d2c69f4a9ff33e1ab8f8fd0b15f8a4a80e0f63bdc451f0f3660c55eb5a71b1005c9ea761b1f303e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370664, "uuid": "20302f5f-882d-4b0b-aa70-81fd4f2d0c31", "value": "T11215338E9AE392447B27D32D3E680E7A3036779F618381F1BA64270F5D7B469392174C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370664, "uuid": "c8b91bd4-2478-45da-822d-a21cfb0aea2b", "value": "24576:WMg9v/4boMk0omVfRuz8c7NdYmOfGiCDPu:WMg94boMk0+F7NumOrGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370664, "uuid": "14920512-3a1f-47b8-8729-a5ffbb02cb31", "value": 900916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370664, "uuid": "acca2df0-6a88-4c1d-b8bb-d40c7985a5b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370664, "uuid": "589ef168-642f-47a5-9797-58bd3de10334", "value": "Product_Sample_Requirement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d5e7f5-5527-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779376185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376185, "uuid": "47d79a8d-39c7-4794-ada7-bdc183e7eca4", "comment": "Malware payload (AgentTesla)", "value": "ba387f1547f62289a4902275370bd4f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376185, "uuid": "962ca85b-c570-44c3-aa54-de6f839149d7", "comment": "Malware payload (AgentTesla)", "value": "2c6133cab1050c0c1be6649a55b14f5c48298fd7cef042d97326acd068a14f2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376185, "uuid": "aaa177b9-ab49-462f-adb7-9b206c2c80f7", "comment": "Malware payload (AgentTesla)", "value": "6173c8c679194dbab118720c94dbb1b95e6a991c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376185, "uuid": "1fb4c3b6-4c83-4015-b9dc-6a1619414ee3", "comment": "Malware payload (AgentTesla)", "value": "0c2ef53838bbc91d62a2657f02a48ccbb105a9cbf10573482baef959e4f7610c0ca4b935e09a17316fdd3d3ec58660cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779376185, "uuid": "1905cffe-4077-4369-8f50-bd67b6f05a4f", "value": "T16945BD02B3D6D076FFAB92739F5AB20156BD78250133892F13981DB9B9701B1233E667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779376185, "uuid": "46b82087-8017-4fa8-a207-5ff7f16c9abd", "value": "dcbf4f6f0a66c4ef804fdb68720c8682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779376185, "uuid": "47331457-00bd-49ff-b97c-0eeb4c0b0254", "value": "24576:/AHnh+eWsN3skA4RV1Hom2KXcmtcY9OWF3zrdsCzXBOoq/D5:ih+ZkldoPKsacYzzrw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779376185, "uuid": "cdc7769c-31d4-4f93-8f06-124f917c1bcd", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779376185, "uuid": "0689c02c-6d64-44da-8d66-4dd792c59151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779376185, "uuid": "6eea309f-77da-461e-b4ff-decd59a91ed2", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41436f91-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370667, "uuid": "91e35d0d-a9e6-44f2-832d-dfbe80a54f4e", "comment": "Malware payload (StrelaStealer)", "value": "43d406297d3f3cc15ef94ddcb4c18291", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370667, "uuid": "37eb0711-35c8-4e85-b668-c1e8e2c2c763", "comment": "Malware payload (StrelaStealer)", "value": "2c64c020b9acd77fe4ff8879cd6abb692e2b5a588da2974c329b145b47aa6da5", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370667, "uuid": "89dfa0a0-bda1-4767-97f3-a792c82c7428", "comment": "Malware payload (StrelaStealer)", "value": "c0f3c0b1a9dd723b1d158cfea64ef63d5d968e18", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370667, "uuid": "3fb61c07-d5ee-455b-b1f8-ecf92246ba90", "comment": "Malware payload (StrelaStealer)", "value": "739b787c655e3aa3abc6a77d717da9ec555e36b293d2475cb0bd70aa6412aff3cf7c33176b38fa49b96608af6cc2e75e", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370667, "uuid": "75d2b18b-f604-4a35-9378-6a29c5aa7f30", "value": "T102716C45797398C1D98967B57C8B2621D513C0E62B0FC654E7DEE1048A42FF6C4009BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370667, "uuid": "a768e4cc-4c9b-46d5-afa1-ae36e6f8e808", "value": "96:CEoMipJL6zSNw/ciI+I3NWt8tRJT+CmxeEgexNoUxxH:7QfGSPiIZ3NWt8VTjzu6IxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370667, "uuid": "35c84a20-90d4-4936-802a-655fefbd23a7", "value": 3754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370667, "uuid": "b0112f0b-321f-42af-b2c9-8c004ade6ea6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370667, "uuid": "9f4fd861-c1e5-4ac6-b7f5-9611e509d9c2", "value": "Verkauf_-_Rechnung.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43653889-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370671, "uuid": "49ca4631-d061-479a-9fe3-724c4f9427c3", "comment": "Malware payload (StrelaStealer)", "value": "bd6b2db4a0347022ed9eb6cd5fddf90f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370671, "uuid": "838aad1e-08a7-449c-8386-601154c3147a", "comment": "Malware payload (StrelaStealer)", "value": "2d0a98714f59984851d089045630ecebd2362cb7fe5f71d45395d0a8f7ee57ca", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370671, "uuid": "49761e56-f0fd-4b3e-98d4-e18a553e6545", "comment": "Malware payload (StrelaStealer)", "value": "579b8c6774c3ae30d6e1ec4dcc43a7705c7d70f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370671, "uuid": "54a6ffdd-d6bb-43ee-9d35-6275711d7c10", "comment": "Malware payload (StrelaStealer)", "value": "4f450ce1dd68ebf310ae999c4f98a1c69862f3d2f2bf3a7d1319b02a02550f49936964eb11c3fe6bf284512926eb2819", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370671, "uuid": "e9ab49dc-8df0-4869-a3ed-b190bec4ec4a", "value": "T12BE43B802E807DAC17A99948F6CE4B089DAFCB156D23C275B52D3C6B4F345FCE59482E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370671, "uuid": "3dcd7fe3-72e9-4e63-95b5-a4382c94a4e5", "value": "3072:eClzE50Z2IQqk7u/5cA3MmApVcMsdi7z0Wl9DuFt1PVbqtgIX7YAkOPEDWMt+teN:eC60+ihc0peyhdiz81Giu1GVjXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370671, "uuid": "208aafc5-664c-458a-9479-843db16c7f09", "value": 659556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370671, "uuid": "70bf1c08-b02d-4073-99ff-27a3a8650edb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370671, "uuid": "89bc68f6-6243-4416-b0f5-cda00faf06a2", "value": "2277927785982214354.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c11dc5-54f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779354027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354027, "uuid": "874d4874-c599-44c7-9c1f-90b964143f51", "comment": "Malware payload", "value": "38e64d575ead1e1453b0cadb44f487b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354027, "uuid": "f034ba18-ba02-40a0-b6f5-8ee68765ab5d", "comment": "Malware payload", "value": "2d57d3059ae3bf04aed0d9293bc212432908dcf1d44e3013a60f9fbe64d6af51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354027, "uuid": "60f2f14b-691d-4dc4-8a4e-6f78088e1361", "comment": "Malware payload", "value": "ffe605e17c44fa34ae7369d820c6626435925f04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354027, "uuid": "45936dbc-0f9a-4238-86f0-9fe6fdc45d7f", "comment": "Malware payload", "value": "4ca8ca7be35c634d6ee38b3989e371037d2c73424a1af2da3f11005aee495808dd108665c9f5666b3e9ad046c97fb6ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354027, "uuid": "c80cea53-74ec-4c6f-bd34-12631f54ba2a", "value": "T1D1F5BF07F5E640E9C01AC174CF6AA333FA77784A8521762F16B0A6252F7BF984B5E704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354027, "uuid": "04c7b620-dce2-4e51-b248-7e4b54ad8f6e", "value": "b8f7d0e0f83de4cae7f7fece4a2f750e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354027, "uuid": "a21c7d6a-b468-4644-9c9d-68c3cee99222", "value": "49152:EspMRI28259LtbjsjdbVmofrZq/zPhmFyuPAfL1s2OwGNbHRafa:E4b2aux6LNbHKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779354027, "uuid": "b89971c0-7228-4b66-aed8-e8dcdba7dd3d", "value": 3550208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779354027, "uuid": "33e31aba-1a06-41a1-87d8-e59d46420270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354027, "uuid": "01625b5d-2881-4c1a-8875-535133a7ee07", "value": "2d57d3059ae3bf04aed0d9293bc212432908dcf1d44e3013a60f9fbe64d6af51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc2c3d0-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372571, "uuid": "82a683cb-4185-4344-b734-ed26250e699c", "comment": "Malware payload (SnakeKeylogger)", "value": "3a2b7d57f2f3fc64f8c3e92788d91d04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372571, "uuid": "44e48a9b-403f-4cbe-b65e-4a1b7fb4dd78", "comment": "Malware payload (SnakeKeylogger)", "value": "2d720f57766050b9ac19ab38c1352f7b064bf194a616613468befdcaf4e51ff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372571, "uuid": "f0c02f65-bd10-468f-b30b-31926f0d7b41", "comment": "Malware payload (SnakeKeylogger)", "value": "e4d6046879d034600c3bb82c9cba79a13ae989e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372571, "uuid": "6242a043-0928-4dc4-981c-ce6274623a73", "comment": "Malware payload (SnakeKeylogger)", "value": "47b83194c448bd46dd959d46b06bd256678edb19a9e1b1fcb7291837a17a0ac6cf4c79919e1b073ad9be315dbaa771e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372571, "uuid": "3f92617f-a38e-4103-a986-9b94a5f88ef5", "value": "T1BB359E2263DD83E0D6A65D73BE1963007EAB3C654920B45FDE442DF8A963361D22C6F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372571, "uuid": "e140cb27-428f-4c68-99f2-ab22b171292a", "value": "649f6ed9a4d576c154bbc0357156a4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372571, "uuid": "42c78af3-c462-4ebe-9088-114cbdfa8573", "value": "24576:HCdxte/80jYLT3U1jfsWaFA80jWulsJ2QY/Q:2w80cTsjkWaFAbjWuGJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372571, "uuid": "32a7f527-54b7-41bc-88b8-144f20cccdb3", "value": 1159680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372571, "uuid": "6f7b3e1e-1c1a-43ca-ae77-93d093275e6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372571, "uuid": "7f700948-8132-4c5a-90a5-f29967d20c45", "value": "Purchase_Order_423737.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712822ac-5523-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779374613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779374613, "uuid": "d2e1c559-fbf7-44fe-8ce7-a3f89b816aac", "comment": "Malware payload", "value": "3f92fae92579244974272a80c9870fa5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779374613, "uuid": "540bddaa-cde3-4b46-9ae5-1afa09a4808c", "comment": "Malware payload", "value": "2dbebbafe9d931b6a9ed9401aaf06acb31d341413f77adecb7c7e4e0e904de9f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779374613, "uuid": "a374984e-1ecf-4be8-88fb-58ce1957bba8", "comment": "Malware payload", "value": "6bffab0a3b54380fb3d3f010cac3c415f0d0b567", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779374613, "uuid": "2936866f-d262-4030-bcc7-572cae409115", "comment": "Malware payload", "value": "bf3a3373de4b48651ba2f1634f363c64ce4dfd3a9ff8c479700b7e3f6536beff676feed80768fb80a6044798e61cfb8a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779374613, "uuid": "797a409e-4e7c-4280-95a7-d2f5942f093c", "value": "T1FB51EBA2474E457FF29E0E10586F085A30FAE5597B810B5917B35AE77C3BCEC8832613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779374613, "uuid": "ea7c4d41-0413-4e75-9af4-f726bd75896d", "value": "48:GoiIrKQN0yO/HtDATv1/veotY4llW+gg+5++5++S++cG8rgoeoCC4fRt0FRorcHa:XFGQqNEzlXtYID+5++5++S++3DovmIRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779374613, "uuid": "3590fefa-46e9-4e4c-94e6-d6489d881078", "value": 2541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779374613, "uuid": "a8755076-2777-4cdd-9adb-36d0d1c89c55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779374613, "uuid": "5b02eff8-18c1-4886-9b73-2d7c4f410635", "value": "sw.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3acbd8d-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372577, "uuid": "f38b2c23-6ef0-401e-85bb-5bbb9d68ece9", "comment": "Malware payload (Formbook)", "value": "e8f66c76388efbf21133b4a0053e5f6b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372577, "uuid": "89f57d7b-a432-4939-b50c-f447533249f2", "comment": "Malware payload (Formbook)", "value": "2e00115f6619e490151ce9751d74bb04cc1f0dcedd53d833ac3de273e0216a6a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372577, "uuid": "d3b2eaeb-0fa5-4a3e-a5d2-ac73400b091f", "comment": "Malware payload (Formbook)", "value": "0d324c809b278744a8efc6b81e96e155b937bb74", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372577, "uuid": "05a97c05-ccaf-4f21-b8ab-21df504e38c2", "comment": "Malware payload (Formbook)", "value": "8b8164871c3ce53bcb63b1d46c78813cfec9e035658183f03ba75e662f82e4429a971c1df288aa5bbbbddc9f225e6581", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372577, "uuid": "c3f0c97d-4c0e-4f62-b9e9-e7cd37992726", "value": "T19B153377AEA2F6B5DCC37C35A2C3656B282066B43A5FF508F3025E5D4B36380B878945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372577, "uuid": "9a187b78-85a7-4183-9b33-b46da92f8cbd", "value": "24576:msAGB8Cyla93SDL0NWqDm1ZzIArDN67CxcBs:mVGrS83SDL0W92Bs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372577, "uuid": "a3fb86fd-07fa-45c3-a7b4-0cc0b98416d2", "value": 942983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372577, "uuid": "c48a5abc-4c79-4dcb-b387-0bdbf84c526c", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372577, "uuid": "b4e60dba-b508-4421-a134-431ab8e23ba2", "value": "PO#86637.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71401102-5507-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779362587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362587, "uuid": "6d906b7c-d0fe-4532-b0e3-e1c2b0a225a3", "comment": "Malware payload", "value": "d26eb0a58495f98585e170342a1bade5", "object_relation": "md5", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362587, "uuid": "8170373c-506c-4251-88bc-c027d7ca8cca", "comment": "Malware payload", "value": "2e1c656bff2b0cf128e9f1ac108b63240c1a10f428b6eee1b887e526559e786d", "object_relation": "sha256", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362587, "uuid": "fccae8cc-d6e2-4f80-85d7-f9149bfc13fc", "comment": "Malware payload", "value": "84aa4e62c1c3278296602b86db16f0ba0af8bc0b", "object_relation": "sha1", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362587, "uuid": "b7d82057-2fb7-4277-884b-4b619920e33e", "comment": "Malware payload", "value": "21c4912f451de869bb4e9f6a30a74273597848e2b157b5181ad7e02a63d230857781aefbbc9b4e3940bac7b2272028d6", "object_relation": "sha3-384", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779362587, "uuid": "9be8e322-d000-467b-8f94-b581a96a9a02", "value": "T1781197708800087560A73CDCDE2F889630F219DD9FA7E3CB8F7285E8251C6A6D08F835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779362587, "uuid": "a820672e-0774-4e9f-8c8f-552a2af2e898", "value": "24:QwjszqC6E1GRpuC0JzcyohsCABmAEPiEcy5CJRVECSCV3sOF:Qfzq+14puqyohshaJuRVEPu8OF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779362587, "uuid": "2cad9ba1-6204-4693-81ca-a3a7984b8746", "value": 983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779362587, "uuid": "7e29e045-1684-4a88-b889-2f3bae455133", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779362587, "uuid": "c206c8e6-9679-4e1b-9a0e-aeee7b2f7dfd", "value": "2026-05-11-part-02-payload-extracted-from-initial-download.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4550caa0-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370674, "uuid": "b7a98a72-f9a2-4982-84db-4736d44238f9", "comment": "Malware payload (StrelaStealer)", "value": "d0632f3ea9f37a9ed61ad779e89a9364", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370674, "uuid": "19b55554-8bbb-4b61-99da-ec8110b40752", "comment": "Malware payload (StrelaStealer)", "value": "2e25fabd5beb23863e85ad47d3f109b474a884dd6b85af8639c557fc059d5c00", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370674, "uuid": "f67d25c7-326b-4a39-96c7-b6d141c9c278", "comment": "Malware payload (StrelaStealer)", "value": "78d25d4a202b5dce4728ec00ee736f19830faf34", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370674, "uuid": "a983bb8b-3111-42b1-b5c3-ef9806c40b14", "comment": "Malware payload (StrelaStealer)", "value": "ed1b9be79bd28244aaed8d632d4feb34bd37b815cd961f745ae6f741b0e43d1f54f7a0f4987c5d7fbb31962b2bc89f5a", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370674, "uuid": "c52b7a80-db7a-40ec-a935-856812b3690b", "value": "T1C23107E89EBD5930C507D17319077A49EB54FEBB9038CE42DE95C964222E809882F4A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370674, "uuid": "b0a5d5e4-c987-49de-9c31-50feb7304a64", "value": "48:9cu/HZdgoIlBJhIOCiaDU0EN4+CISws3CEarMu/Cd:6e6lvyiiU0EN4RFmQeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370674, "uuid": "2e08b4c4-0739-49af-be2f-293616a2f973", "value": 1636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370674, "uuid": "43727f37-389c-4f8d-ba8a-9b81f46495e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370674, "uuid": "a6eb228d-a3be-4ebd-91b8-ec6c5f08ea97", "value": "RechnungX25931XvomX11.11.2024XMandantXX30857.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f939fea2-54b6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779328026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779328026, "uuid": "0762674e-c4e8-4cb1-bc0a-e55e839ba972", "comment": "Malware payload (RemcosRAT)", "value": "7fbb5494dfa0f9fa5929792f19dd3a6b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779328026, "uuid": "20418027-5cab-4322-a407-fc0c3b1036bf", "comment": "Malware payload (RemcosRAT)", "value": "2e69659d1120b42482fea319c433be91d6f184ea7509314dec9355c2eaa14965", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779328026, "uuid": "7f3c35c2-f461-4393-bea1-97cc82df42da", "comment": "Malware payload (RemcosRAT)", "value": "fda3eeffcc3ac9ddfc83816365573c74666893f8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779328026, "uuid": "61e9da75-be14-43e4-837b-cd24fea3beba", "comment": "Malware payload (RemcosRAT)", "value": "f8fbcbbbd1a01ef77038fdf950ff2ba69efe6ffad568bb39c371ffe43c5a72aa655768b15b915a8f88090d74c249f0fe", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779328026, "uuid": "d9bfa0c7-be9b-4cc4-b432-b3ca423caf8f", "value": "T1F705AD3F9229FD9402C5EC53DFF91F9900EE7D9591231B749E50C02EBB48608A7E6A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779328026, "uuid": "14013554-725b-4e21-b50d-8a2eb0dbb73f", "value": "12288:C1Fm689YvL9x6WtrcUJlCfA3vep/hS3Nq6a5eoINUk79vSxSB7mj4WwSGbr6jTLh:IvDrl2FtMdqn0JnZvmcW2O9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779328026, "uuid": "5bff8f40-a14a-4560-8e13-9a22e2a5b5fc", "value": 826186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779328026, "uuid": "b1a5c189-5eff-43e7-87f1-45e17cc5f6ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779328026, "uuid": "79d10501-dcef-481a-895d-1f32f5c4fc03", "value": "PoultryWarehouse.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47686cf7-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370678, "uuid": "6f219c4d-bdb6-4052-b9c4-f2c8fa469350", "comment": "Malware payload (StrelaStealer)", "value": "6fe9147c523f08967547c4479a8fec88", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370678, "uuid": "b9fb3a38-8099-4325-aa28-1a13f48cd289", "comment": "Malware payload (StrelaStealer)", "value": "2e81fc625f21ead24d87943fa7e7022c7c47d50c9af5664ba78fd85cb2401ca0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370678, "uuid": "2c2db95e-d9a1-4286-903e-e3075a3290ec", "comment": "Malware payload (StrelaStealer)", "value": "8b422835e4c22757a681ef0017a1c08a46bd51b1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370678, "uuid": "d80c1a77-9ed9-40e7-8c3d-1daa8afe0692", "comment": "Malware payload (StrelaStealer)", "value": "cbcbdfbf560a3d3f1636448e18d57a0fa4c5dd3c3eb8cbc6c473701d2be0ded5c56a703b6d2ff4002504d59a058e90ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370678, "uuid": "3358b4c3-9128-4b2e-97d1-ad1ea631ffd6", "value": "T162450960B1673FCF4E6008DDAE9F0AF048C601713DD5D4DD6A9AA2A3D102A58F6D7E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370678, "uuid": "2b1376ef-ca32-4b35-918e-6617a521e36a", "value": "3072:S++aIHBgSlV0fJLtpVpMiyl+s+5oUVQBUz5oOHrmkY68aw:S+HbfJLtp3wC5o+iUzlTYcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370678, "uuid": "a3c808a7-478e-447f-8234-7cc2aaa39bb3", "value": 1198909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370678, "uuid": "f861c6ae-1607-4b37-9171-9a8af147042b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370678, "uuid": "da5fa842-5cd0-4db1-8d28-0d6c36c4c756", "value": "2569419712856021590.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a848d6-5507-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779362677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362677, "uuid": "5560e5a1-a6e2-425e-bff0-13cc77c704fc", "comment": "Malware payload", "value": "bfba273e7f58a474e54970e99b9bbd8c", "object_relation": "md5", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362677, "uuid": "30e5401c-2b23-48f3-bfcd-0ec1f339f09e", "comment": "Malware payload", "value": "2eb62756704f169e6da9f0921442a637cf67aa256ced56226cb265db5838b239", "object_relation": "sha256", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362677, "uuid": "6f0cd52c-dc70-42e9-a012-1d4e94238499", "comment": "Malware payload", "value": "b42a4f13ff82ae0c56e1c53b40a44809f3bd5388", "object_relation": "sha1", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779362677, "uuid": "c951fb4a-452d-4c05-a19b-75a91fcb31e1", "comment": "Malware payload", "value": "bdb9c8af6acd24f3d915a794d8ba2d5fbe54543892efcc7910ae874cd9b3540e9aa5118c117dc6231445f167691afca2", "object_relation": "sha3-384", "Tag": [ { "name": "dedelk-com", "colour": "#EB9A74", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "suzke-com", "colour": "#8E17DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779362677, "uuid": "483cbaf2-ad49-4bb5-95ad-05dfab962e40", "value": "T162B33A0B1276F568C9A5C5302BCB8BF3AE11FC3119A3596B6740F3762EB98695F10723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779362677, "uuid": "a16f72a1-b6fe-46c2-b25e-49b5ac3cd9fa", "value": "1536:MkGcEYYJR1kiuJGdrP8h+oxtDbyU8utLMUukC0g0Ub39OHDI0q9I:VYb1FuMP8DxYUdvg0UbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779362677, "uuid": "b70e8a5b-bc8c-4216-bb55-e280c8680f60", "value": 110352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779362677, "uuid": "15c0534b-4bce-4051-acd7-01faf23e16a3", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779362677, "uuid": "db3463ef-8629-488c-a674-e880c39c101e", "value": "2eb62756704f169e6da9f0921442a637cf67aa256ced56226cb265db5838b239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bae179-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372581, "uuid": "2dc4aac2-f08e-4ba0-9411-f0227fabc824", "comment": "Malware payload (StrelaStealer)", "value": "3ee6505d9d40f73602c4bbca5069fe1f", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372581, "uuid": "cb92eb57-6ffd-4082-b6b1-0ed2a25d1515", "comment": "Malware payload (StrelaStealer)", "value": "2ee7aaebca65b34dc671e58ac55f564ce3151d53bcf1ed20cabc93ac900b4558", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372581, "uuid": "9d620d46-9859-4057-a576-7600e8c87511", "comment": "Malware payload (StrelaStealer)", "value": "b094310914e184b7a3fcb061613fbb94eebf787f", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372581, "uuid": "b33b45db-da37-4113-86ca-cc8561afd10d", "comment": "Malware payload (StrelaStealer)", "value": "18a9d10f1d82403f2355bbb43e46811516443976064bcf425cd86764c60a19b7f7bf3ed1cfee90c2ce9d204e592a0813", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372581, "uuid": "d8d242c3-8b17-4c8b-9ab0-a27c00634c17", "value": "T1E931F9D6A6396806E2BE9DFB1D71D049DDCBCC06626C2115AD3C320598D615E94B018D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372581, "uuid": "0129fd62-129b-467a-82a7-9ddcef73eb56", "value": "24:9Zei6gUTJOyA/QUMm6nqEdDvpuOAIBIRrXyz9g/SYDeiK9e3v+TXT89dcG:9ZDM4T6qEd1uTFn/zo9emDwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372581, "uuid": "332a1551-afb4-463e-89ad-d7973dc259f8", "value": 1516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372581, "uuid": "006e03c7-c23a-48fa-90f3-7bb639fd9ac0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372581, "uuid": "58e74f17-d4df-4f9e-bdd8-6c896acd0fe3", "value": "I01033740A5P46-copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c10717-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372584, "uuid": "5fd6825a-e910-4402-a447-c8d738d4a996", "comment": "Malware payload (AgentTesla)", "value": "f24a49a7156a0818b3cfb324435b78c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372584, "uuid": "b01a6792-6e8e-4fa6-adb7-b6e3605078d6", "comment": "Malware payload (AgentTesla)", "value": "2f0757eaea8b6bfc668256150fff4773872f83f2cef9354d6b386d284a597041", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372584, "uuid": "1e2e23e6-4697-4367-be99-962f5ac0fcac", "comment": "Malware payload (AgentTesla)", "value": "f917319e826057fc33d8fe0db64df871f761bba5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372584, "uuid": "4870437c-0e6b-41ea-8b8b-6176c264ba54", "comment": "Malware payload (AgentTesla)", "value": "f994b46fe7207ca0d14eb88a7809b25ebcb1d3c824ca00ea9864d1bf70c8fd3ed3068b6caefb5b1688ace761bff94ab3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372584, "uuid": "d28d6879-b696-4b79-b396-54a54abfec4b", "value": "T1CDC4234936C5147A5834CBB026BA2FACADACF581276466074F32F39DBB1EED460B5C1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372584, "uuid": "c7772355-ca3e-45ff-b3d4-0613c121f97f", "value": "12288:MP2ZXhWpkFiU9wKhW23I70rU3HbVNq4vD8nwm2/Q1nDui71p:MPpkDwU38YU37Vk4vawm2/QNicf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372584, "uuid": "36380eaf-2293-498c-8448-72db3c1fb95c", "value": 544033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372584, "uuid": "4ac3cdf0-6640-40e0-bbca-bb94ab265617", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372584, "uuid": "2e4ac271-143f-4836-83e3-1a086da21f3b", "value": "46150647.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c07bfb-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372587, "uuid": "5eab30d9-d72f-40e3-8aad-5ef977610ab6", "comment": "Malware payload (AgentTesla)", "value": "9c300fd440cae082ec1fe2cb47d9012b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372587, "uuid": "040413e7-704d-4f3d-a94d-5ed4cf0f7699", "comment": "Malware payload (AgentTesla)", "value": "2f28213bad81f4c67d4122128da38af664d2e9cbecbd863533e724c808f1130b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372587, "uuid": "918137bd-63c0-4fba-8fdf-56149a36b685", "comment": "Malware payload (AgentTesla)", "value": "01970ef6476c1cb49cef6801cd80ecd8ddb90048", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372587, "uuid": "736902d2-2ed6-4836-99b7-c8c038dece9e", "comment": "Malware payload (AgentTesla)", "value": "6a6fa20b4434adde4411c8ec41c9da335177db29df52f21af736a9bc902c6a925b36c9ce0f65436fc267f27e0c51a8cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372587, "uuid": "95ec6d56-34a6-48be-b5aa-fee602f10d4f", "value": "T14BD423A27E422560BD84C714FAAA10365910D073F6F0F9DFAA9FD051B068473ABB35F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372587, "uuid": "cca8f3f2-40f8-473b-8ba9-f9a26a9cd896", "value": "12288:wd/o5nG3uyU2+3eIPGuV6zW65aYJrGTGI3dqLw50/02CnLsWYIhE9rLuKEOy6l:wehimZ3eIOL0lU+0/0LnhE93WOyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372587, "uuid": "62eebf05-77fa-41eb-8812-2d2f20b3d495", "value": 604659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372587, "uuid": "abacd0b7-9ce8-4b50-8f67-ca96c25d2d52", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372587, "uuid": "533b85db-841a-4d92-9846-55cfd53f0887", "value": "QUOTE-2K248314-A-CCC.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea80600d-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779372669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372669, "uuid": "ba930dc3-7c83-4a50-9455-0f9ce8e5a90e", "comment": "Malware payload (Mirai)", "value": "3c552ce281ed14f32ca97c9a9e17e591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372669, "uuid": "34645ce3-0e8a-42ec-aa77-b5209712da51", "comment": "Malware payload (Mirai)", "value": "2f8bcd100590deeacc75f9d9632b9be3081457027faea6891cd54642725b70b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372669, "uuid": "2327f97a-3b7a-4162-b0a9-a5e2363bac6e", "comment": "Malware payload (Mirai)", "value": "319feb2d3e2141f9633a6499c147cad3a4ccc703", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372669, "uuid": "0e88c546-5ff5-4246-8726-b67e02e30541", "comment": "Malware payload (Mirai)", "value": "704b15be355e7cc0eb509a22f4cfae1f4801a880e64ace1519fd936c0280d202603fd7ed53098bf1731d0ba300de219b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372669, "uuid": "ca6ec1b5-6822-4dce-a29d-7cc20ff9aa10", "value": "T14BC3F705BB611EFBDC6FCC370AF91705388C591A12F96B36B934D81CB94B21B1AE3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372669, "uuid": "0dd7d930-98bc-4788-8083-de02cabaee53", "value": "1536:eEZOI0LSQ7ackP71oYcxVu3PJn6uFcz88NhSyeUlyhNIWhZmSdD8O2Wh:eEMIa7ac4qVu3PJ/y7h9oIWhf/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372669, "uuid": "5eb38d7d-a2d3-4828-b22f-f9fe9d435aca", "value": 118500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372669, "uuid": "3414fd81-744f-418e-bbe2-03ca01f925c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372669, "uuid": "e52b478c-b4b2-4283-8a4a-733fe5cd91e3", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af7802d-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370684, "uuid": "771e5e2b-057c-4b2c-b8e3-fff9446c2c64", "comment": "Malware payload (StrelaStealer)", "value": "ff136d0d069745b7a09e78b2483e7bd9", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370684, "uuid": "4e97a74d-97c2-4d2d-83f3-0e186445f171", "comment": "Malware payload (StrelaStealer)", "value": "2f9e8bc9f844e57f8edb191ff7e056ffbe10bcbbffac5f68fe49b018d6ef366e", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370684, "uuid": "c994e08b-66c7-49a5-b82e-d6bebd1871dc", "comment": "Malware payload (StrelaStealer)", "value": "6ca376df22b5bd45b6d5117e878f0a92ce792f30", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370684, "uuid": "9768df71-210c-4d68-9d6d-48c7dacd6272", "comment": "Malware payload (StrelaStealer)", "value": "78c4e3db36d74a190961888de067e9e5d9ca33b132cbb25f91b2b4936bfd0a6866558db21879e1b047455fedc9d2ba07", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370684, "uuid": "fb6ecf3d-b6bb-42a1-8f60-7bcbe2238c71", "value": "T100141299F224A973DE53ECB2AE35D6622854CDAD6D670DFF23B806EE106F7593381100", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370684, "uuid": "9ed5f192-18da-4f09-8313-35066343b830", "value": "3072:0fpEvIRH/d9u4tYZlD0KKvjrs1dmZs71oOwgL+WWWCYIEJQnrbErwX5N1doTUYLD:cOIRVMCY0HjrJzgiWWW5G+wXldormTRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370684, "uuid": "4bd8fdc7-9481-4a2c-9c53-59e2a041080d", "value": 192582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370684, "uuid": "d0f34916-6935-44c5-aa2e-33cd33a2e79b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370684, "uuid": "395fa8f9-a77d-4f90-bdcf-46e7394dc454", "value": "Rechnung-NrX240620.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf75b56-551a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779370687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370687, "uuid": "b81a5391-29be-47ac-a9e1-279d56019d84", "comment": "Malware payload", "value": "289ae60103a3752ac5570798f8300ee0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370687, "uuid": "7e85f238-7dd5-4362-b16b-4b995a2e13ef", "comment": "Malware payload", "value": "301598e4237e8607982423bfdc4900e13e40347a6bc95392b28fb49fc74bd261", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370687, "uuid": "ce1dcd90-dffc-40e0-b9b1-61e550989990", "comment": "Malware payload", "value": "13c9f5d9f70807b7ea1bff9a44d0a2e910ce1b15", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370687, "uuid": "91696f23-0634-4696-ae4c-867964f13371", "comment": "Malware payload", "value": "2d13b2c3401aac71c9cd59e1cfcdc6043091506d356d3ba6b870c4fd0e82d44e123809ec55d0ef68be745883277cb02b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370687, "uuid": "ff6495bc-7b06-4fc5-b812-c2bde7f766c2", "value": "T13372D0254100B93AF9879D28243678A9615108B9457FB3AE7CDF5E3A33E163D0BB836D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370687, "uuid": "ae928445-2d8b-420f-92cf-93db919f012f", "value": "384:roiDqFnDHTKkRvjL2nXi3e5ddaPGXV3iCYcis6HWsm18:rfDqFnDHTR7yX0GXVSC1irRm18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370687, "uuid": "9fa34fc7-0054-4bec-88fa-ba5c7cda67e5", "value": 17138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370687, "uuid": "f629c951-4fcb-40e3-b612-33f4096ba877", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370687, "uuid": "4f9373b4-0da4-4f84-87e5-5aac46b56908", "value": "RG402403755.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee3aadb-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370690, "uuid": "0b0655e9-7cfb-49c5-865d-0b336345f063", "comment": "Malware payload (StrelaStealer)", "value": "cbdb9feab03daaf2dacf0dcc445714c6", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370690, "uuid": "731e784b-e65f-4f77-a16d-57acd64ad45a", "comment": "Malware payload (StrelaStealer)", "value": "3079ba35a5cb70e2252c68e7dcecd7e2a10ae6364c5a0f9439c7310eb1adc034", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370690, "uuid": "a0f2a305-3bb0-4d0d-856f-5351f34e1ec3", "comment": "Malware payload (StrelaStealer)", "value": "8f5543d9ba8f7307b19c5f4245e63bb07e5af17f", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370690, "uuid": "375c1326-822f-4186-9e23-ab8a16d6318c", "comment": "Malware payload (StrelaStealer)", "value": "511ca7cc175913dbe04fd39ae2c67c6c5482df2dffb48e57becfabfdf61d176e0803d7a919854787690d7a3f9d83e824", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370690, "uuid": "599f8c79-1c67-48c4-9f4e-4139a69635ee", "value": "T1D2A2C0015138B86B952786654DDE0426CCB45642FFF7AB72EB7A02C7B50D880EA7BC22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370690, "uuid": "061bc3d1-a32f-489f-9ba5-e1f4b49b9962", "value": "384:ue95e1ZZf9ifuJDW2rlN9Tv48h4FAZrKsrj6Z1xzwz9QSU7xYu1CB8n:uaeZ9BDPxj7H4F/NMzq2uHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370690, "uuid": "59d21dc2-2736-4661-b877-82ecf4894348", "value": 22123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370690, "uuid": "4c38bd40-1e5c-4c51-905b-4e40cd8d3c3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370690, "uuid": "c9d3f796-f66f-488b-9c1c-53ebcbbc9c4b", "value": "Rechnung_2400367.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41a1d09-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372605, "uuid": "83131cef-2004-464a-90dc-dcc991d0c3ee", "comment": "Malware payload (Formbook)", "value": "1982129b4d46d7568f5e164ebc6c000a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372605, "uuid": "706c8736-ea30-45c5-bc4b-ebfd6a33edb3", "comment": "Malware payload (Formbook)", "value": "31729602572d78a3e578704e9eee8878c5c434be5a6df2656640fb6e76545c46", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372605, "uuid": "d850679a-7f93-4d19-8b43-140b7d4b816e", "comment": "Malware payload (Formbook)", "value": "a0f318fde556d4f3ea4439e7d3cd0ebd9fb534c0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372605, "uuid": "d6a6f5e5-085e-4490-b471-53af9c30d34d", "comment": "Malware payload (Formbook)", "value": "115342b522923d21508ecc6316ceb5e3728dd59d7b12283b0a0563e156db45379c15a1f5d32519fa455dff6a0ba5999e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372605, "uuid": "3c6fc15b-6fca-4424-8329-acd032e2577b", "value": "T1C3D4233FA1F6E40B86F8B1361A5D3201C0E19B1D6A4E75C7DB7E5E34ABF04AC512E918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372605, "uuid": "7d834628-eff3-439d-ba65-4d5f55caa457", "value": "12288:hpE+jBkmugPELUSNo4LuH7GO7fc1U3RaLwGUU7KtGjLekNLQqW8x9:hp5jyBgPEgt4ROgYa8GU4LjpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372605, "uuid": "eb8bf10e-bd4c-4cc0-b240-c01d0a9959f4", "value": 603140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372605, "uuid": "deeaff38-7fc1-4931-9f61-e5f54aca624d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372605, "uuid": "2fdbeada-4a93-4208-97c3-38cc36714fba", "value": "NUEVOXORDEN01_202407238454854.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e72247-5514-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779368185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368185, "uuid": "ee672f84-4378-48cc-a4dc-1682e4a5a3d6", "comment": "Malware payload (AgentTesla)", "value": "092ffaa75f48481bab76ace5ab9f0910", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368185, "uuid": "2ed686b1-fc91-4f2c-967a-6f3f9b56d854", "comment": "Malware payload (AgentTesla)", "value": "318ced91bea8f8ada8f96c28a036d67613128f8393c93afcbf711710a0af5713", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368185, "uuid": "237bdfa6-f589-467d-8e96-224216b6982f", "comment": "Malware payload (AgentTesla)", "value": "554604b79427cfe1b31a40b42016558525cbec43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368185, "uuid": "c93cfb5e-1e08-412c-a38e-391f64581412", "comment": "Malware payload (AgentTesla)", "value": "6e29596eb8652d7ce2337fa1be264b54c6667529e36b5ebb4d021102d2bb3e7857ab2d1ec4fdcd2dcbd8de4cb12fad9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368185, "uuid": "4f27db2f-a899-436e-ad8a-186b1868b149", "value": "T1332523144AF7BDBA437C882D14FEFC1C12604DDC2C99619BB5FC5483EA96FE1A1AAC14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368185, "uuid": "d06e56ee-5443-499a-89e2-6ed7d1e6de37", "value": "24576:sAmBBIzEHMJ+7a0Qh+WqZmSH0gGS76MR8Rl9PwPmo:sA4k40zq4GR8Xgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779368185, "uuid": "36a7b789-6ab4-4adc-9c0f-89c4d52eae20", "value": 962268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779368185, "uuid": "96b5635c-b8bd-406c-a413-a747ec409797", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368185, "uuid": "1520294c-f6c0-4e30-9d78-be34db8dc195", "value": "318ced91bea8f8ada8f96c28a036d67613128f8393c93afcbf711710a0af5713.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ebb6c9-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370694, "uuid": "4f0e402f-c6a9-4be1-a0c6-653af1cf9d0f", "comment": "Malware payload (StrelaStealer)", "value": "f3fa05692b1ed31eba64ea2e1d351972", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370694, "uuid": "a4a96bb1-067b-48c8-be0e-49eb3a93c293", "comment": "Malware payload (StrelaStealer)", "value": "319aac9eb6d16a9233a8e722f9a35d763217ad79e921c765657b69794915a317", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370694, "uuid": "a5df3172-025a-4650-abd9-7f8821ae747b", "comment": "Malware payload (StrelaStealer)", "value": "9754cc95eff08202148107bacc2611575f251fe7", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370694, "uuid": "fb8a0c02-a1d1-4399-8b9f-5b7afde2daef", "comment": "Malware payload (StrelaStealer)", "value": "837cdeeb2a8e3bed61d4ee6f281e5eea26363e1964878accd7a2ee050a80d8036a38512275670b2435fdfde04fb4fc32", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370694, "uuid": "2bfc3a83-791e-4f52-bc4d-dc1dc909c5ce", "value": "T1956412A286CD5D23646729C719DF7C7BE6BA3D72D0345CCBAA164CAE510B0584AE0CFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370694, "uuid": "3cfc2b44-1f48-4d89-a157-46c76ce1c7c9", "value": "6144:4Ei6TUDypn+QkigDAcHE90aOzZI6F4ASnmEH4sXt9Z9Q1lBsyI0d4ey8DCl8:4Ei6TU2pnvkiWAcmezK6zAmW40r9ZFV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370694, "uuid": "bd5fd2d0-3540-4990-86f3-f25650044605", "value": 318314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370694, "uuid": "4ad6327a-72bd-46d4-a5f7-4e2498056271", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370694, "uuid": "03c1093a-c704-4e17-90c6-e382b38e1fea", "value": "Rg-22400799.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972ac86a-551c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779371670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371670, "uuid": "5fecd094-90bf-4de8-827b-f980078f3f65", "comment": "Malware payload (RemcosRAT)", "value": "42fdf7390ca1d295a0ea7dfce75996a3", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371670, "uuid": "7314e77e-70c3-451d-a5a3-6613002af2c0", "comment": "Malware payload (RemcosRAT)", "value": "319f35ca0465d8d7556aebdd6bb86720dfbce7390a1f02871b91715730d2abcf", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371670, "uuid": "facb45a9-0942-4e6f-bf09-7bb4ff847f2d", "comment": "Malware payload (RemcosRAT)", "value": "bb1346a2ce5f4a9675d3907b3111562120102784", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371670, "uuid": "3ef5c2cd-8b79-4ef7-a0e4-c7d5f4cc8c4e", "comment": "Malware payload (RemcosRAT)", "value": "65b3003c713ca641135cb1b0909712dadb146f2a8b94650a2f3ea6d91962fd8a475ad30962fef527994229d7ab98e4c9", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371670, "uuid": "a5be9711-e1a3-4ff5-a0a3-8312f9ba4308", "value": "T10632D17CE1604F89C5BAFC33D0A9991E7D750AA7C99185C87617093B4C4F1A22CAF1C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371670, "uuid": "9b7ed491-10e4-41c8-b066-88c5d87e7afe", "value": "192:r3r8SdFjYRNgdhnrKh99crh99K0Na+c/LdCjC2Nb3Toj97XvKKj51i9jL+Cu2L:r3rNjGsxKYDNaJIjC293I97XvDrwpu2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371670, "uuid": "87f84ea4-6b95-40ea-aa27-b60079517c51", "value": 11301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371670, "uuid": "6cf954d3-53d7-49f7-8b58-4301942f81ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371670, "uuid": "c07365cd-2be0-47e8-9afc-4e950a91b86a", "value": "NewCopy.gz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80eebc4-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372611, "uuid": "3a99b0fe-41b0-4cc0-9cdd-57bebb40ad9b", "comment": "Malware payload (Formbook)", "value": "16bdea5d3a3afcf5a0475f6bc9a866e7", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372611, "uuid": "7bc70b91-a3f1-41c5-8f49-84cfec05632a", "comment": "Malware payload (Formbook)", "value": "31cbdc36726a00741defafd987734c58dd06d6ee32aea64281bbea43669c82f2", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372611, "uuid": "3cde9803-c89f-4970-b2c6-d2723b964470", "comment": "Malware payload (Formbook)", "value": "42667d0fcde9394ae02d870b4c61ffad9348fb8d", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372611, "uuid": "4cf3eb08-29be-4376-9020-2c9a8b6ae618", "comment": "Malware payload (Formbook)", "value": "17fa2602ff94bb7f13a8f1aedcdc17e8fde9c391593710360bb8c60f9a63fa4436503710b085cdeee3dfc46b04943846", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372611, "uuid": "6a324f48-bcfb-442a-abfb-5e3fc3e229f9", "value": "T142D433DF6402672FC18E79A7AE3846431B1B5CA69C5FE3D61265A720F7E3721C983432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372611, "uuid": "cf11275a-da10-4762-8390-e5664c8ba82b", "value": "12288:kXT8GrzqDoDUcCo1aJ4TkshhlbT/3vSJC0s+JpD1E9J0Mh4:kXBUod1esksBnyns+JpZSmo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372611, "uuid": "0f969073-5d76-4bbc-84df-c90c0b92fc65", "value": 637092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372611, "uuid": "1008edbc-ee90-4f3a-8426-b076bdc50b0a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372611, "uuid": "93578519-9b22-4dfc-9e2f-a07915b8aba7", "value": "P.OX.Arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90d369c-555f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779400477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400477, "uuid": "e056c47a-4eca-47f1-bb74-7476a4125cf4", "comment": "Malware payload", "value": "562b720cb6bebc400723b015a85356b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400477, "uuid": "7d726cf3-bc73-4b5c-b8d3-45df00b6a44b", "comment": "Malware payload", "value": "31f3d49b3aa1561facf94ccb30db3e14101e235fd8ffba391e50125c6f0c703c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400477, "uuid": "53f099f5-0089-488c-a657-86a0b9da889a", "comment": "Malware payload", "value": "ddba04348628d1b0ca96bfdd1185616abd6f3736", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400477, "uuid": "96c223ab-61c2-44e3-ab56-ebd9f0592e9e", "comment": "Malware payload", "value": "c38c57f1fa7240183e89d63c39d6742b4c77f3193bfcfa19903375032555a27adc7da00acf65893583eb1b6c25c1c7b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400477, "uuid": "c639cb49-cea2-4dad-b133-3704548d0e87", "value": "T13F15DF66BC419A52C4C026BBFA6D8188330717BCC3DA7506ED14CB3572EF89E4E3AB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400477, "uuid": "c0ce6629-d0a7-4635-8032-163e3040a3a5", "value": "24576:eJv1uunnhdkLpP7dsa+Jy9kV6uFjmPCygdU1w+qm:iFG7kqkvQbqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779400477, "uuid": "ca69e9fc-4a45-439d-9a40-49e956f7bb64", "value": 881658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779400477, "uuid": "b850650b-f8c5-4c88-97fa-090385ea0086", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400477, "uuid": "4bde0bbd-43b1-45c2-abca-d1fdf45bad6b", "value": "atbtjft.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54d3544-5513-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779367909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367909, "uuid": "0c287d2e-69c3-4406-ba30-666d3dae437a", "comment": "Malware payload (AgentTesla)", "value": "41bbbd11ee18968e05ede087dddb50df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367909, "uuid": "2f813640-2cb9-4375-8a34-944516dc686b", "comment": "Malware payload (AgentTesla)", "value": "3235d1e6d69b8caed7b3028b8d9876074984bdd7f11f2dd547c7481473098c54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367909, "uuid": "8e2e1a50-bd54-4b3c-8f85-5415a2099d6a", "comment": "Malware payload (AgentTesla)", "value": "1cd5cb8d6d67cad8f93a283f79b5d332376c2c15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367909, "uuid": "d93f13ee-83e8-497a-ada1-adb84ed48da9", "comment": "Malware payload (AgentTesla)", "value": "23e454ba8894c1810da18755d457a075e4e784adb5c8c73388f40a830099ae374220cbb59da7cb78cc158b1e7f1c1ded", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367909, "uuid": "ec9adc39-fb7c-49fc-b3ef-8f3f2cb5694e", "value": "T1243400027F88E715E1A93E3782EF6C2453B2B4C71733C60BAF49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367909, "uuid": "c5260288-45f0-4b84-b494-1a4cfee1324d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367909, "uuid": "cda3536c-0e0c-4b78-98da-c1c247ab72b3", "value": "3072:0WbqayiqH2zSyo+AskmTHo9rG8KaG5jnTh+SYufzz:/qayiqWm1Isq8KaWTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367909, "uuid": "adb47d05-323d-4b6d-8545-019a189a28eb", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367909, "uuid": "596ad4cc-e447-41c0-b82a-63a060b8f731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367909, "uuid": "a53d87d5-7070-4104-a5e0-f8060c5a6538", "value": "3235d1e6d69b8caed7b3028b8d9876074984bdd7f11f2dd547c7481473098c54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca86b4dd-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779372616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372616, "uuid": "e5700403-8d41-4060-961c-d2d47dfe3782", "comment": "Malware payload (GuLoader)", "value": "c4e61e932bdd5f393356c5c1fe1357f1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372616, "uuid": "a0b795b7-7973-49ff-9731-2c3790fb257f", "comment": "Malware payload (GuLoader)", "value": "325f7067201f04026ef51a30cea468fe763938181c4197fbcfd2a5fa262ec0da", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372616, "uuid": "18cd2fd1-b32a-4ea5-89cb-3f326fbb511f", "comment": "Malware payload (GuLoader)", "value": "6e96d05fa7236e998004cc92680163a7b8d47093", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372616, "uuid": "1083674d-a32e-4d33-a330-9449085e911a", "comment": "Malware payload (GuLoader)", "value": "82db67a09db27f5518a9c58e15e5364cfad84d34a6f5bb727bc7c0172bd6e2d54ed964fcf3e9f1314b3f7247c1d8b6e8", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372616, "uuid": "466b4356-77ee-4fa9-b0bd-f1f9f9499426", "value": "T186D4239AB516221E114F79797C7FE0F967CF4BD12B690387A0967815CAC4E33BC1890B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372616, "uuid": "6e2b4c1f-0e78-46ba-9ebf-b6a64c7a2ed9", "value": "12288:FhWm+SOqVXP7AeeXqkowQkRHloDyWec5WoQ/Wg9PtMnQ6r8PQv:QqVXP7AHXq10tlEvQJPWnQ6rgQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372616, "uuid": "9aa528df-ca96-40e5-bfec-9feb8eb36eaa", "value": 640106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372616, "uuid": "bf0ed74a-27d6-4c73-bf92-b71b0953d78a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372616, "uuid": "ebaa88cf-c8c5-4a81-a945-6c9a14eca713", "value": "rfq_last_quater_product_purchase_order_import_list_16_06_2024_000000160924.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53eaa17-54e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779346461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346461, "uuid": "0e7d8ff6-d058-4782-963a-108728718827", "comment": "Malware payload (Mirai)", "value": "04bc6f2cd82cf549f8a335bdfc94dbf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346461, "uuid": "1eb52802-e2e3-4bd2-80a5-14081d543860", "comment": "Malware payload (Mirai)", "value": "328fc6ba36bca4c3cfdb6910daab4303b2a6e1ed242e649a03c950c96b7c2a9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346461, "uuid": "12db01c3-758d-4256-9ce9-443840d5a194", "comment": "Malware payload (Mirai)", "value": "5034d4168e3a6c9a2045c4337224d4fdaca551ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346461, "uuid": "892f2cc1-c2f9-46ea-8412-3f8f76ac3138", "comment": "Malware payload (Mirai)", "value": "aa34893729ec8a596a904074d0bf08e016376ca64c8d2eed971f063aacbdfe18bebac2b1036d18c01001575cc1035921", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346461, "uuid": "9f37b7b4-7315-4c39-af8f-af49562b08a9", "value": "T1A2043B46FB408B17C4C61779BA9F42453323DB98D3EB33069928ABB43F8379E4E62515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346461, "uuid": "99f71a00-209e-45bc-8f41-7ba41954a058", "value": "3072:gbvKDq4NSl1HhBsaxsBzhcopohRb5ApiCrrDm1z17L/Kwysi:wCDq4NSnBGaxsBzhcoqhLAoCHDmL7L/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779346461, "uuid": "87a1c57b-4494-4e71-9d3f-1fc15f8d39f4", "value": 182385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779346461, "uuid": "11eecab2-f708-4b50-8559-e5e1cac1266c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346461, "uuid": "d58594aa-3b7a-4801-961f-da67b74e0778", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e94c8e-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370697, "uuid": "d58e2f6d-722c-4679-815c-4ab43f0c9cc3", "comment": "Malware payload (StrelaStealer)", "value": "88f42f258f08651b30d87790b3499fa4", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370697, "uuid": "a785d8bb-c7a2-4422-b883-c9f63a715474", "comment": "Malware payload (StrelaStealer)", "value": "32f78d5784e85b5c40fd6f5244d160e996081670f1ea017755537ccff9280955", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370697, "uuid": "9d7038f6-8e3f-4823-bcdd-5ecfad0e6dc8", "comment": "Malware payload (StrelaStealer)", "value": "348b8e59de093dc1ec0a5fd0067e899e0cfb4387", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370697, "uuid": "b17add13-d117-4e1c-82b9-36421680663d", "comment": "Malware payload (StrelaStealer)", "value": "6801c0367388b3e8f44764011804e09adab7e7bc7f2d75e601b01eac91c6d75d375ddcbe182295e8388c1d05ba60085a", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370697, "uuid": "b0abdbb6-4846-4149-afef-5f3265910f5a", "value": "T15DA2D1503EB44177B7A3D77F507054EA7593E6A11F44B1873E6D4A0122D1DC3F1A2AA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370697, "uuid": "befa3fe4-8510-478f-8e0f-a68593a2ae87", "value": "384:luEkJDMybWcSabSf5QcSQpJXzGcvAkBIhoPlr1ASDqG1zfj5iiPDYX3zGoWFGAx:rkJDDGMG1rq+3Ih8r1Agpljoi8X3zGo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370697, "uuid": "5645dd05-f602-4bd2-9408-311b164afd60", "value": 21923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370697, "uuid": "c9e0c1ee-9a85-467d-a2ce-375e5c7b2e97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370697, "uuid": "c0019c90-e72f-42e4-a2b5-ee0e5490fcdb", "value": "4918255407_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc64c740-5554-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779395811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395811, "uuid": "16205cb2-0992-4a85-bf72-293fee8e5e92", "comment": "Malware payload", "value": "d2e9a2fdd7a102423f3bd2a3a66685a4", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395811, "uuid": "df6c8c99-e1cd-4e32-8e8c-b4219fea2ea7", "comment": "Malware payload", "value": "330bbda09403a0f0b0b4ece87edab43c2078c691001438edb42823090442fb43", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395811, "uuid": "372a902e-d4b6-41fe-b106-01f21e617d6f", "comment": "Malware payload", "value": "d90f04c64af6b2ed11f719dffb889e7118a3eb77", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395811, "uuid": "38d2433c-a6ce-4e01-beb7-dc93eb9b2970", "comment": "Malware payload", "value": "b8ee93b45f75b6e11403fe79b165f4e4adc439fbd68464752ad9a6d1e6289d8f0ba18bad6c6e83674a7d35f16894c7b2", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779395811, "uuid": "9aa20ed5-1dba-4632-98b6-83f14c5aa03e", "value": "T1AC03B643E96A7C629397C63A5482D5527B696C1B564D2C38FCEC811C2F0873C82FA7F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779395811, "uuid": "acfdd6db-8aa3-44ed-aced-401082ddc1d5", "value": "768:sGRys4rnZLzA5ZXG0kCmpz6pXI8L8idW9fMh3Kybnq:scysAZfA5ZX5IzUh3Kybnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779395811, "uuid": "6a425e7c-ed48-4860-92e8-0e812bbc862e", "value": 40227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779395811, "uuid": "482afd66-1a67-471b-98c1-5382f47b31af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779395811, "uuid": "45b4c129-eb39-4bde-b9af-ae0a4c81bb76", "value": "stealth_executor (2).py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd74e189-54b5-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779327523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779327523, "uuid": "5b8bf6f4-0c47-4668-ae62-58d3fabb612e", "comment": "Malware payload (WannaCry)", "value": "703528bc39f7773e61354deead7af682", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779327523, "uuid": "20f99502-c4f0-4899-ab5d-6e5e1d7d24d0", "comment": "Malware payload (WannaCry)", "value": "3337d8bae0e2d0c50b5a86449b8591a434c3225c3d4b2b15802053d4950228e6", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779327523, "uuid": "d9f5a5fa-33ac-4089-904b-db3461df0f3a", "comment": "Malware payload (WannaCry)", "value": "7e4b9fdc473ab1f25f803b7685050b4b5879c1d7", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779327523, "uuid": "e7fe92f2-d5e1-4759-910c-adf0089980d9", "comment": "Malware payload (WannaCry)", "value": "d39c16e2ba865a9410c5a3cc3b7da86d573857276783da89e39e4b79b95999342fcbab34ba3b37e148f1b9a453166a65", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779327523, "uuid": "92e3b15a-cc0e-4388-bf36-e3da7de14f65", "value": "T155363348617891FCE0450BB484B78E5AB7B37C5A57FA4F0F4BC0826B1E53B86AF94742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779327523, "uuid": "e962e997-ee32-4d0a-b9f4-08c46734a4eb", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779327523, "uuid": "77baaf48-fccb-450f-ba4c-15337e2d856f", "value": "98304:DX8qPoBhz1hRxcSUDk36SAEdhvL593R8yAVp2H:DX8qPe1/xcxk3ZAEHzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779327523, "uuid": "ff85f505-c956-4fde-9bf0-b3f54de3a2f5", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779327523, "uuid": "6cd139b1-8846-405d-8fb4-d68bcf7b96c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779327523, "uuid": "d7f785ec-4b59-4b50-877a-1bc710ba2e9a", "value": "3337d8bae0e2d0c50b5a86449b8591a434c3225c3d4b2b15802053d4950228e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea068d6-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372622, "uuid": "388e146c-d5ff-4c72-bbea-919cb92d3415", "comment": "Malware payload (StrelaStealer)", "value": "6bac57410565bb619e422a9a1fc29250", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372622, "uuid": "4430a2a4-2ab1-48f7-bbd1-399651ce394a", "comment": "Malware payload (StrelaStealer)", "value": "334372413e20f562e474b1a7d20eddaecc99b32a7cba3ebe902ae621f1abf6eb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372622, "uuid": "d5309570-88cf-4ec0-88f3-c51ecc174786", "comment": "Malware payload (StrelaStealer)", "value": "5e3ea8d61097e62c9f4570d66eacd712ea52a463", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372622, "uuid": "95eefd89-0031-4c59-95bd-9e508772f00d", "comment": "Malware payload (StrelaStealer)", "value": "d48ae212801de4d60a7d570cb898454a2441aeb786e436e10da8b7b54de24b7280292c98e3715cd5daa5ebc236fff122", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372622, "uuid": "20d47b7d-728d-472b-a7df-a035d4bd962f", "value": "T1B5324C51F021229B1BC261A7E40CD350F9B840750706AB5BF8BD860DF70752EA77BEAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372622, "uuid": "15bbe694-1d64-4f04-8e5b-08c8991735f1", "value": "192:69t5L+wCOFMpwvQua9IlMAC2rRgtWcfLzzzbsYfLzzzbg9ZHWB/0lh2C84yWx89O:697L+wCOFMuvFnpC2rRgtWYTsUTMZHee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372622, "uuid": "a7fa32e3-9241-4045-a6b9-f4002f4c5a7b", "value": 11556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372622, "uuid": "8febade7-f45a-46b4-ac85-3ef7d052d81b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372622, "uuid": "491df04a-9d18-4593-b71d-e5635ae0c81f", "value": "254995732330430019.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d308ce24-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372630, "uuid": "8f039b38-a74d-45bc-a626-b40f6eb5d3a5", "comment": "Malware payload (Formbook)", "value": "c697245d3f310b7d11d85abd2991d7e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372630, "uuid": "1a67c9ba-a016-4f39-bcfe-bf2614b83e98", "comment": "Malware payload (Formbook)", "value": "337c323b0e90ccd3d20df64ef6f59a745ce14359b406359f16bf20e5053a50c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372630, "uuid": "3c3e10a1-b058-42b2-be1b-200a69d81f04", "comment": "Malware payload (Formbook)", "value": "2b86060630c7031429f1135fb64a73d8c3da4cfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372630, "uuid": "30cd252d-6260-4d14-8dff-d3200c436569", "comment": "Malware payload (Formbook)", "value": "7bad81fddc024aaed63b84c37535345b4bf3bafa812a9c4e6925e3f640a82761c1444d50042afb3d4c0465f2ead47152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372630, "uuid": "f8511dad-bd8e-4efc-93a5-3402a54d05a9", "value": "T10605124CEABD6D13C639937AC16322A40371C8965645FB8B2EF831E51F637C8D486E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372630, "uuid": "dda705b7-31e6-47a0-b125-d1e93eb0a4ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372630, "uuid": "081ebf94-b4a7-41d9-a4e3-c8865188943f", "value": "24576:NDFQOl4eOVbDjw4L5oDYS76OBNZ5YFKha:0OSVbD1oDV2Oxikha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372630, "uuid": "eb2a9f7b-f13c-4ff5-9edd-7661e69899a2", "value": 847880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372630, "uuid": "352bff7f-4a1a-4238-b17d-9f531ffaa016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372630, "uuid": "b92dc484-af3a-4b9a-8375-a6dff178db27", "value": "University_of_Bahrain-_Project_FMD20240942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d764e50a-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372637, "uuid": "e34f475d-6518-45c9-9036-426bdfeef232", "comment": "Malware payload (StrelaStealer)", "value": "e347367242548dc744156465c8b674b4", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372637, "uuid": "26f2288f-be66-4e79-ab26-c5d7d4ac884e", "comment": "Malware payload (StrelaStealer)", "value": "33ae90d4a93617643380df5d88e2f975899db8585ef55d005d5913158ce15a6c", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372637, "uuid": "afa3227e-8d0d-414a-b2aa-853b062223d5", "comment": "Malware payload (StrelaStealer)", "value": "6a0f7122a0d271bd58e918ea013513873fa21d27", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372637, "uuid": "8ba32c5d-bb12-4712-b705-35b52ba20234", "comment": "Malware payload (StrelaStealer)", "value": "62c6f293102744a708dba56449b4d39f09fffa38b126774bc7d17a0b4f557f861ee6ad888c7b41db4fd14bd66b69b78b", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372637, "uuid": "71771dab-22ce-4deb-a5fc-1a06f26b1087", "value": "T19931F76223069C95FEE08ABCD84608DA1F23E08747D241AB4E6A63A18C9AB338C1158D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372637, "uuid": "f071419d-be29-4198-90b1-42b166a05961", "value": "24:942KN53eoUKXGI0r8Ic8NOce9g4Co2b8z7txtsbEHxkLd9XIHW3EMQtqvHn96V6d:94F5FUWx6f9Qce9g4Co2oz7tEgHyB94s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372637, "uuid": "6f647d4b-d066-4f2c-982a-2ee7de6c95f5", "value": 1532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372637, "uuid": "65430e45-692c-45d1-bb7e-8dd09ee3eed5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372637, "uuid": "4ee2b055-281f-4f23-8b9d-7f4f9e4a7ad1", "value": "Rechnung_1018520_(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e4e206-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372641, "uuid": "c69b532a-152a-4abc-9f94-26bff71ab406", "comment": "Malware payload (StrelaStealer)", "value": "144a20804c6b8256fa58ab75a76195bb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372641, "uuid": "719864ae-30be-4aff-a8aa-c88bad5b64be", "comment": "Malware payload (StrelaStealer)", "value": "33c0bfaf30f6bf50b1a7d4315702f2bc88f5f252945ab34dd1e26111b7b73ff8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372641, "uuid": "88bc745c-79a6-427c-8050-d740fcbd5129", "comment": "Malware payload (StrelaStealer)", "value": "d782db131e176fd88f614bb37f12e2f0e755855c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372641, "uuid": "e9b501f6-ead2-4257-aee5-e4972e599a58", "comment": "Malware payload (StrelaStealer)", "value": "ebfc736130b5b425b003040c15f6a61eb40924e9c4156a96c751a743faf1c9525587b32ef38826d66b53dab498eb9acd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372641, "uuid": "f15404de-3d6a-43e3-abf6-0d30115b41d5", "value": "T1A772F0E6BCC893E5B97D3A6583766F2B905B3AD7896AF5D2F07B4B302801345B18314C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372641, "uuid": "91d9bfe9-f9e8-4c52-86f4-399d075f1ca3", "value": "192:8SqT+tz2PoMjA54MnQLYZ6piOBr3NJEByQxRDwX6sRynOejOQw:CiTojRND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372641, "uuid": "f2030b19-8069-45d3-8b08-19dfa3f7367a", "value": 16732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372641, "uuid": "b4012ed4-ae6a-4492-979c-e88cbdcf7585", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372641, "uuid": "341325e9-4c89-4204-a93d-a1ac13a54d09", "value": "154734291294621066.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58438bd8-54e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779347943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347943, "uuid": "4f8e8319-b4b9-4a48-a7a9-b84a5e5958dd", "comment": "Malware payload (Mirai)", "value": "222dcd804e59627a24602d6d2e55e7d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347943, "uuid": "93f05823-ac22-43ca-8bc2-986e3adb7213", "comment": "Malware payload (Mirai)", "value": "33c9e7b720dc14324b10d0b7588aa1898b5db66ef44343d7f792a3388cff3a47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347943, "uuid": "3bc5862d-d62a-4da1-ad3c-53b5db9719b6", "comment": "Malware payload (Mirai)", "value": "cd1354e2b23371e1c088eb51de55b31381ad821e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347943, "uuid": "30727b6f-c1fa-4dfc-88e6-5d8e04cf1db1", "comment": "Malware payload (Mirai)", "value": "9f159f78c990678fb51e0c9e60bc7e00d6a7ed3d53cf20f8a8c27dbfcc9f6a6ed19c1c137b22f4535203068c1fd8ac61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347943, "uuid": "4ad2abf9-a6ce-4b15-a20a-989a23afa2af", "value": "T124934AC3F800DE7FF40AD77B8853090AB271E3614A820B7A7357B967A9361945877F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347943, "uuid": "0d8b6b90-e989-497f-96ac-74dd7a41901a", "value": "1536:ctYpRDxT0NQ1TGNyU8byaSbpatvaWjkOgs5gDDD2wanloda4fdTb:ctkxT061TGNy5yaSbpWFkRsKeloddVTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779347943, "uuid": "af1c2a96-3ee6-41fb-a2e9-e6d575b110dc", "value": 96712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779347943, "uuid": "af426d9b-f974-4268-b20f-79f0c546b9f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347943, "uuid": "644747d3-e2d9-4e85-9c7c-5a2e308d48b7", "value": "bin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d051b2cf-54b5-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779327528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779327528, "uuid": "832e9ab6-4f3a-4148-adcb-2cf0906907b1", "comment": "Malware payload (WannaCry)", "value": "77fadc2db23aa421fa98f7f3975800e7", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779327528, "uuid": "0283488f-f897-4a00-a3e9-55f35af74202", "comment": "Malware payload (WannaCry)", "value": "340c556805575359ac98f522e2f2b6f79513623a04e79179cc2c16cc258957f7", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779327528, "uuid": "0afa1e92-8652-4fc8-acd7-8a1be4a6dfb2", "comment": "Malware payload (WannaCry)", "value": "69cc45feec7afffc1da1380b204940b29387ac35", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779327528, "uuid": "ea6d565a-2c87-4eb5-bba5-6e284f3b5a67", "comment": "Malware payload (WannaCry)", "value": "0fb5ff633203e6ee0447dfe650415613cc4c8cf8584568c468ad547306e04deed4e3c8d0427e7061c5c694b6ed72f507", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779327528, "uuid": "b0fe1d1f-7b17-406b-8179-178c777985a5", "value": "T11A36235E326C90BCD006633D54B78E17E6F37C4AE2B9DA0F4B444AAA0D33795AF64712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779327528, "uuid": "f07a6c59-fede-4767-8b00-c61d0c9559af", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779327528, "uuid": "574f7a44-97a3-4d41-aa2b-db7b104521c7", "value": "24576:jbLgWbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626M+J:jnXnAQqMSPbcBVQej/1INRx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779327528, "uuid": "f5e34f59-c49b-4469-b803-dfb1490a0d23", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779327528, "uuid": "d51c804c-ac17-45d9-a443-6c0d4a425322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779327528, "uuid": "c9d23cc4-4e6b-4173-ba65-5e6368bb41fc", "value": "340c556805575359ac98f522e2f2b6f79513623a04e79179cc2c16cc258957f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc544456-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372645, "uuid": "8e536851-120a-401d-9821-87e6ac0630fd", "comment": "Malware payload (Formbook)", "value": "d1ff149e52bdb5d9b778b06c2ee00c19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372645, "uuid": "4ce7bcd4-8746-4058-b389-323544bc1a41", "comment": "Malware payload (Formbook)", "value": "3424a53f5b4c7422f142ec1e6460b55e5da222113d45e9cf4f2f9f1013e3bcaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372645, "uuid": "20ee2dcc-e0d7-4306-a795-362da31d5e39", "comment": "Malware payload (Formbook)", "value": "8983e7eb1865656828efb89edaaa21e6676d515f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372645, "uuid": "3a0ac3a3-3374-40ba-8659-8d2abdc938ce", "comment": "Malware payload (Formbook)", "value": "d9c3487011f6c2fdd302ee156e27e6a7c8c408b9d23fbe825023012844abb40bd367777689548bb4480ac5559f3693ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372645, "uuid": "5195a57d-cb3d-4986-8dd8-a12def063111", "value": "T13A55C0027381D062FFAB92334F5AF6514BBC69660123E61F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372645, "uuid": "80192275-6b49-461c-af2f-efd09f57f7c6", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372645, "uuid": "bf5b8d12-fdd0-45d9-8f7a-0e9b12e74f82", "value": "24576:WqDEvCTbMWu7rQYlBQcBiT6rprG8aseESR/ap2FiADw3IrnhW:WTvC/MTQYxsWR7asef/aplITh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372645, "uuid": "1a2561af-65ce-4020-8ab4-6f2d6ee8f8d3", "value": 1322496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372645, "uuid": "b08ca9df-b550-409c-8e98-f0fa0787caf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372645, "uuid": "a6e3fe40-fbf5-4e1b-ac4d-a475718934a2", "value": "PO#86637.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debae4ce-551e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372649, "uuid": "4263aa52-d337-40e4-ba86-f76afb3f517a", "comment": "Malware payload", "value": "c52818d2d9b4401b38603fe945688714", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372649, "uuid": "7c0d2989-54e4-4a3b-9a09-e7f3151e8432", "comment": "Malware payload", "value": "344c6352027a74b59fe17049f5627dd3da9c1cde0afbfec8bc752f03d2095e8b", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372649, "uuid": "24b09257-007e-4823-be38-58ca17cfc995", "comment": "Malware payload", "value": "44eea6afa7d1323c8af7c2ee6e4a310663a81968", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372649, "uuid": "b01ad5e0-a36e-41ce-8a18-58ee84246d45", "comment": "Malware payload", "value": "f4d5026a12bcbc54f154e47534b9a26a68395c64fb43c752a6b92ebdfafec8c3ded672477de50ffbfa76cf3cc9ec05f2", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372649, "uuid": "809b0eb8-3865-4199-8dca-80b31068f383", "value": "T112B4239257667418DDD709F52A97FA226EB9A83373F23DD2BB89010F100914EF13B366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372649, "uuid": "068bcddf-17a2-4776-9cd0-52c73d739f0f", "value": "12288:ru5TBtDd9ibw4jYv+uHBjVrjmcfawpowiWFJ5YNMvGVQ:ru5XbZyNuHzLawpgWFJoMv0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372649, "uuid": "3e28dd8c-c8ca-42f5-89a2-f726db667026", "value": 502748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372649, "uuid": "c73ddc98-ce59-4a77-a201-f4c94e2f7a49", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372649, "uuid": "9544e511-de87-4aec-956c-d106562fad7f", "value": "PIX24000032.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641069a8-54de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779344956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344956, "uuid": "c14db669-7d13-47d1-aaaf-4a38c810063a", "comment": "Malware payload", "value": "0a0cf6c62990a0ff0f9fac4e8431ed3b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344956, "uuid": "5a205a52-016b-4a15-997e-63fe55fffcf3", "comment": "Malware payload", "value": "347aa7eff96e6ac3f02072d5dfe1393024710f6740744470df86cb0d64bb96e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344956, "uuid": "1e13cb29-2bcc-4f11-9591-b7c3804b022f", "comment": "Malware payload", "value": "949ba9e8a850c024e1b3f0f1a58b1cda34a506cd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344956, "uuid": "fb9d0631-19a2-4188-b0b2-108b3b887864", "comment": "Malware payload", "value": "3bcae15ac02bdb3493d9c658c7df8d88fac7a0d0e8259f9fa05f60ce7e6b41500d312c5f48e21e9ca2938fabed3c4b54", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344956, "uuid": "35b440e4-7351-4aad-a48c-c2a1a8a18e79", "value": "T17235DB29DBED0109F5F7CB54AD741032987BBE26293DD97C0D98068D07F3A08A96973E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344956, "uuid": "690c62b8-2e8e-4943-b413-eb61a91d658c", "value": "12288:zSN+G1adnUAhLrgoXFR/IDrTZgP23Oaw7wxYImiKxSgWPJUwAP6ZvxwQI4H2qTM5:znhwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779344956, "uuid": "1f4e64f7-afe1-4d49-b156-116c159ac5f2", "value": 1162872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779344956, "uuid": "80df1085-436c-4355-bfe5-a1bc7bd4188f", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344956, "uuid": "38e3f53c-3e2f-4354-a26f-131636227126", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44433fc-5533-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779381598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779381598, "uuid": "16e47044-8d66-4de3-a4c8-665022565e83", "comment": "Malware payload", "value": "4ba5c51cc3961177ff19ff5da79fd5b3", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "chacha8", "colour": "#E8029F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Not_Avaris", "colour": "#E843C8", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779381598, "uuid": "98433d1b-335b-46d4-89a8-e60abddebdde", "comment": "Malware payload", "value": "3485419b7a85123f50512ee04e29dfe1ad6d973118b073f16a57565251a4d2f0", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "chacha8", "colour": "#E8029F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Not_Avaris", "colour": "#E843C8", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779381598, "uuid": "38474a10-a155-49de-8f0f-25e88858d921", "comment": "Malware payload", "value": "ee8197a91aa95c223f544853b2f458ee2bfc4b31", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "chacha8", "colour": "#E8029F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Not_Avaris", "colour": "#E843C8", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779381598, "uuid": "31db27ac-9c84-4bc2-98c7-17d8f8c65447", "comment": "Malware payload", "value": "924eedde3cb580fe71048f91758c6bc202aefacc6a55fa7a659750e4dd7d2743909e2f867fc8a820666192cc325ca451", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "chacha8", "colour": "#E8029F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Not_Avaris", "colour": "#E843C8", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779381598, "uuid": "8bcfb601-4d62-42a0-a2a7-0806e4b98add", "value": "T18833C73AE7738098C5CBA2F1BAC75CE16570FE740130A61E039446687F4FAA95EBD2C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779381598, "uuid": "4398558b-cac2-44af-a5d2-6bde30aaceda", "value": "f88dd3f28281a8a2992e3a8334111f43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779381598, "uuid": "5bb80312-7cc1-4775-91c2-bde7206ead2b", "value": "1536:ZVhxJM9lq5Bc9W5lrVBRxNsBEY+K0Uj+wsTLtFVA8OlmlCXYLjcJP5L5:ZVhxJM9lq5Bc9W5lrVBRxNsgUj+wsTLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779381598, "uuid": "7dddece0-ac10-4af8-a984-76a779c619f5", "value": 53760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779381598, "uuid": "f3652286-1c3b-4e9b-917a-69b3f5427670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779381598, "uuid": "c4ec3ed8-0a7d-4015-8e3b-efd0c3d93a02", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47d3cdf-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779372659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372659, "uuid": "342392cf-788a-49f8-aac8-f5be8cc4f112", "comment": "Malware payload (RemcosRAT)", "value": "d4ba4c675c656b8f779ece6a6dab0f74", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372659, "uuid": "d36fa2e8-4e53-4876-abfd-7d88fc6fc2c6", "comment": "Malware payload (RemcosRAT)", "value": "348d487cbbf4466e57269d7f39c3c721d01c65df85a32bf8f974610f704d102d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372659, "uuid": "e32b8d41-6194-4bf0-b958-1880be44eb64", "comment": "Malware payload (RemcosRAT)", "value": "bf45bac98dc1a9e75e727459eaedd573f49785ed", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372659, "uuid": "18d3a5c0-be85-4bd4-af36-b5f744987fde", "comment": "Malware payload (RemcosRAT)", "value": "3035c39fe0abbf0077e2f6aff85f89b3171fdd58dd967eed59c1d7e82901b43f672a6056e9a0e95c08cf090e6f0d8d00", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372659, "uuid": "945ceedd-9f6e-4dfe-8985-640675458637", "value": "T14033F12F5E862F9891CCC47A6924392FC0B7AFC424142EEBFF2595F1E3158861E62D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372659, "uuid": "d278fefb-94ab-449c-adfd-c07f1797255f", "value": "768:wZhHmw7iRmGImcncI7l/eacoUncB5MIcxHmzHUJld9OFPlNgshv6+jlQC/WZIr:wZhJ7vdjcI7V1tDc5mzHUFOPs4hjlQMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372659, "uuid": "1a4f3643-cf57-41cb-b52c-3888aec10661", "value": 53920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372659, "uuid": "4a26b6d3-c8c8-4af2-b363-78bc4224825f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372659, "uuid": "72e3abad-2e8a-438b-b182-e08473dac77a", "value": "New_Order_Sheet_Samples_Specifications_Rquest_quotations_0000800070002024.7z.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55031e02-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779370700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370700, "uuid": "cbc3193a-cde7-4baa-80d7-4445cf0c1c5b", "comment": "Malware payload (GuLoader)", "value": "e541f3e3e4258f9c314141c4eae990d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370700, "uuid": "619ca04d-4bce-4bc8-81a6-5cfef51d750a", "comment": "Malware payload (GuLoader)", "value": "34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370700, "uuid": "93ef49ce-115f-42f8-8d26-24d51f32cb81", "comment": "Malware payload (GuLoader)", "value": "812733251bb335680e3c3bf298a61b41a16155ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370700, "uuid": "e10b4c68-56d2-46cc-994c-02db073ba8e3", "comment": "Malware payload (GuLoader)", "value": "cc57278cffbec8241f21df4f474050560ce45855f4bd20fc73b63a616a589984c9e204e0a148f9a49ba253de96e14bf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370700, "uuid": "111f79a5-642f-48d6-a018-f42aa6506936", "value": "T190F4232713A8C067C1306330C917A7F2C9B05D96E46A9F831A12BD5E787B2D2693D7E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370700, "uuid": "df927169-cb77-4272-9d2e-75c549ee778c", "value": "7192d3773f389d45ebac3cc67d054a8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370700, "uuid": "404fbcfe-132c-4a87-9470-2640b76e10b5", "value": "12288:TDGZKmormA1yB8sRQF3/naKqjMZyM9/NBtT9FWfRFpKdYLyHCf7neOQm8zKeGc0:1mor/1yBraBva3jMU6FBtT9OFpKCLyHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370700, "uuid": "4e46a274-7444-4026-8e53-4fd0b42f992c", "value": 769824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370700, "uuid": "9976e842-6ee7-4712-9645-2d58ca1a6513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370700, "uuid": "5d26bd54-61c6-4c08-9b7c-34ef25020b4c", "value": "Phraseman.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559b4707-5513-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779367695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367695, "uuid": "dc704082-057b-4cb7-a7e1-d9940ac8f095", "comment": "Malware payload (AgentTesla)", "value": "6e4f19e7c8ac1594623a5e80982c5e98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367695, "uuid": "622b1b65-faf3-46a2-94f8-92397e8138a8", "comment": "Malware payload (AgentTesla)", "value": "34f3a9472b39fb5313a54a7840cf11e7a89e021c1939fda84a7c7a5fd43e4049", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367695, "uuid": "b0e74348-9ad1-496b-87a5-f4b3cb216ae2", "comment": "Malware payload (AgentTesla)", "value": "090c50a8fe497df98516f9954e7a4d14d746fd24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367695, "uuid": "4929c255-e5a7-4dea-84c4-30b3a4259a75", "comment": "Malware payload (AgentTesla)", "value": "6578b530ea32f69960129d4c34636ec62b6c98cf8a6bfdafed3ff395b10e84df520d4834a15f25ab86ed809703bd3466", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367695, "uuid": "6e751d26-bbea-485d-bdd3-8d21f4c8c50a", "value": "T15D556D83ACF279F84A7CD426139DA08C97E2841F510A9D88F23E5BC97E5B58CF937416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367695, "uuid": "8a769c4a-bb83-4d06-9a2a-18b2449b2c82", "value": "24576:xdH3vb5WRiVEy7u826uhHNL5nRiGZDiOtx6Vm:URiGy7Q5NRLi+OOtWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367695, "uuid": "b5e5f05a-7c8a-4c20-9613-7500779ae780", "value": 1336624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367695, "uuid": "9d1ea3fc-4066-43a7-8301-cc75533a9e55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367695, "uuid": "2676f7b3-ec1b-4af5-89ba-d3540744b098", "value": "34f3a9472b39fb5313a54a7840cf11e7a89e021c1939fda84a7c7a5fd43e4049.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571642a2-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779370704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370704, "uuid": "2dffaa60-5770-4cb3-9663-4bd1115c6cdd", "comment": "Malware payload (GuLoader)", "value": "00fff46f71b1ebd08d593b3fee92f4b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370704, "uuid": "357371a6-f5fa-4200-b29e-a10e2767c66f", "comment": "Malware payload (GuLoader)", "value": "3522fbd2c52c010c282e7515153c31cc354b110357774f8ec135764060ba63c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370704, "uuid": "4ee6eab3-108f-40d5-9074-b148640ea706", "comment": "Malware payload (GuLoader)", "value": "b26c29aab59c048cd85125bd5c23213b17150149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370704, "uuid": "0511a276-ee47-4961-97b8-c0081574b9a3", "comment": "Malware payload (GuLoader)", "value": "a6671944ee6aac3b9263b247440100492d0bfe804eb95d1a4a631c00261f5fb560ddf4aa241773891e58aa0e3e13654b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370704, "uuid": "30dddd06-e4f2-4ec9-97d1-12f8d2340aa8", "value": "T18905BE89C1D4D2AAF06A4174F56707F44303ADEBD67C8A7B245C3C247AB934E907AE1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370704, "uuid": "62aad2de-b3f1-4a19-8037-6cb53bd0792b", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370704, "uuid": "a71aeb2c-34b7-4bf4-9b60-c99a2796b896", "value": "12288:1/AKvOZt7o85rsbrT8/vjEHAMKKvyWZdBNuCMgyDJsn/aZMljR0lE/V5Je0sZptS:SoO1rGrTkvA/CTJA7jH5toptKigDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370704, "uuid": "0ececd36-c11f-42b3-86f6-849b7f4a989a", "value": 852568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370704, "uuid": "86052e9c-f868-48f5-b923-f5105a6b2323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370704, "uuid": "b9362b50-e262-40a1-9fc9-981971f06790", "value": "SWIFT_Outstanding_Balance_EUR_16.465,39_20241122015126.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8dcd161-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779372666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372666, "uuid": "aa8c8dcd-0c9a-494c-b471-cb239011164c", "comment": "Malware payload (RemcosRAT)", "value": "6c549ccddf87155357905e0426849b62", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372666, "uuid": "09305074-1804-4fbd-b766-fb0d87978e81", "comment": "Malware payload (RemcosRAT)", "value": "3537e58a678374efbd7b48f563eb649f8d1669d4c28831f623af201ed1aa8bbc", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372666, "uuid": "2e065d83-b941-4695-b704-6402fec00a67", "comment": "Malware payload (RemcosRAT)", "value": "cdf3fcf443681ab9ab7b2898a7c688a9b6f70376", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372666, "uuid": "12c4bd12-7c76-4a8d-ba53-94c8fdb30512", "comment": "Malware payload (RemcosRAT)", "value": "9a8ee4ace3e00dac57196e7ba0500b0a545f193a6f2b5747bd60cb1c761bff45bde5acecd0b677cfa546a3b72dd666c1", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372666, "uuid": "d48c3985-ce66-4d55-a49d-79a0b5837d98", "value": "T1A10523365CBB33C89365429C586F954AEEE40F652A0C4A12C74907E3AFFC47A7E244E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372666, "uuid": "142f0967-c51b-46d6-8b64-f112a22941be", "value": "24576:wgUe7bZ1dMxDfpNp6nddOymcAPxQhNWLa4B:wXe7bZ1dqfpWnrmcmcWdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372666, "uuid": "1a8d4505-5b72-4e3b-bc4d-12ce9861027e", "value": 864425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372666, "uuid": "2e32cbb9-e8c7-4a03-b911-e48664d7bafc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372666, "uuid": "910f5420-ecf0-4347-ba3b-22f1da6cd571", "value": "Comprobante_de_pago_(PAGOS_BBVA).lzh.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb26c1b2-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372670, "uuid": "fb508857-7c50-4906-98bc-2850be54d50e", "comment": "Malware payload (Formbook)", "value": "1d15b08f77075d035848266cb96f555f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372670, "uuid": "66955ed3-6bd9-4d01-a82e-215a39088127", "comment": "Malware payload (Formbook)", "value": "35566df8caa1c9cd12df5ac40b40bebc0521658e525d77cd64e3961f14396cd0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372670, "uuid": "2ee37907-21d4-4dd8-bd64-ca8bd8f0c7f7", "comment": "Malware payload (Formbook)", "value": "89b3bfc344227d3fdbf3dbcb66ae42e70221ec45", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372670, "uuid": "5f747d49-e429-4a3e-9543-423bd45fcdbe", "comment": "Malware payload (Formbook)", "value": "df85ba3ef745f599699dbf2b7de090081562e0e063cd2ddf1625e88c166ed00dd3579ab972c5872d874d45b687e565e1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372670, "uuid": "b20b0a60-84ac-4199-87f8-bf20f4864947", "value": "T1522533D845AB0CA02E21CA62E13FCC6E968716BB8FCDD0A378D5A5F8141F6C395621B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372670, "uuid": "b59200a1-11e0-4f0a-b766-422b117ece68", "value": "24576:cSR0LD4tJiCIMtxcNO/GjHb8JsUojJQKBu4shx4bXDceVuZ+:cSR0LDcTIMzcU/GboJsUo6yu4o4keAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372670, "uuid": "97eba178-6562-4d70-83b1-9d69c51ae9ca", "value": 1039493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372670, "uuid": "c4cc311f-6d7e-4d58-931e-0736ebcbfbfe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372670, "uuid": "776b1f04-300c-4472-b409-8933d5195b4a", "value": "ProjectXCommercialXTermsXAndXConditionsX-XForXManualXSamplingXSystem-RevXSSGTXGeneralXRefXNo-YASREF-318-CJXG1-61XPhaseX1D-BCDX20th-September-2024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed711902-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372674, "uuid": "ab27909b-30e7-4412-8eda-b8ed524d1211", "comment": "Malware payload (Formbook)", "value": "0219e6795a1b0cbd74f5eb72d29bc539", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372674, "uuid": "bcf8ffd7-96a4-4c2f-bac6-2096ad6c119c", "comment": "Malware payload (Formbook)", "value": "35af2d58762d12704b45bbc314c5e2292a0d2b26b5c463e28353c7122a15d16d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372674, "uuid": "4872306c-e095-4d96-af7f-85b40de33e86", "comment": "Malware payload (Formbook)", "value": "130fbceb49f17141c21642d0810aec15a6f6c49a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372674, "uuid": "785486ef-c5b0-4a1e-abe5-c7e56fe000aa", "comment": "Malware payload (Formbook)", "value": "1dc26b5b01742d24dd189c1d6e240dca946e580b66ba7e7d7a5b97e4cd9f79738bd59634dfa97d377a89f3e0a7c86a1f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372674, "uuid": "b53cd376-b8a3-4ed9-a3ab-1352ccff139f", "value": "T19BD423633FA9FACF1266591CB3F39C704A886F09F71438552F6A016F84D20366754AEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372674, "uuid": "10426d7f-3d40-4b46-9567-907fa12233ec", "value": "12288:6x1Q5dK1Y4XsvtsN2Y+z6hYglRQizXqWm6pzOcH5I1vYdR8fFV49hv5jb:l5P9O2Y+zyY0R3XqYpzvS08fFG9hv5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372674, "uuid": "e805fbda-541b-49ef-9945-00fa51815420", "value": 654385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372674, "uuid": "b9cfc967-f395-49fc-b5d1-e3a8c7db6e45", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372674, "uuid": "18c53a58-b9be-4180-8d9c-4f2bd0f5fa00", "value": "SPECIFICATIONS,_BOQ_DOC_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1177c86-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372680, "uuid": "c0203dac-9fdd-4bab-a7e0-19f03a071c19", "comment": "Malware payload (StrelaStealer)", "value": "ac08b212bac57ac23f70400f07804d99", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372680, "uuid": "2ef8dff6-3276-4fc0-838a-e74b08fa9ca9", "comment": "Malware payload (StrelaStealer)", "value": "35eea34350fb8f502bd336645cbd93bd6f9adbda8cbe852332959aeed84a33b9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372680, "uuid": "3c864cc8-878c-4872-9278-d9a692f32a56", "comment": "Malware payload (StrelaStealer)", "value": "b78e3384751b4a40498f4d4a35c54264811176d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372680, "uuid": "c207b75d-54c5-46c4-afc0-1b4d8a949060", "comment": "Malware payload (StrelaStealer)", "value": "512c9d617e8b7638d4db247bc8a0ff034ba3f84952ea1f602d7ac1dce50ec0dd90d9dee1cba78e506bacca7ff7d619ec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372680, "uuid": "bac9ec48-dab8-4519-9138-18f1dbd821ad", "value": "T1273211F6AD9E20B407E2008E77772657E77BD09259D7A5B4C02D63001BDA0A83BC799F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372680, "uuid": "e428eba6-c463-45a5-9e27-38e1960feb99", "value": "192:7V4p+y5AhuRJhCyWyjNqswrWmIxwwrWmI+:5MV5KuDAyr1NmIxwNmI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372680, "uuid": "e6cdcf59-249d-4e3f-8897-ddf3e3cbfdf9", "value": 11319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372680, "uuid": "a1c3cd2c-49ae-458e-adfe-8d8c34667bec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372680, "uuid": "366bf3cf-d2b9-4b84-9e80-b6f9331e95be", "value": "658317182819512400.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb76ae4-54e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779346130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346130, "uuid": "70059e7b-e662-4db5-bc13-b88e7b2c3ac8", "comment": "Malware payload", "value": "9fe5d55f347e5787e730e0e28aa46d73", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346130, "uuid": "117219c6-b29e-49aa-a95c-3d7608a8607c", "comment": "Malware payload", "value": "3649a83e141d60e628248fab7342693e3c2b8df820af6586d72be4ea9f23d5f9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346130, "uuid": "e640a2f6-69c5-41ca-ba4b-924e0433916e", "comment": "Malware payload", "value": "36b7ad3874117fd404a75c7e024dd316ebb804a4", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346130, "uuid": "27e260cb-78dc-42dc-a236-87391eff39b9", "comment": "Malware payload", "value": "70664ae090fdf096f37ab70e10797fcbcec3bef9a469deaf4dc4985340452b068d59ca7952401d8db023e57cc22f89d3", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346130, "uuid": "fb3f3ce9-e8d4-4691-85a4-fbb5e27cfe68", "value": "T137F1637EF656C5D103E5160D9CC2418BE83511AF12D93FA1F57CC8526FECA3AB110AAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346130, "uuid": "5dc1e07d-192b-45c4-882a-dab0432b7299", "value": "192:x5JoZmJjDtsehe0OUvWMJbkw1vA/FJlxHMwi/hTB:x/oEJjDBUqWxw1Y/FiJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779346130, "uuid": "26565673-8a0c-456c-a04d-672d31d4f310", "value": 7880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779346130, "uuid": "92b22e8a-1532-41be-9ba9-6ab3a30246c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346130, "uuid": "3457c88c-7520-45c5-83fb-7c65df12a1f8", "value": "3649a83e141d60e628248fab7342693e3c2b8df820af6586d72be4ea9f23d5f9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f308985d-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372684, "uuid": "3cb8b5df-d3b5-467f-b747-d62c1e7a72ba", "comment": "Malware payload (StrelaStealer)", "value": "d5abc7899c60302193ca1c8399138ae0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372684, "uuid": "097cf4a8-5703-4342-9d19-9e55079e60b3", "comment": "Malware payload (StrelaStealer)", "value": "365235cd0c4aa88ab997f00505992c62030534f775b497a0560e26df6c1c008a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372684, "uuid": "d949f0d9-329c-4549-9c37-727134974ba1", "comment": "Malware payload (StrelaStealer)", "value": "008b92c35f5db6176622711bf3305cc5f2a707b9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372684, "uuid": "6a2ba482-31a6-4b1b-8ab1-555b6cea1d68", "comment": "Malware payload (StrelaStealer)", "value": "8f1ef058f4c4a23bc179fcad54faffdde1226b7c6ef34d5aaf6f3b4443bfb38d3fb2d1c32b68d84d9b3d1455cd252085", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372684, "uuid": "8348fdad-60b2-4249-8c32-3343468fbeab", "value": "T121C125FAD00920DBCFE07156235198CA0F0BFCDC9799F06E66F4F51588E7D97226509A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372684, "uuid": "3cd79642-4032-4ad9-949f-1744df3f1499", "value": "96:3jMLEdf5pjaxy/L/htWfLg/gnpmxluhArGWWduubEl8suADRivkrl8suADRiK:aErp+0/L/htWf0/gnpmxluhArGWWduua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372684, "uuid": "758475fd-3fb8-4023-9422-64e652bc147b", "value": 5896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372684, "uuid": "d24187f1-0060-4d9e-878a-a64885d9de57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372684, "uuid": "c71fe08b-2269-4bda-a191-538e2f130c9b", "value": "14655313952528229878.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7714acb2-54de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779344988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344988, "uuid": "810cfda3-3cac-481f-8ec9-f09c6b1db860", "comment": "Malware payload", "value": "fe2e22c17cde565b8cd703e03247839a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344988, "uuid": "c4930ee7-6abd-44e5-b240-527283c68be2", "comment": "Malware payload", "value": "366d9d3d591dea34e734ceef7a66cb6ff16ecb5aecd7f02d23a6a35628f20edf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344988, "uuid": "7c952fb4-1814-4ee3-affb-a0255bc87e37", "comment": "Malware payload", "value": "dc626da681429677a6ecaefa58d44c4b9ba145f9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779344988, "uuid": "dcb941fa-4958-47bc-9d7c-06d5781c72da", "comment": "Malware payload", "value": "84a1737e6b9fbcd81af1cc5212c02fcad1086da9315eff8d318316602419343b5d09b9e24b416536bb67fb41c2e79423", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344988, "uuid": "e0516918-368d-4ebb-bec9-369ee147f0b6", "value": "T1D10559919BEA5D3CF1B60B0C69F558125967FCA62839C38C055D5ACD0BB3E089CA0FB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344988, "uuid": "1a0a08fc-309a-4cd2-9be0-cb71e36738d5", "value": "3072:iz6vpeO5x8Q9aZuWZeK/drbvf2tIU63RBXbwg47AW4qDD1qOhjDZq2fu4/:1m9T9zR1684/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779344988, "uuid": "f1c64752-62ed-434c-8a55-dbc8ecea6ee5", "value": 801344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779344988, "uuid": "7e4279a9-3bd9-4c7c-ae82-29f5afd0d57b", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779344988, "uuid": "2dd3a497-aeff-4616-9bb5-85bf0cb57168", "value": "REQ For Payment Invoice FER120002600086230-8119_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5198c93-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372687, "uuid": "126f6915-4ef3-4f50-8302-8881dc56567b", "comment": "Malware payload (AgentTesla)", "value": "7093258960a3163ca9d784d4de9dbae7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372687, "uuid": "0c76737f-4b97-4b03-9286-fb0bcd532fe5", "comment": "Malware payload (AgentTesla)", "value": "367dfffe5b481ea41845028453d6c1dbe7ffa9b214c509946a7ffccbd80cf622", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372687, "uuid": "c2c32bea-2d18-40a2-bd47-03358b8e3c32", "comment": "Malware payload (AgentTesla)", "value": "b939198c51675c7a99c1ce641a62feeda3f27bdc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372687, "uuid": "12d60de9-b7bf-4224-801a-8b2fa60963d6", "comment": "Malware payload (AgentTesla)", "value": "474b81bac30e3cb555f650826124e31cb0d4de7dfef976f701c9cf869043e8f8d1582892b48ac2385a408875e98158c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372687, "uuid": "6ff549b5-1884-4279-ba22-474027bd3720", "value": "T160D423253F00229BE2D0D1346A13D42E68417FBD8BA565CBB7A37AD76728D42DBE7130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372687, "uuid": "ea51f66b-6f74-4464-b0a0-af025020ed14", "value": "12288:z8Z4bJ31v9oibrEjtXXqx3TQ85NASFE9WHHGtSIGrAJ/s+O2D3kzn:z7bR1uwEhHqxTQ8RFG2ksyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372687, "uuid": "4a3540cf-53b3-4bb1-9ade-c2e0a7c829c0", "value": 598369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372687, "uuid": "b42b86cb-9d8a-4b6b-bc5d-5da8a826b92c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372687, "uuid": "8423e53b-db8e-429f-808a-6d709cb661b6", "value": "HAWB_No_Original_2_-_(for_Consignee)_-_HAWB_No__D889163(2).pdf.bat.bz2.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96da2a3-54c4-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779333905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779333905, "uuid": "8c832f26-23ea-473c-8669-0c4a660d6b56", "comment": "Malware payload (ValleyRAT)", "value": "124d221daf8afebfc3423c00316dc4cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779333905, "uuid": "2c327d5d-544c-4de0-975f-b4c24869daf7", "comment": "Malware payload (ValleyRAT)", "value": "3683d673395b2ef445ea80d604af15a7d05c5d21cdcbbb02fc933298ba9b9862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779333905, "uuid": "30562844-686d-4ef2-9405-801088635033", "comment": "Malware payload (ValleyRAT)", "value": "45da70eeed52ca0915b003b5a7a76a88d73f9fb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779333905, "uuid": "b761ab29-8c15-4f67-bd5e-b7deb82ac636", "comment": "Malware payload (ValleyRAT)", "value": "59777767d2d3f2c0a1466bb7cce899a3e054dd50fb7c0c50e6803b4af18da727668efe14673188e568d666668dd54b24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779333905, "uuid": "cd627424-0e87-48b2-aac6-b6f80dcd995d", "value": "T198B34B5BA3E930F8F577867884A14A45D772B83107619FEF03A4428A1F236D18D3EF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779333905, "uuid": "6713c09f-64e9-4b4c-86b9-b38e85e5dde4", "value": "3a09d6f3e772ec693539319ca5a0d1e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779333905, "uuid": "e2873d42-8080-43d4-815a-85ab65077560", "value": "3072:WZ3o1XiAi8CpdAiIHjMf/eX7FHqoeSn/5Ss6k:VSAi7AdDMfmXRZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779333905, "uuid": "956de92e-32e5-4788-aa53-41deee11937f", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779333905, "uuid": "e856ace0-0e1d-481c-9bf5-5ca4402b24d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779333905, "uuid": "a3869fea-d5ca-481b-bb41-c741225a7a2a", "value": "ConsoleApplication10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72dcc40-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1779372690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372690, "uuid": "eb2e97a7-bfbc-496e-86b3-c2ad902281b9", "comment": "Malware payload (VIPKeylogger)", "value": "1e37795dc8a8474cdd14e42e48b76815", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372690, "uuid": "ef07213f-7314-4ad7-b6ce-f6fa09c9ea34", "comment": "Malware payload (VIPKeylogger)", "value": "36c426667c14f04bc5dee42c1673ce7573d0804f5bc7574f661378577c0a2a1d", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372690, "uuid": "eadbfbd8-e797-4ad6-8e16-312334b6daa6", "comment": "Malware payload (VIPKeylogger)", "value": "aa010c1a090a06c03e3e5c9de05d23f94b803a74", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372690, "uuid": "c5aa81cf-0173-42bb-9d12-f0b2f306e446", "comment": "Malware payload (VIPKeylogger)", "value": "669a1650bacbcb5c382bcbee4473a9d08da5aa8bb39cc3f76201b7d808be0a531e6b871a761ef39d64d2d566177ef362", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372690, "uuid": "2d3d2bc4-dd0b-4724-bcea-7dc8891e41a8", "value": "T13C1533804A6A80529DCD2AC4F2FD216C31FF3BD95E9570C66917403AE0E8253B9A7DFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372690, "uuid": "7ecdacdc-55e4-41d8-9001-795aac537642", "value": "24576:dt7Y8R39qYXC6ruzV8yo1YL0rJXtE56H1kab7:dt7Y89qYXC6ruzVVPs9fH1kan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372690, "uuid": "76eb2bc4-5334-4338-a6b6-12371c30b41c", "value": 936021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372690, "uuid": "432efc2c-965d-4e1b-ba24-83b86445866f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372690, "uuid": "03ef81a9-e91a-4867-af43-403268f9581e", "value": "INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590fabef-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779370707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370707, "uuid": "fc280c17-d70c-49b0-8585-03261eff611b", "comment": "Malware payload (AgentTesla)", "value": "95c50c87e48db56a4d19de7ec79ef04f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370707, "uuid": "228bcdbc-4920-4d6b-9b2f-074a1e11e9ce", "comment": "Malware payload (AgentTesla)", "value": "3702ec1e2c703218f32fbe9d3783e3dec8c525c332df40490f41fa25d813edf5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370707, "uuid": "688094fd-cdf2-4067-ab4d-5452f1b96afc", "comment": "Malware payload (AgentTesla)", "value": "cd7ba24e1c662fc6a1d9fd2b2e6d0a6ee077e0eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370707, "uuid": "a4cb8a16-4e34-479f-b80b-84109497f7be", "comment": "Malware payload (AgentTesla)", "value": "d74b8a6a28b3fb11418b379bf35b3719f5ea4e9972895031c2117eb9415f2dd3e8a99ebf3315690643c205ca5eb7ed24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370707, "uuid": "ae00d9a4-2b38-47f7-adba-668969f1089c", "value": "T1B0E42353AB7514C1D54E073CC23C6C42AEDA86CF22918B21ECC95C6DBD972BB966E0F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370707, "uuid": "9964a3df-aff5-4f6e-8d83-9ac3badf571e", "value": "12288:adM2B1UNORGyn/bTAXldVIGiEYKbJTAKCMZGBOp7Gi2yCbooFSC1u8/6DajUTgKx:ae2BCsRGy/KdVIG3YKtALMZGBli25bbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370707, "uuid": "a8fa6e90-a167-4471-90fa-d5056c67ffa4", "value": 679032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370707, "uuid": "1540f1c5-f820-4b60-af45-d7120b7ee031", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370707, "uuid": "2c6ebbb5-7aa9-41ed-8b6c-862946d1d0cb", "value": "PO#86637.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b18c1ce-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370711, "uuid": "9bada670-cb27-42dc-a155-07c6aee05048", "comment": "Malware payload (Formbook)", "value": "964c51ac8e76ee4be9e8d0c2a7c4d4ad", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370711, "uuid": "8b0078e1-e27b-4a56-a833-1ed62162e115", "comment": "Malware payload (Formbook)", "value": "37166898830ef4789177d4772cf0defa0a9d6ee9e620154b231e95ece63897f8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370711, "uuid": "93b923cd-ebb0-4864-9d79-3dcbf12dbbdf", "comment": "Malware payload (Formbook)", "value": "abbe00224437e614976d956f675a0e0e5a779968", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370711, "uuid": "fe06ac03-16cc-4947-96ba-260d0528a9a8", "comment": "Malware payload (Formbook)", "value": "f665d32fd1092ab94dcca356710345191c3d20b9ab300651b04305bc47a1ca845ffa9f1ce6f3c9c96a9cd35e97b97f5c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370711, "uuid": "d92c8a0d-d086-4984-93b5-2f73d30d9d82", "value": "T175F423909E900105821CFEBBB064BA9B922C1F1E4E2338B17B3ED7B37C7756A165C875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370711, "uuid": "2f5cc447-7e79-4eac-9f8e-bdd58a67ffae", "value": "12288:s60NQ73DP674XUWSE/9nWuqELYyFUIQXlMFa8rDVUn9FAt21KYRu+MEp/8bknz6E:C8u74XUWSElnWuqEEvFlEHrDV/0KYRxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370711, "uuid": "11c88c86-cb4b-4031-a9ca-cc7c0f8f0263", "value": 758726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370711, "uuid": "da542578-d57c-441b-ae24-67737005f4c3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370711, "uuid": "47b970e3-5066-4c6a-a4d6-3edc3a48b9ca", "value": "LPOX-X97866547876X-X7667438670034.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6e4031-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372699, "uuid": "2bd95933-b9e5-4320-8f64-ea911147de40", "comment": "Malware payload (SnakeKeylogger)", "value": "6d725c548a089d73604a8e4d03500085", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372699, "uuid": "7002266a-6581-4998-b529-cab06e945fbd", "comment": "Malware payload (SnakeKeylogger)", "value": "3768d94fddd8b35b9b631ca3d91f6396222dab41bbce83a89be732d6784f44ec", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372699, "uuid": "ce21e44c-d14c-4adc-810b-561c601655dc", "comment": "Malware payload (SnakeKeylogger)", "value": "65785a667abbaf153a725fe7d456b232ac96d4e1", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372699, "uuid": "f4a73c54-e80e-4cf9-a727-fdd882b75f50", "comment": "Malware payload (SnakeKeylogger)", "value": "4110b9483749a45b2f48dce64396edb8fe80f356acf41bdb4d910f7189416b644c0ec3ba47788032d311fac2a2c0ee9f", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372699, "uuid": "d1dd2b36-ba06-4dcf-aed0-7472931ad705", "value": "T143E423528BFF7F119267A82238F20D6461055DADEB0C63DBDDC39E86F21B98154F026A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372699, "uuid": "c5ec3c01-59a2-4227-b06b-3b26d117da62", "value": "12288:axhxNeilYNX0zt03IppZ5jmDtlqEu0ZMinejV4zK9wR2w5dILs5ANX:woeYNX0zwCSDtIEu0SjWu96dSsMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372699, "uuid": "b4d5ed8c-bdd4-4368-b8ab-5ba672cc4457", "value": 688057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372699, "uuid": "0b7db3ed-bd42-4d8e-b070-3109c80a8b1f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372699, "uuid": "9386660c-78e9-4345-be64-b5f28e88fbc0", "value": "PurchaseXOrderX423737.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe752719-551e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372703, "uuid": "1618dca9-5c7e-48d5-8670-4d8b2f2d94ef", "comment": "Malware payload", "value": "acbe929b6f38250f5dbd76b1bcecbf32", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372703, "uuid": "40a5492b-f809-4580-ac89-8a7d2cd1c0fe", "comment": "Malware payload", "value": "37873429a60c019fab9619b3c4348d896e391706ea9fd6e1710f6bf51c98d97f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372703, "uuid": "4249d5c1-905b-4a4f-8c56-7a8295dac46a", "comment": "Malware payload", "value": "add3b802a1068582e4f3ca0bf86df73d757ba96b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372703, "uuid": "3ad22953-fbda-4871-a38b-d7f02a035f9e", "comment": "Malware payload", "value": "93a2e2efceabcdb98b28e326538420bb9efdd9a241c2f8486dd3836b7516efa68749c84a35bd9ba3151fb84dc9e1a534", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372703, "uuid": "7c9d1656-41eb-431b-9d7e-36fde6203e87", "value": "T17575332EC3ABA6C025AA9928F7654950FCFD70772E421F35D020E3972DC319ADDBE464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372703, "uuid": "c2b74472-f680-42e9-b1c7-98565ed20876", "value": "49152:mplKmTBfSSYD1qirpIg3Cn2v6esm9b/bL/ZI4w116+N1:uBfoRqirpIgyn+FPbDBL41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372703, "uuid": "3dd83d73-f6e8-4d58-88b3-e945311f2eec", "value": 1657969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372703, "uuid": "d1d50e15-e132-446a-9a57-2b38f3cb8169", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372703, "uuid": "670ee0c8-573d-4db8-90db-aab7f431cd4f", "value": "NEWXORDERXP24002603992.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff06539-5510-11f1-a769-42010a9c0008", "comment": "Malware payload (AntiDot)", "timestamp": 1779366290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779366290, "uuid": "5f9336f4-e0c3-4a08-ab55-4e5e1831cdd2", "comment": "Malware payload (AntiDot)", "value": "8a5ad3ea51cfd79859377eec67a7e190", "object_relation": "md5", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779366290, "uuid": "2b11d744-b885-462f-a9c3-b84c319e216e", "comment": "Malware payload (AntiDot)", "value": "37ca38979f944ff0aa1a75343a9a5645d8559f6505c3b35615d0b0ae06ab28e6", "object_relation": "sha256", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779366290, "uuid": "e1e9d8cb-641a-4857-b343-6eee094e9c7c", "comment": "Malware payload (AntiDot)", "value": "f5eb652bbdf8efda2dd34419648fadbd5e6c9387", "object_relation": "sha1", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779366290, "uuid": "74287de2-4411-4046-872a-10ca09683d94", "comment": "Malware payload (AntiDot)", "value": "ab11a235231834bbb142e0e5de883d23b13b1468d90ea7a313f02054760d368a49224a775cd5d57bd2f8db82eb6cca06", "object_relation": "sha3-384", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779366290, "uuid": "27625773-b07c-4447-a303-0df91b5763c1", "value": "T116E6E13052C2916CF66221F781972CE033249B9DE3A597AC3F39340D6ED6D252762B7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779366290, "uuid": "a8eb823b-3857-4d2f-8183-3b55a7e110d7", "value": "196608:eKvBqQl4MOVO/5NWm3XsVks/tVG9OOPp4y+auxGX03+GXUUlUTeTp2:Jptl5/7WmMGsvGI403PXEid2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779366290, "uuid": "b116e453-e515-47f0-bac6-be3a8aed991f", "value": 14992245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779366290, "uuid": "2ffa6e1f-e753-4a45-b6d1-f9a14b5bc1ba", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779366290, "uuid": "4b3e8b0c-3350-4a06-a709-d7dcfabdf022", "value": "com.lutileha.boot.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0223b31c-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779372709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372709, "uuid": "26fda915-0c24-402c-86ef-9b37253dca3f", "comment": "Malware payload (RemcosRAT)", "value": "66c9a87604d825d9d6f517824ceb7232", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372709, "uuid": "0120b028-f7d2-407c-8b3b-e05627f56b61", "comment": "Malware payload (RemcosRAT)", "value": "37d7de1665e2b4fce2a0781f513037bd5aaa0bc0358e63df5bac07d13c302996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372709, "uuid": "7c4bcceb-81bd-47ad-a6b7-22d6ffd50ff2", "comment": "Malware payload (RemcosRAT)", "value": "d270a3473904328805a5dac801a872d0dd9ed411", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372709, "uuid": "4373e66f-94a1-43ad-b737-45f18f24c2bd", "comment": "Malware payload (RemcosRAT)", "value": "9ceba5d7ed56e17ed0268700078d48fd03cb0c2f61559b977c9302c2ece7e5a9f38477555ece409375389003d45ae8d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372709, "uuid": "0e81d7e7-95e2-4e52-9efa-5b5056fff435", "value": "T1CE1512413AA6E606D9D52B710A72D2FC2ABA6DC97122C30BAECE7EDFBC307511541713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372709, "uuid": "7fd426a1-0d2b-491e-b432-057ba90b1a7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372709, "uuid": "6b914ded-7c82-4436-9274-a694402a12b6", "value": "12288:B2i6yMILo8mEA0YA12QkBuDT6csfiT5DZ4IUKT0b53fixTGEZvsAa+q17PETzIuy:WHaopGYwT6csfiAT6SEVsx+qmzIl4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372709, "uuid": "82786eb4-dc13-459d-b2b3-4d95c5ec6917", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372709, "uuid": "77c032fc-2184-4322-b407-d446ae09f98f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372709, "uuid": "5fd44b4f-8d76-420d-b76d-1131e372a42d", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c431d8fa-5554-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779395798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395798, "uuid": "358159c3-e25a-4edf-a5c0-99df8d9766cb", "comment": "Malware payload", "value": "2c051f94ac8693a6e011ecf2e2b32842", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395798, "uuid": "b6333e33-5d57-406b-b7a2-c1f04f86f900", "comment": "Malware payload", "value": "385528018b4283098d4c17eaa8252dc85b79b484b98ad89e1bad224165a6df79", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395798, "uuid": "4dd58610-8ce2-469e-af5e-ce587cd74182", "comment": "Malware payload", "value": "a9e3724e747531d8ef01c4550474ef08ab402134", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395798, "uuid": "c0567fba-fea0-4afa-a07d-c6db67040dfa", "comment": "Malware payload", "value": "000abc1cdc29e03014ee66987524c03cad2eae943b5958966b7ce1b8ba64be9fd4116e4a2a3d7af16d1f2bb9f1a846bf", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779395798, "uuid": "6699be72-7f58-4e87-bb79-5b20238ecf12", "value": "T1ABA27576DC080EE6308BD0AC4A56A0E5D52A71337E607CAC778DB2258FCF99C61791F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779395798, "uuid": "dde8b50f-6d82-4e83-b397-af3cf4602e05", "value": "384:wA4qQwFC/LkFXoNIiFDsEmHd7nM5Pe1EG+L3f3qK721kE/jAm1MwcT7ta56p:wA4qQwAAFXotFDRm9Y5PFSPcWc/tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779395798, "uuid": "c4cd653b-d1d0-436e-ae29-b70451557d8a", "value": 21915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779395798, "uuid": "1a58753f-c111-4481-866e-28a45e751fe5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779395798, "uuid": "e323747d-8dce-47df-b7de-50c9ffb9f05c", "value": "malicious.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d094fd-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372715, "uuid": "2701cb0e-9401-4266-adbe-c006f81538dc", "comment": "Malware payload (StrelaStealer)", "value": "8f8511ef741b8a7916ca6f049b7b19c8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372715, "uuid": "bbbafa6d-91ef-463e-9bf9-c357a8a1c7dc", "comment": "Malware payload (StrelaStealer)", "value": "385c2f0552de84ad8fb34a327ecc025b59de267a1e16f4ecd109778a54170af6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372715, "uuid": "27be105b-85b5-42d8-8a7f-2417671226c8", "comment": "Malware payload (StrelaStealer)", "value": "cd10573c85e58cf36aeaf06d96d31159692b6ef7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372715, "uuid": "543214f4-def3-475c-8e23-a2161bb411ab", "comment": "Malware payload (StrelaStealer)", "value": "d07591e38eb84dfceefd433aacda1572352fa4405eabc4ec73ce710fbdd06f8d7432e4b956bc8ee2c42b9b204fd0b7ab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372715, "uuid": "2f26893e-3423-481d-8eeb-bb4f6fc3a28c", "value": "T1AD423548B5C2AE66AF9BB5470E3777D47FBF38621BFDC2189002B15A06D1778EC448A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372715, "uuid": "bd885bfb-68df-41e9-8c1a-5604de7aeb4b", "value": "96:j9lEC1B3EBhtyLU3J/3iuPhU/IfWmMU68itSC2Il4kUfZjAIfWmMU68itSC2Il48:rz3YGU3J/3dCgGsNFGR1V5m3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372715, "uuid": "76098948-5907-4db6-8071-e1c7a83cf806", "value": 12790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372715, "uuid": "bbbd5227-a2af-40b9-814b-3b7fce6e2c2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372715, "uuid": "17830dee-25bd-40c4-aa8e-0397e14c4b4f", "value": "95313143027999156.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098bbaeb-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372721, "uuid": "cf5ffd69-a934-482a-adbc-373c4fee7840", "comment": "Malware payload (SnakeKeylogger)", "value": "b0ab001fc49e61ce3c910d6543c12c67", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372721, "uuid": "01cbc827-7e7e-421e-9b34-73a257ef4377", "comment": "Malware payload (SnakeKeylogger)", "value": "397380c85090e20674183bd7011fc2815c1c77ab81c8d47b7608b68b3662cb90", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372721, "uuid": "86b1f344-f0a9-4b39-866a-11dc5afb8aa7", "comment": "Malware payload (SnakeKeylogger)", "value": "d1b03d10f74b5751834e900443f014631435cc13", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372721, "uuid": "912e964a-fbe7-47bf-92a7-ac75cdd0f03e", "comment": "Malware payload (SnakeKeylogger)", "value": "cc212a3c07960e5a0f9134e77b1a4fd6def021ca5937c9404e391347c577c0ed7b9baaaf8d422828c0c242e02398c649", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372721, "uuid": "8cb3c5d7-a446-426e-8148-d1fa2652d610", "value": "T122A423F3A05C2BC6ADB1C0DD82D352A50EB8A24B853E1D135DF7242EB8EC89015CFA64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372721, "uuid": "53c3d062-a364-411a-b999-58efff8bc9de", "value": "12288:lW2SZ7EEo9Ka10FyrOJSxAkWOfVS9GVIN02vbJ:loZoEoB10FyoWl8GVItt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372721, "uuid": "a1361865-22e8-49f5-b247-06cd673b3023", "value": 489702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372721, "uuid": "64bf5e24-15d5-41fd-b0a1-f8932da6f67e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372721, "uuid": "148dcd0e-00a4-4ff6-8e39-62f6e72379e9", "value": "PURCHASE_ORDER#.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a131c872-552e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779379418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779379418, "uuid": "1808cb4a-aca6-45be-b998-f01eedf0ac11", "comment": "Malware payload (RemcosRAT)", "value": "87168e22f4269cfff666a0146a0ba067", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779379418, "uuid": "59d83676-7c87-45a4-a277-7a82a7793621", "comment": "Malware payload (RemcosRAT)", "value": "39848daa941906b33b0a28e969b56b76a0f802e5b55f8a2aa53d8455e7ff2cd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779379418, "uuid": "746037e7-a22d-48b3-ad08-9ab7c52abd35", "comment": "Malware payload (RemcosRAT)", "value": "aaece89319948d57a603382535b2724346b8176c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779379418, "uuid": "3684b38b-2445-4935-80cc-44a477b01478", "comment": "Malware payload (RemcosRAT)", "value": "dde5833dd48429475c5d89e83aa3ee57a21bcb2dd473ba67d2140079fd6137c452d52b9565a1672598ecfe966e9c42de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779379418, "uuid": "472bf568-59d8-464a-a246-06764e88d8a6", "value": "T18FA3C717B94BD0B3E42591F186826BA18FBC7C333646213BD74FC9419DB8486D452EFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779379418, "uuid": "d911628e-e2ad-4acb-a361-2386fd75a509", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779379418, "uuid": "bd33f3f0-a97e-4496-a4b4-6edaea520fd8", "value": "1536:QhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6xr1:2hzYTGWVvJ8f2v1TbPzuMsIFSHNThy+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779379418, "uuid": "13a5bce5-a7fd-4b5e-840b-a19b0b4e2ccb", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779379418, "uuid": "9d2b71d8-2603-40ff-829a-72456721ec42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779379418, "uuid": "4527f90c-7191-4e0d-bf78-abc8059674c3", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc071f8-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372725, "uuid": "d0572440-b973-491f-ae38-6b8c6c0e4137", "comment": "Malware payload (Formbook)", "value": "7d080b0de2cd0f3c10271bf2ba73b172", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372725, "uuid": "069e0b85-e870-490e-91a4-66893863e2be", "comment": "Malware payload (Formbook)", "value": "39b89865d86453388d1f2f826a09c917f2181a981862cce22fb0233a42e7a116", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372725, "uuid": "c71aaedd-ee97-44eb-999c-0de2090b0c8c", "comment": "Malware payload (Formbook)", "value": "30b56bece4702755aead7ae6ad4a631e0184943e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372725, "uuid": "c58ac23c-312b-43f0-9906-ed682a7cad41", "comment": "Malware payload (Formbook)", "value": "32daea2888ee288b6185f1f561f75fbb0c6e29872ade7909a0ae49add3c1d36a06ec15c85a66dc2d5dea871e9ed784fe", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372725, "uuid": "efa42a18-90e8-46e8-b1b0-01167ed11a13", "value": "T118E433C4FDD6F5C20F50CD7E467CB97660D0B308B43AA89BDAE2AC621043A395F691E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372725, "uuid": "f8bb4660-e817-42e9-acea-a55090889c0a", "value": "12288:KCE+3c5if23VFRYLH3h+gf53omgkwgmR/2cjwGL8I0yyWaAWy4+d2kbe/RV:RcOUVFSMgOmgwW/2ZGX02PWy5bi/RV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372725, "uuid": "b9d165d3-768c-4dd9-bf50-7c8a95df78ef", "value": 669574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372725, "uuid": "b28968c8-b44e-4eb5-8fa9-24d0dbe143a4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372725, "uuid": "40a7499e-152b-49f5-8045-e581be6b8bc4", "value": "IMG__12724.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb5dc5a-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372732, "uuid": "d74a20d4-99cd-463e-861a-aaa6a4bc3e99", "comment": "Malware payload (Formbook)", "value": "42df4aa98bfcbb6f615664c73900dc38", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372732, "uuid": "d5d0bb8c-5900-4e6f-b305-b632e7853108", "comment": "Malware payload (Formbook)", "value": "39cf479638c206de96e319f2b506b7692af7c96e1b694c51731dc353f54c6356", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372732, "uuid": "b0dba7bc-8b29-4a6d-907c-347ca0402b7c", "comment": "Malware payload (Formbook)", "value": "9062c0bf5097ebe7078e06a13789d8ef08e6150e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372732, "uuid": "485acc3f-d7a8-44b7-beaa-9cd72de12824", "comment": "Malware payload (Formbook)", "value": "77eb9bdb4d1462d0789ca079c7f3ab77a7bcffc0fcccb184ab9a279c90bed78efdec4fbc3b7bb221f5a4dbaeec829e9e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372732, "uuid": "24bd511b-ac51-4995-8f14-4f93f76f514e", "value": "T1F4F43321B344DCA2FEB55AEBB37FFF241A91798562377AA1C6450C7D0C0A2B05CC86E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372732, "uuid": "ff5cb79f-de36-4c36-b9ed-4fb7207a6ec2", "value": "12288:rongiNUIR17SZf40VisHEdC8b+exO59xb6g30RvuSqY844Ft5tWD5Weui4qM3/Px:rOII2ZXoeEUw+8OxyRCt+534L/8VlkGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372732, "uuid": "acea02fd-a9a8-4a97-920b-b0523c131546", "value": 792679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372732, "uuid": "06f65b3b-14c0-4cd3-9177-944e422c6c11", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372732, "uuid": "c9a3b762-f5e7-4dd1-847e-61871b6f6895", "value": "PurchaseXOrderXPO#82024.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1399ee05-551f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372738, "uuid": "967ca6cb-b76a-4603-8f40-0e1e9bc71e26", "comment": "Malware payload", "value": "bda439681f5b2881af5ac544c54b1646", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372738, "uuid": "0bc22efe-eb34-4fbc-8b3c-2e7e1e1f07e6", "comment": "Malware payload", "value": "3a13583c51add43997b963edaabc063c1abf9600d404e1d0e49bf4d09665d104", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372738, "uuid": "3d8cc362-1f46-422f-badb-de301f7c20db", "comment": "Malware payload", "value": "ada384ab6e6567164a925b929829f2b67e44ca16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372738, "uuid": "e43bf15b-5548-47ba-9cbc-31f431966440", "comment": "Malware payload", "value": "260332b33910e2ad3ad236d542c12992fab89822fa62388c096b940774e1f543da379f0dc1d1c929ed87eb1c710b1167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372738, "uuid": "972022cd-cbb8-489d-8909-c263b913dee0", "value": "T1D2157AC13A449C4BD7F27EF94F15E679471E8E9D2D29E20244F4AE23F8EE64B9D20481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372738, "uuid": "56814741-7988-459b-b39b-ab0e97f9ca95", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372738, "uuid": "0547d6c4-3474-4d90-bc26-8a5394b08212", "value": "12288:YBz3Cm4bQdnmJ2k491sp6iR0rXxUSuyA6wwtJbrq:ECm4bDJksp69USu4wOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372738, "uuid": "afb07d6d-0c57-43ee-93cf-5904c36277c0", "value": 912400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372738, "uuid": "3c3c9919-c040-4e99-aa93-76cc46b259a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372738, "uuid": "e25a203f-f66f-4956-9449-aa6994026714", "value": "Product_samples_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15fd6ea7-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372742, "uuid": "bfdb0020-f947-4959-8503-e9741abbae92", "comment": "Malware payload (AgentTesla)", "value": "d8abe95d007beaaa1859cbe31f78185c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372742, "uuid": "70d947c2-9315-46e4-b6ed-0a09d09c2d0b", "comment": "Malware payload (AgentTesla)", "value": "3a538ef02cc87ab0fd12ffb13cb1c86f31e7d0ec36760296628756b4edb4211e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372742, "uuid": "b365f8bb-3176-41e7-aa42-9e3867364744", "comment": "Malware payload (AgentTesla)", "value": "b05d2d962601736a5f76c1a0b0a022c5cfe9d9fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372742, "uuid": "0b582772-0891-4ea7-b74f-01bdecde583f", "comment": "Malware payload (AgentTesla)", "value": "319361dc579e10310c1075eef35be6169928d0524ac9869d9b9d9c92f8f4e467c1827bd52d459bda31f16cdeb75deebb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372742, "uuid": "b5daf23a-77ec-4808-b75b-b5778e9e6873", "value": "T1B635AD0273D5D036FFAB92739B6AF20556BCBD250123852F13982DBABD701B1263D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372742, "uuid": "28d5fb79-c41b-47ef-8f72-a8f9dd89c2c5", "value": "649f6ed9a4d576c154bbc0357156a4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372742, "uuid": "0a4a6079-454a-4cdf-adf2-6ab76be8e186", "value": "24576:gAHnh+eWsN3skA4RV1Hom2KXMmHa6S45:Xh+ZkldoPK8Ya6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372742, "uuid": "1342a3f3-9ebe-4da4-b764-514e4db81952", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372742, "uuid": "1489f6e9-b772-441f-845d-3e0622be3cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372742, "uuid": "d3b35325-f838-473f-8b8c-bab673280681", "value": "Dhl_Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1859fb5b-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372746, "uuid": "36301196-2c21-4db1-bd6c-513bcf562894", "comment": "Malware payload (Formbook)", "value": "de4d235fdfe709db2b12a57dd86b2c40", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372746, "uuid": "1f2b45c5-6da7-4320-b3e1-55995fa41fbb", "comment": "Malware payload (Formbook)", "value": "3a606e9328223b1c63b85f84598c83ca95a4f21a42047e1e818eaa593d9f37bb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372746, "uuid": "446cd2d0-574f-46a3-b7ec-dca58b5af9e7", "comment": "Malware payload (Formbook)", "value": "78e839516fa42d6dc4f30b8179eedf167e3b2af2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372746, "uuid": "07ac5825-17be-4ff5-b25c-a138cc2e99c0", "comment": "Malware payload (Formbook)", "value": "998bb4d0c27f74e2f346fc4a0e74305a00a81ac8b8622ac00fd714d4aac5459a398e6032c125e31ed342f0602555f4bd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372746, "uuid": "3f976858-ef72-49d5-be23-f1b24eafe9ab", "value": "T15C0523F959AEEC75CB62355C0703A3B5F16B96F4B457F3CB80FAA88999934C404BC409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372746, "uuid": "f169e74f-89d4-4627-9c20-8f333e64c62d", "value": "12288:Ajw4SRgOcu9+cIlKrZG5ve7IZqF7jlr930qvrzvOqRstSNjd2l5ioVD:swBRrYclZG5G7IZqFX31v/UAd2ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372746, "uuid": "7ced350c-56c3-4f40-9c7f-92f7b73d4ca9", "value": 803199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372746, "uuid": "44eadcc8-c96f-41e7-a13a-e1392b0d3752", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372746, "uuid": "78f35a19-8e6b-4974-9a94-caac8b9e1243", "value": "1012024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7fda9f-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779372750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372750, "uuid": "a475c6cf-16b2-4b82-8426-7a3446d8adef", "comment": "Malware payload (GuLoader)", "value": "975cb5f9371896d681a56b1693a320d3", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372750, "uuid": "f237c8d1-3607-4c81-ad16-ea34e024e311", "comment": "Malware payload (GuLoader)", "value": "3aa15d906f530f4b50ae0ce7627da1eab22fdb6110e60af7ca85fad30c9e164d", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372750, "uuid": "71e73cf6-28e8-4d40-ac64-a42e8c54b53d", "comment": "Malware payload (GuLoader)", "value": "de2174b2dc391a94cd071fe9192c4244d52ef76b", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372750, "uuid": "f50f526f-0923-4bb4-a123-6f90af711a20", "comment": "Malware payload (GuLoader)", "value": "fb6ae04a310e9f6c9bed5dd475ae76f61ad19078149dd3be4433bca97144fd508d1f824c9e203363e0436ad882ef0470", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372750, "uuid": "84b9c4e2-8a7d-4b39-b46f-885ad41c1942", "value": "T10FC19E1F6D4BE8A5E0341507E4887E196A39F7890E353B400CEF71389450B70A22BACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372750, "uuid": "13bd9268-0119-4fd4-aa68-006644f3e2c0", "value": "96:JbIoVkLvedWJFPlyeT6k+bnfEz/zr3CxLAe94m9QDA9WbRrvBK/D9zkPRHkdT71V:JkA8m+R8eP+bfi//C5Aemm2A9izAGPe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372750, "uuid": "e4add62d-6d32-48ee-b1e8-8660ff783872", "value": 5918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372750, "uuid": "3583f9a0-1f1d-423e-a85a-5f5d8dadc1fb", "value": "application/x-ace-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372750, "uuid": "44957634-c0d2-4f7f-bd40-1e5628bb629c", "value": "EX778415591042_(2).ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd11bc4-555f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779400481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400481, "uuid": "598a551c-daa6-493f-9240-4128717cf9c0", "comment": "Malware payload", "value": "bce5efc5de0e9ec6716dbbd673528496", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400481, "uuid": "60f777cd-76ab-483d-8d2e-fb12ba5f152b", "comment": "Malware payload", "value": "3adcdfe92f3fa4802295808ca33bc8407365e09cd5dd7ba977978c2cff845a69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400481, "uuid": "748befb4-e09c-4427-b302-509c297cc026", "comment": "Malware payload", "value": "fb7eeb4d386134d713ea03930225eb6084796665", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400481, "uuid": "5f4e1cca-e55d-45ec-8e50-57f93c8dca20", "comment": "Malware payload", "value": "6673fd7140876c3112e37d07a1b15239bc062208d3d1815680d22604bfcc0e16579f2bafda5dece28a2e9ab174919f84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400481, "uuid": "4ec91d88-5477-4a80-92f1-37554e3d68b4", "value": "T1ED450265B54C2631E2CBF87FAE0DC6F19452B0F95798C0603913C25EF680EA94F6AF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400481, "uuid": "9d6d0259-3d18-4e77-a1c3-ef1dd270d460", "value": "24576:xrLyxqYaunm95MyK2UKFRNUsMJRym92EuYw+l8Cjd3yT77/O/xZRUDph/Fd:gxXnm9BK6KscRnY/+lDjdC/7GxZRU1FL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779400481, "uuid": "8d83e72f-1e3f-421e-9d4f-c205cbc9583d", "value": 1240741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779400481, "uuid": "e6b13cb2-7544-4f9d-a1fc-5a807aaf35e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400481, "uuid": "0d4cc814-ec59-4865-a5bb-f3ed9082bfd5", "value": "uagkrww.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdb452a-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372754, "uuid": "091d3dc8-9bd6-480f-9a1c-fdd4a587b8d6", "comment": "Malware payload (AgentTesla)", "value": "c097dfbf40246d3b43a604d9571dd4f1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372754, "uuid": "e7c5ac1e-f4e6-49ba-ac8f-c32775c0bcdb", "comment": "Malware payload (AgentTesla)", "value": "3af1e949076a3e656cc116c422461497b84575d028a9b99db0f004a9de191094", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372754, "uuid": "83a4b317-10cd-48bf-82d3-15585c5693d8", "comment": "Malware payload (AgentTesla)", "value": "68949a9f030d3343ef5ee2cebb66d8581623a7be", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372754, "uuid": "5b6c78ab-1e22-4284-9f12-72077f3579bd", "comment": "Malware payload (AgentTesla)", "value": "b009a7e2648f258648af5336a37d105f1cb55d4914aeb86d0d1a9b90c0b31ed81b142d93787eccd1a9afffaf711f354e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372754, "uuid": "ecacfa7d-65d5-4ef9-ac66-35dc0dc3546c", "value": "T107B53373F9BD7894DD33C0A15BADEE9C8DEE24D60221937CA9F5A27E85B23414073192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372754, "uuid": "7fd1521f-9192-4cda-a928-45d0d0b57ad4", "value": "49152:RGsUajmlk9SuQKYoOtidASERBdX9qOl52bixrsecJCf:ssNalk9SuQboOtR5RBdX9ZXYFfIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372754, "uuid": "8c6ff0b4-4073-4751-a760-899275c4a140", "value": 2304255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372754, "uuid": "c0a74cfa-562c-49d4-a4d1-11f95a2a72e4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372754, "uuid": "5317a71f-6952-41ea-a20c-6a2db463ec03", "value": "IMPORTXPO2024-0961XASTG.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1e96fb-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372757, "uuid": "5c483224-e0dd-4970-a9ae-27d849954301", "comment": "Malware payload (AgentTesla)", "value": "f5e4fc87937ec2a93b32d452e5e08d8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372757, "uuid": "a6e300c6-fc34-42cf-94bc-a15ee48da87a", "comment": "Malware payload (AgentTesla)", "value": "3b00087733d29d27a553f25e93cefd4aca7179a278b91fe7e80c2f984975b5b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372757, "uuid": "b75e2856-f731-437e-87bd-381f879a6c65", "comment": "Malware payload (AgentTesla)", "value": "5f93c022af6113a20162cbfb171beacf168b16fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372757, "uuid": "938392b6-05ae-444f-99e2-ca263823da90", "comment": "Malware payload (AgentTesla)", "value": "c5e552bd5e2aaf2f52288bc2f95198debd871d5a05500b3977959fc535fb5b0a0c61eb00c0937f80c23955deec2a39af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372757, "uuid": "8597c3be-ca58-43a9-bb2e-b05c9a129e65", "value": "T103E4237302FE5F8D51C00E61C993CB1EC19F27219272DF9E2653BC9851ABD2217EB989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372757, "uuid": "ed5c64a5-241b-446b-87e9-15d01ea393eb", "value": "12288:BL1TroolsBbhrDK7IX3pCqKcNTIIeE5hH53Ketf0Npj+KE5fw4nvPkck:BLZr1md8qpCLcNUQ5htFf0v+35k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372757, "uuid": "ee40744b-f1a2-4f8f-b3f4-980702d85ee3", "value": 662426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372757, "uuid": "30f76e4a-0114-488f-82c1-437f10720bdc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372757, "uuid": "d96a5722-4e6e-4b34-acf1-e72227a38ee5", "value": "Invoice_314367.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213f7e47-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372761, "uuid": "4fabf65d-dddd-4b92-82e5-fd2e53674a5d", "comment": "Malware payload (StrelaStealer)", "value": "880e9216075020b98098e13a16198133", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372761, "uuid": "6602285f-d7ec-445b-af6d-e71701c9227a", "comment": "Malware payload (StrelaStealer)", "value": "3b1a3005f1de760c64abd3703a3af179bccf8934a8118ad7bb177fdb71b9f9ef", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372761, "uuid": "294e12d7-29ab-48de-aee1-397b91af0570", "comment": "Malware payload (StrelaStealer)", "value": "3a39f567d4d1331138dea34b03f70341622e3307", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372761, "uuid": "77743cb8-86fc-45df-8d01-3d8ecf47eb36", "comment": "Malware payload (StrelaStealer)", "value": "fa1877d78eb2a6fdcdc802fb8ea6e4eb27e965e2147d55b1a09af42968aea20e173be60c109cfef34aba5617b9786bfd", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372761, "uuid": "517824b6-3e6b-436d-9463-0347b1af978d", "value": "T10E11A5C59346490CE8823AB4C68C9543875A5D4FC687FB11B257B3C88E0268954E2E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372761, "uuid": "2633b1b9-6fbb-446e-9257-666ea6cc44d8", "value": "24:9oXpb4AjuenrtAg3PaJkFOvqIpJ44xd6hmw0Ho/mbB1y:9oZnjBnr18pqYJP6hZ4nFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372761, "uuid": "a7890861-6b5f-4515-b6a1-e74bd1ecab9e", "value": 1032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372761, "uuid": "113a08e4-0ce1-4183-b992-36376403fdb1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372761, "uuid": "d4a56b3a-523e-489c-88b6-49b549ff4ed1", "value": "Rechnung_R24-167627.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad990dec-54e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779346368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346368, "uuid": "e852beb4-b55d-439b-905b-1f93042ed9f6", "comment": "Malware payload", "value": "f5165ec72858d3d2e49178ebdb8532f0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346368, "uuid": "2609a994-806f-4f42-aa7c-bb1b7e43c5a0", "comment": "Malware payload", "value": "3b71c6c5cec371d2193fb641140a8069e9e3531683f7670f7e2865b853275407", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346368, "uuid": "efcc3fa5-ca7d-4c51-92ec-437a9a748621", "comment": "Malware payload", "value": "562ab0a23cd3be530743cf97de1802b3f5bb2974", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346368, "uuid": "0b0a8f16-bdb1-482c-b926-e9836a4ccb05", "comment": "Malware payload", "value": "ad728d5f804b4d3ec3466130beccd6402ece6dccd72c0d28d382e0a51903eb0f4d2505b8da024bbaf4c644d9ceb7a177", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346368, "uuid": "9127b84a-a22e-4df6-a50d-53584d6193fc", "value": "T1B017120A2F0C39780ADD654225BF6E5F6CE80D19910378FDAAE75E8FA5C853F61E841C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346368, "uuid": "8a334b39-a628-4345-ad38-25f2616af0ef", "value": "49152:tvAqv3vHvuvYvqvHvhvVvNvTv/vKvHvfvSvjv4v+vMvhv4vWvyvcvyvFvFvuvmvJ:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779346368, "uuid": "deb7e8c7-3ae5-4679-bda5-ecdbcadf037c", "value": 20014252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779346368, "uuid": "cb5e8db6-4852-4e66-bcc6-99d856e9da3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346368, "uuid": "ac379f9a-da86-4190-867c-566e91eda2a9", "value": "transcript.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23796ef0-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372765, "uuid": "1cb32c06-67d9-464a-ae7a-6bbee9a73e36", "comment": "Malware payload (StrelaStealer)", "value": "bc013ef81aaa570543d17b4cc7633328", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372765, "uuid": "a14b9945-9416-4ff3-8fdc-f8cfce398d29", "comment": "Malware payload (StrelaStealer)", "value": "3b7f255af563a2efcc4cfe244b367a86005d204065654bdd07babc59176dbdb9", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372765, "uuid": "04ada828-9fd1-4c70-a624-a531d4c2ddd2", "comment": "Malware payload (StrelaStealer)", "value": "e12f4290c7309a5de2a8be372784833c4bd5eaeb", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372765, "uuid": "c286b170-0e96-4569-86cb-9800dd05c4ca", "comment": "Malware payload (StrelaStealer)", "value": "d47e31841d7754b5c9fb39ac4c3225d6959db5fbca6c2a87fde09db46823c7c6605829c5a5250d49468700351c5393af", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372765, "uuid": "762de9a0-09f3-4d27-ba02-2df38c549b40", "value": "T1FB716CC02831B713E64F5FF688E32BE55B63D26BD982417F6902670B704C6D3561C742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372765, "uuid": "f1f33929-c3d7-4b5d-9d0b-7687a8b8dbbc", "value": "96:nibK5K49dHqy8TXb3BAC9fwnlK07DL3BucexS:iP49bWXbRAC9fw0mHIHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372765, "uuid": "c3fa165b-c9da-4eff-a1bf-a10e60d6ded0", "value": 3591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372765, "uuid": "aa736baf-0187-4657-9dbb-4f5f8ed96648", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372765, "uuid": "929187b2-7270-452e-92e8-4bab4e1965cb", "value": "SR24135784.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2a8672-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1779370714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370714, "uuid": "a0897aa2-9d86-418a-a1d5-5e1d0c8c3a5e", "comment": "Malware payload (DarkCloud)", "value": "5d3895f6c83372845fe5874af738a9ef", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370714, "uuid": "c3bc6c9e-787c-4b42-9c17-49e13f28478f", "comment": "Malware payload (DarkCloud)", "value": "3bc3f07f106cc8bbd9943c1fccda4b3e94de012f628ea28e8fe674531004bf4a", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370714, "uuid": "885b07cf-0c4b-4131-9028-facb6528a2cd", "comment": "Malware payload (DarkCloud)", "value": "cd82066f950014133dbb89d179cc44ea423a6a20", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370714, "uuid": "34ad9a9d-6f95-47b2-845c-c35bdd8e3133", "comment": "Malware payload (DarkCloud)", "value": "638d6c8293fddd4737537b53c0e59b7122c722616131d2b6c3375474f15432a3ccc6eecc6f2e97616e5ff7a491b8ed3a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370714, "uuid": "f231ad1f-2a59-465f-bae5-cf44a06d7a70", "value": "T1091523A9F754D32ACA5747F3666C0884E3F6734505B4CDEAB88B62CBC6C17864230E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370714, "uuid": "a9af4fb7-e140-4316-ab56-92d398625133", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370714, "uuid": "c354ee49-9528-43da-8ced-e8e7f53b73ed", "value": "24576:6i0//P6/QBtN9Fu1EF7MZto/SpxUM+MO9mO5oE:6iEy/QBtIz2Wf+f5oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370714, "uuid": "e71d41f4-c609-40d4-a45e-2107fec6589c", "value": 917512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370714, "uuid": "321f2129-85c5-4113-bb73-a681e16b99b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370714, "uuid": "c410b151-b5e3-4d1b-9f0f-0691208aa0a4", "value": "Uq8uKgzhE4CpiXt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b1e974-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372768, "uuid": "25602410-edb7-425e-9df5-7b39cb88d1cf", "comment": "Malware payload (AgentTesla)", "value": "c4e4e8e6e8d230979943d2c014f2f4b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372768, "uuid": "3f0c0936-fb75-4476-8ff2-8f7ccc4dc118", "comment": "Malware payload (AgentTesla)", "value": "3bf4e6133ad1f0f57520775e6a55bd65cb58a4ab0739fe05e38b598f9651e849", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372768, "uuid": "a5771ae3-a2bb-4f75-988f-2d5cb28ef48c", "comment": "Malware payload (AgentTesla)", "value": "93a8c0506da42d8c189e80a27b55e0ed6f1c9a63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372768, "uuid": "bb3d5c6c-0eb7-47f3-9368-a79de2e312b0", "comment": "Malware payload (AgentTesla)", "value": "8bbc729cdd32211e661ac507bcb22160a8588c5f65b9f4873cbb45fa588a3e946a379eb1286660c1f7ec75e1ebd24f0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372768, "uuid": "9cbd1983-2982-44b2-b36f-1dfbfd07881b", "value": "T1D4A4234BFAE090CA7EB91BF0C989572B61113F1CA416749416CA68EC93FDA3DE1CE1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372768, "uuid": "4c42e6dd-01cb-4250-9366-912259d1135b", "value": "12288:YWed+F+l1Is09sGlISOBvOFB4dxsEbgxW1JLuGvn:YW6+0l1IHv+SKGFkL8GD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372768, "uuid": "aa32724d-5761-4fb5-b9a9-861ae95bcdc3", "value": 475454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372768, "uuid": "c81bdaa4-1588-41fa-8621-b44731ed0b1b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372768, "uuid": "70434644-9ea2-4a15-a77a-8bdd43e3d396", "value": "INQUIRY#46789-JULY24_Materials.gz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a55d513-54c7-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779334981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779334981, "uuid": "aec79db5-daf8-4a39-804e-de0b96c4e30c", "comment": "Malware payload (AsyncRAT)", "value": "af8d1a8fda568ed55e7033370d71fe25", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779334981, "uuid": "e334218a-9c94-4433-a979-c1e6d7567649", "comment": "Malware payload (AsyncRAT)", "value": "3c06afd6074e6b5a71138f3037d0b03d6ff4ee589d8aed2c15ae7db38250009e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779334981, "uuid": "ec4568ca-3a15-43f4-9ee0-ccb815e49390", "comment": "Malware payload (AsyncRAT)", "value": "de897ae5ca0cc34fe3107f4eabd863208af615b5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779334981, "uuid": "4aa7b413-7128-4de0-87dc-25d4f9a8bdb3", "comment": "Malware payload (AsyncRAT)", "value": "635a2cbfff92c64ee759fb5ae9ee6bd4461bf98706a98c8b2aafc9a1ab32b6f9692733bfdedc0c2d9054313e1db08c13", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779334981, "uuid": "f46aec5e-f352-40cc-a64a-5999bb57e624", "value": "T198232C003BE9812BF27E5F7499F2314586B6F2673603D54E2CC4529A5723FC29A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779334981, "uuid": "97eecb25-d144-4e5e-89aa-a9a6bd1331aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779334981, "uuid": "b8899391-0524-4419-ba32-5163844ee0d9", "value": "768:IuW01Towx/9WU9mp+Xmo2qzG/F0laWRCQ0fPIawSLA0kfuz0b76Fi0i1PJsfe3Bg:IuW01ToqEO23XWRCQZawOYfu4b76IFFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779334981, "uuid": "5a853cd8-74c9-41e5-a7ca-3f1ef52e8a79", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779334981, "uuid": "063b6308-394a-42ac-94bd-b4c48e4dc6d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779334981, "uuid": "39394871-4100-49e8-b366-956b748c76dc", "value": "mko1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b58d3b-5505-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779361545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779361545, "uuid": "32e5356c-4944-4452-92bb-82cac271c490", "comment": "Malware payload", "value": "8eb003c9dc281427a2f2f8336be16325", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "metecgroup-cam", "colour": "#F940D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779361545, "uuid": "64a67be4-2e51-433b-b79e-b18ff44848f7", "comment": "Malware payload", "value": "3c41da8e04c77599cd797b516ec180b141f441f21ff3bb0aa26bdc339323dadb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "metecgroup-cam", "colour": "#F940D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779361545, "uuid": "2b6ec54a-d5d2-4064-852e-710eb5f4b02f", "comment": "Malware payload", "value": "881e2a24a8074f5193831e8d553cb143ca2ca7ca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "metecgroup-cam", "colour": "#F940D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779361545, "uuid": "15df29cc-077a-4846-bca2-42efebd4dad6", "comment": "Malware payload", "value": "fd58093361ac44df55fd683841d7e08999f85272dc8054ccf65461fc9657b89b8a5121d06e96558a5eb6cdf1947f8235", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "metecgroup-cam", "colour": "#F940D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779361545, "uuid": "9b97dc0e-f71c-49b6-a1fe-44b32be8d368", "value": "T1BD942473DA0589B66C87A820CE1954251CCEB527F0D7E5BDF6A834DA0B74E806A47FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779361545, "uuid": "8f598af2-2b71-4c4f-94f3-2042000353f6", "value": "6144:Xi6j6a9xe+mAKtYd79cA5/WzVWqUeDBObcX1gyRDmSoOPpDXbuvUJwOBH9426GPr:jV9pKk79RezVVObcX+yRDfoQx/wOBaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779361545, "uuid": "c89c3edb-530e-44dd-9ca7-ea951b174202", "value": 421200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779361545, "uuid": "e5462c7f-990c-466f-80be-3d4d421aa8e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779361545, "uuid": "179a0163-ae59-4fac-9850-af62cad54336", "value": "Lorgnon.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d941d2-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779372772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372772, "uuid": "b09a5b9c-8c62-47b9-8c4e-d4784a38b769", "comment": "Malware payload (GuLoader)", "value": "cccaef3434bb48fa765a2025ab21770a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372772, "uuid": "316e3c08-ea6c-42b1-acbc-aab6a03edaa8", "comment": "Malware payload (GuLoader)", "value": "3c63a3c0670132e07fb90ca3c29ba35d898f6293bd40619a5611cb705e8b8212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372772, "uuid": "abf376d0-0be2-43e2-8922-5e29e77eb972", "comment": "Malware payload (GuLoader)", "value": "0bbab84b4e502892a6b90bfcc5fdb7c076998ffb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372772, "uuid": "72405f00-0291-4aae-ae9f-6ad72e9eac67", "comment": "Malware payload (GuLoader)", "value": "1f173a583804c439cdc0e47e9b9a5aee6a8c29299266b5702f2f1bd33a5a697db263bbdad21125e7e25cb984b944e5df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372772, "uuid": "13805e89-4ea4-472f-91fc-a41ee3f4ab3a", "value": "T1A01501C2F1009595E4F11EF1E85D9B60DEA16D27D997150329A0BF1B3B733838AAF923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372772, "uuid": "a7c1d88b-2a40-4cec-a488-6e0520e1d14c", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372772, "uuid": "939466cc-fc14-4ce6-9317-a3539f36bd79", "value": "24576:H1C7arosQOWJ+IoXyok34MkIFHNXXRHpQ:VC7kopFz37G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372772, "uuid": "61b0e3a0-98f3-41e3-9cfa-353bddcd1680", "value": 924706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372772, "uuid": "75e52cc9-fd46-41b1-8c89-95f12afc7149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372772, "uuid": "da49b918-1805-4023-9bb5-0524156b59d4", "value": "WORK_REPORT_FOR_YOUR_FILLING_AND_SUBMITTING_SCAN0012_PDF.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f53cf3f-551a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779370718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370718, "uuid": "7bbc85e5-f1fd-497c-a848-bffb63837a34", "comment": "Malware payload", "value": "25c1398f1e917b8e619c337864aed21e", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370718, "uuid": "c73cda8a-370f-4784-b779-e5fc6ac4173e", "comment": "Malware payload", "value": "3c730b8dc5da0d3491b57de29bbdbb924e6ba77587430856004d218f6654fa19", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370718, "uuid": "68dd5c9a-e241-4612-b70a-cd78a468b230", "comment": "Malware payload", "value": "9df2215d48579d97a60cf1a1e58293783a970210", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370718, "uuid": "bef2a272-041a-4f26-b1c8-83455c66d123", "comment": "Malware payload", "value": "3f45c6a2c151b1cf0e7f96725b035d6ded58e9ca51f2a30767fb286ec0e58de900901543209127c65c6f1330703d2a60", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370718, "uuid": "3b499727-a1c8-4860-8c29-163c3872a3ae", "value": "T1991633FF98A12586EB1C295D81C04A5D15F38EFA5B6247CCF8BF9B215A8014D93F728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370718, "uuid": "6181ee39-2889-464e-bf61-e100f7e02bd8", "value": "98304:xzRYGB+okJOqHLQg/ZZ6oFnp6qPsTrgE+tyma8dj:xiqpkJJT/XdsTMpymn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370718, "uuid": "a938c185-655c-4f16-a9a9-a27064413fa6", "value": 4031762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370718, "uuid": "b1575321-df4d-4ec4-b5f2-86bd103dcc31", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370718, "uuid": "53bb066e-c3ec-46d4-b0f2-31793c90a6ce", "value": "Offer_request_inquiry_099585950_PDF.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0246c5-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372776, "uuid": "90e87d51-1fb6-4cf9-b7b7-ebd6e462e4c6", "comment": "Malware payload (AgentTesla)", "value": "d50f5c044cade943b107e12b758d94be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372776, "uuid": "69ef137c-68e4-46de-8f17-ad1b5ecc0119", "comment": "Malware payload (AgentTesla)", "value": "3c9f96db10be4b69eb71ed27ecea954f721347bee8a310fa25d9a0ee2a0c57dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372776, "uuid": "ef303cd1-54d9-4b9d-a8a3-56bec402c654", "comment": "Malware payload (AgentTesla)", "value": "016ac256b0d5956f05223f781518ad0bdb3594a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372776, "uuid": "2cd46427-26b7-460d-9529-fc1f6991ef59", "comment": "Malware payload (AgentTesla)", "value": "f85f2e81fb6a6557f18a56f49b48cb91380168336f69782e84b9604c34494d6ec8cd75e4e58da0588858e09c065ac355", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372776, "uuid": "1156fbad-0441-4123-be7a-76b0114c8010", "value": "T16BE4239273E49B27C1FE13F516952866B3F0141AE8A2EBF91DD6B1EF2481B005F10B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372776, "uuid": "eecd2133-d143-41b9-a338-ca8e01087d83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372776, "uuid": "3947af75-482c-436a-a3af-ec9d60e1373a", "value": "12288:hL9d2iNjJz/IIHF3fKqHnLooj076BZlSjuKoFClCjkiekD3HzqIwx0MUh5bc:Vn1NJz/IIHFv9Hko0Sx8CI2HGIwx7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372776, "uuid": "7127dfe0-1340-4459-b39f-6fa6b0213c5c", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372776, "uuid": "57144250-178f-4755-8122-e624df8cb2b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372776, "uuid": "6e7e028c-9765-4497-99bf-fdf74591d92c", "value": "PO781000885.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd45954-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372782, "uuid": "ddfebf63-8504-4ec7-a782-821605cf0970", "comment": "Malware payload (Formbook)", "value": "52017892725209dd4072a24161095502", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372782, "uuid": "9e0521ac-e80d-4be5-87f6-19c84ed06b39", "comment": "Malware payload (Formbook)", "value": "3ca8a7876e9cd45f761b58011eda2d3ead794312151242e3101658d5857889fe", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372782, "uuid": "eee0ff41-244e-452f-8d2d-2cf6fc268e52", "comment": "Malware payload (Formbook)", "value": "b1463194b232176b3824fbbe36ad6fca375f351f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372782, "uuid": "9f6807dd-b4a9-4fbb-93f7-af445d83926b", "comment": "Malware payload (Formbook)", "value": "04c13b8d2c08fcccb0f1f68b412bbb79adc0f5da03ec130f57a5e89a1eb27a5b4c6e5ecb177fbac3970ab6063956252d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372782, "uuid": "4b38d747-cb38-4f2c-896f-edd7db371de4", "value": "T12CE4232512718B90B3AF7DE084136B83E99910E76054489FCFFC04E9987C1A73F5A6AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372782, "uuid": "eac412e4-ab8a-45dc-856f-9a8c74a5953f", "value": "12288:s+4rE1loGgSx66KpQJoEX1hhq+75SyFUyNnToaAqvsSfSbAJNtuP:sjE1Vgg66K6JPq+7YyFUyJToaAIfmFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372782, "uuid": "e239a378-cf0e-48cc-85dd-ce4b62083596", "value": 663705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372782, "uuid": "b040081f-b326-4857-a812-ea70ab827517", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372782, "uuid": "a65ae790-dadc-4106-a803-c4537ffadbe8", "value": "Project__University_of_Bahrain-_FMD20240342_PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ac7dd4-552e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779379266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779379266, "uuid": "cceed38b-92a3-4403-93e6-be1a03405920", "comment": "Malware payload", "value": "6ec381f4895a1aeeb4031b6b553b90de", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate", "colour": "#F2696B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779379266, "uuid": "34a1b4c8-b4c7-4e2a-a5d6-cb403cd8f2c2", "comment": "Malware payload", "value": "3cb4b373a24afb10b8003762e763e6b44008bdf9a58d0a9a2b80a5de68308ecd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate", "colour": "#F2696B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779379266, "uuid": "eae78909-b276-4b7b-9c20-4e7a5fc85031", "comment": "Malware payload", "value": "b769f3a69621ebe5a2747e85f43b7756a515fec5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate", "colour": "#F2696B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779379266, "uuid": "bc789e98-6c8f-43d1-b751-11eb1fa24fd8", "comment": "Malware payload", "value": "51b8a75ac8858635d1c36f759b030275944e012d622e3c713a5c514eed9ae96427e3d9224e199f7f4b516da39d7ae640", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate", "colour": "#F2696B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779379266, "uuid": "15a21c29-529d-4db8-a411-6e4613cc8bdb", "value": "T1F386018BF749A66AC8F313364A7A4A2551474CA68F83D7C37904737C58BB6C05E0ABCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779379266, "uuid": "90fd1d38-69f9-4359-befe-df138a6efeee", "value": "196608:JuhqOf47PfFQ9Y/mNWdKRJ4eXXHDM5P5A0mCIj:AhqOf47GNWdKbXzMR5A0ZIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779379266, "uuid": "649d23fd-3b64-40e0-a888-aedab72a17d4", "value": 8125391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779379266, "uuid": "861ddea7-85ac-43a5-8d7b-3c0985fabc44", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779379266, "uuid": "9d0b73a9-f7c3-49a4-b71e-9da998430e63", "value": "NFO PAY_18.8_sign_sign_sign.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3083342e-54e0-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1779345728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779345728, "uuid": "cc259fd1-b177-4ca2-93d2-5d2742dbc972", "comment": "Malware payload (NetSupport)", "value": "0066832a27aca7e3c93fc6db0d33678d", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779345728, "uuid": "2fc7fe2b-219b-44f9-b254-8529a83c174f", "comment": "Malware payload (NetSupport)", "value": "3cb50ef6f6bcdd5580e1a56497e9cea56080a14674eeb4c87df5943d53ad56d6", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779345728, "uuid": "f89ffaff-0d92-416b-b426-c4e7103a72da", "comment": "Malware payload (NetSupport)", "value": "1fac94b42b8dfaca07c4c7b2da809fbc90f97fbc", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779345728, "uuid": "1bbfb9eb-ab6c-446f-98b4-3fa319dd3c35", "comment": "Malware payload (NetSupport)", "value": "44f278cd7d254c8da2aa41d7f4e6e6c5bacd2f758387a3038deec7f3c8fee4e329e2796b87770b005e48f2980301f6fc", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779345728, "uuid": "b2635107-df54-46d2-9a7a-12bebc956526", "value": "T1B8029E1EC7C84C83E1EFF5751AD04155C92AEA890BDB04494AF863C9BB82EF7A231335", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779345728, "uuid": "4dca47a8-1e4a-4cab-aeda-f7b54bdf9748", "value": "192:mORmyca9fbpkjXskAPyXXlKaO/Ax8/dI+j:ZRm/wksuQJ/g6dI+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779345728, "uuid": "fa06e01e-b337-46ff-b4cc-4f2c07c02a94", "value": 8990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779345728, "uuid": "64462e05-1061-4786-8aa8-860d9b438731", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779345728, "uuid": "2930b40c-07f4-494d-9c80-3518b8afa4cd", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa4599b-54f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779353914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353914, "uuid": "ab1b5ffb-5564-457b-8478-f0037163e7b4", "comment": "Malware payload", "value": "f280e12f51f996dae7fffc64a56ee527", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353914, "uuid": "b24bcfb1-bb24-499d-9efc-109eafdc55a8", "comment": "Malware payload", "value": "3cd7a6ad1df6c48afa326b64ce5370f1df568b33966218b1844dad427dcd34f6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353914, "uuid": "837d038d-889c-4ec4-84b0-7b50349570cf", "comment": "Malware payload", "value": "9cbd657fcf8936692dc9be9cc2c01c2d56c368f3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353914, "uuid": "f318aefb-002f-4562-877b-ccfc265fbe04", "comment": "Malware payload", "value": "861cbd44236b9e4078a2b475a0a2406eae58d957d46fa81896f1885a39cb90db147fa94576a230b0e94e8f2142aa6872", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353914, "uuid": "76ae05ce-16ee-4e29-90f8-3d71de3ad25b", "value": "T132E7339E97432E56DE1FF37059CF1D0A4B35ECDAAA90C6E76434B42C2D72723AE68005", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353914, "uuid": "4e96b5d0-6931-4858-a603-248c9b845b8c", "value": "1572864:geIOcLT5IBiWVVDlI+bxW0iQrbfiKjSCc7VywGIvJL0PAWkOPo:krT5mBVVXW+SH7cwGIvJL0PL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779353914, "uuid": "083c859d-e722-4a8f-9f06-b68a674946fc", "value": 67313664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779353914, "uuid": "54690aa9-86df-417c-ab9f-33e9cf894cb9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353914, "uuid": "d32399bf-2357-4420-860a-99c0c2e3c74b", "value": "3cd7a6ad1df6c48afa326b64ce5370f1df568b33966218b1844dad427dcd34f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38206c22-5516-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779368934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368934, "uuid": "c7f87dde-f748-4879-bb55-3bbd56f26c2e", "comment": "Malware payload (Mirai)", "value": "a5d878ff18d926281793830b8a086170", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368934, "uuid": "0aa59f72-d5ea-4568-a239-81e442dfd30e", "comment": "Malware payload (Mirai)", "value": "3cda183f431e119df5d69c7598cbc1e7dbe4ba6f370b11eceeb4c1e5180c487b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368934, "uuid": "08babdf9-1c6d-4df8-bfe8-ff55d0ffeb6c", "comment": "Malware payload (Mirai)", "value": "ea12f37c31de321b4ef25ea977fc644e1367054d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368934, "uuid": "808898f1-b607-4ead-bea6-1ae1c54e3d6b", "comment": "Malware payload (Mirai)", "value": "394640a1f652175da6b36c6605d3bb574831dfcc533c3e0fab1f931b2453cac5b890294eb66e57b7598c50166e9bafdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368934, "uuid": "21c41dfc-0a5b-46f6-a3d7-a802389960ff", "value": "T1C8B32C47BC429B12C5D622BEFAAE018D33536FB9E3EA3111CD205F5523C699B0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368934, "uuid": "65fb3681-eef8-411e-ad01-aec054b4cc45", "value": "3072:FoFE/17wjkxo1nhhal4VW7P2oQZVGvhzJG+39:5/Bw9fhal4VW7P2NZglG+39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779368934, "uuid": "39569ac5-fcea-4000-a301-475621f053cb", "value": 117632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779368934, "uuid": "998ada7c-e559-46ca-8327-3b70331d9584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368934, "uuid": "56efe17a-b24e-4146-82b2-e5754f46aac2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97133d0-54d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1779339086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779339086, "uuid": "d04f226e-6b40-4451-ac48-a7a3560e7023", "comment": "Malware payload (Expiro)", "value": "edabdbf55a7704964bcfa65cb910b432", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779339086, "uuid": "7cb06909-3d00-4ae6-961e-1c69b36588e9", "comment": "Malware payload (Expiro)", "value": "3d6da5772b68271ef098388e533350cc497e6744260111a773f6e828bec88432", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779339086, "uuid": "d8b1b48b-5a1b-4748-97ef-433f592b8a0a", "comment": "Malware payload (Expiro)", "value": "0244c9b18d8e284fe7e3d369768a33219c45579f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779339086, "uuid": "b778ef03-38e6-405f-b03d-ff3a19a8d731", "comment": "Malware payload (Expiro)", "value": "ac625906c59154574220d5db804fa3f5fccdb0692f1e54e010550d60146557b5d8ee93c4bcc113cb22720eecf049eeb8", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779339086, "uuid": "cb4aaf99-bced-425e-a0b7-ea350ec7ff7c", "value": "T14C4633241A62B0E2F85BCBB1C1A10146DF66B83A0610DE8F0EB69D7ADF734955F3B711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779339086, "uuid": "3cfe87e4-033b-4b5b-8e75-1a634648148e", "value": "050299c65eb6ef7ac704d1e57a47c396", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779339086, "uuid": "64dae7ad-9896-4702-9d1d-bc3b0e8e5739", "value": "98304:+eXnYSzAQmedPrf6OB8rg26f32bfkuvHoyM4tjJax1mSxDoJVmvRr5FH55SSDntK:+yYSzAed7Wrgb32vvHoStjMQSVoJVmvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779339086, "uuid": "94ee9e14-158a-491a-aaaa-3c8395673e3b", "value": 5777920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779339086, "uuid": "e90fffd8-1b6c-4316-aefc-96f22c37d22f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779339086, "uuid": "2cef2df6-e0d8-4ea4-9f41-5c69a96c6edd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb672243-54e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779346391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346391, "uuid": "f65560bd-9d2f-48a5-819c-2d2f25ddefb1", "comment": "Malware payload", "value": "9b0714b797b7a9887a9d619ca88be9cd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346391, "uuid": "f6278b04-ed51-4df0-91d3-5c9a2194092f", "comment": "Malware payload", "value": "3d72ab4aa3143b3c7f6ac9f9780c33a02e91e3e84f0984f9c40081ce8dd0905d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346391, "uuid": "b1f2f24d-dea8-4ddb-bde0-7a8e3036cc82", "comment": "Malware payload", "value": "85088f677aed6d5e7315967cf83d2a29a1037c97", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346391, "uuid": "10acf540-b977-45ad-800c-d579da5ddaae", "comment": "Malware payload", "value": "d1c8a192da5730f74c9c3d3ea44ecdb68ef9a63f67b0ff642e9e87bf0e5faa9c0f4c22a40ede353eb9e8004579148db1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346391, "uuid": "cbb81988-c444-4504-aa7a-412dae29da93", "value": "T1A41712247B6D6E290838307586E6574B7B74AC4B8460B4D7ABC27C8DDBC6F25E0F3918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346391, "uuid": "334f0ce2-32cf-4444-a407-262352c28ac1", "value": "49152:SSl7SGS/SySgS6SHSASpSZSmSmS/SpS8SeSbStSjSHS3SBS2SWSUSHSMSRSfSfSk:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779346391, "uuid": "87709e45-5980-4d39-a922-ca79d403811d", "value": 19814234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779346391, "uuid": "b14ed224-1f92-41e2-9fa4-5f4f1bf6b2d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346391, "uuid": "e8abcd10-4607-4823-8be4-b455cd0ed74d", "value": "transcript.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe16561-551f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372786, "uuid": "6609555b-38e9-4e07-81f2-152b586bd5da", "comment": "Malware payload", "value": "03184521b9979dd7e6472582ca76c4a7", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372786, "uuid": "372457b2-cc4c-4948-b2e9-ef44ba1e6839", "comment": "Malware payload", "value": "3da71801735bbf2c147ef746c9223e13321e81b5d643e98b1c013da524ba9e40", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372786, "uuid": "3d96e653-c212-44a2-8e0a-f88395172dd9", "comment": "Malware payload", "value": "4486054bedb9a817f71113a20c70b3bf45831ca1", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372786, "uuid": "bf874832-a92f-44b0-b5c6-2b0aa2c14ab4", "comment": "Malware payload", "value": "2d7518873dd626e1efd172a92ff6ca518b29cb83bbce9327e198d655a8362b1e33acd4f897c3b1f833cba6af3179628d", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372786, "uuid": "1c1dd6fa-35b4-4aa1-8dbe-ecfe10cfc803", "value": "T11912DB54CB8D42D1F7226B969FD9A7D2472F9A21AB0F4BD21C1443C2332EEC19966F31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372786, "uuid": "d45e86b6-6379-4f4a-aca0-76d22106a15b", "value": "192:8gACEgWLvpFr1AXyYEDt/91UkMWX5nGJuv4zdnKTK:eLvFAX9EDt/xJnfv4zdnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372786, "uuid": "e733ab91-35d5-483c-9e6a-704eab90069a", "value": 9638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372786, "uuid": "6fcca871-375b-4068-8c51-195265644bf5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372786, "uuid": "804de4df-d157-4557-b815-afd43f1d1ed8", "value": "payment_advice.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328e6ba3-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372790, "uuid": "2e97664c-f3b9-4516-ac27-f310c85b594e", "comment": "Malware payload (StrelaStealer)", "value": "30323501a1ad93859fc1136420a3b382", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372790, "uuid": "7ff1beee-869b-4dae-9ab6-c1559128093f", "comment": "Malware payload (StrelaStealer)", "value": "3db29a124aff90b0c838002279bdc4f71765f74d1e95115f011b4458264c0067", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372790, "uuid": "a7b39fcf-8a56-40cc-bed6-ed672db1c1b4", "comment": "Malware payload (StrelaStealer)", "value": "2914644118f5da4af87dfa4081b27505c235f251", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372790, "uuid": "4f795621-902f-4569-8bb9-6b90d6a3e651", "comment": "Malware payload (StrelaStealer)", "value": "6034fc8cd5ce5c8f8ac8c1bfdf6216e3b5e9239fba834732e819336ef17ff35e1b24eceb9f38408f490cd11cc47ab50f", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372790, "uuid": "b94e6a7a-dc0e-46a2-b578-cf6db3cc7b99", "value": "T1EF31F95F15FBC30AF29466F215DCC941E6202A7EB0A5B13B215154E88089F6ACEC383D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372790, "uuid": "32bde623-5670-40d6-b61a-ca51f4432530", "value": "24:9b5AsN0UIDvehAC7VSmMmQp+ZdbBgcwyTpIaE2Ppy2wHTmWWPBw8DkO30PTM/35L:9b510JKhhS3odu6It2Ry2wUPBhDX0I3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372790, "uuid": "2812ebca-89bc-433e-a657-b292572adc47", "value": 1517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372790, "uuid": "df659f6f-0464-46ad-9d5e-01c9b8bf8ff3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372790, "uuid": "da106017-eabd-4599-bafc-232a36e1b6a0", "value": "Rechnung,68974.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f15246-5559-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779397680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779397680, "uuid": "da6c1aab-867e-44a1-8e71-c4e14df50595", "comment": "Malware payload", "value": "e53fe2b861e2044a1e856be38e87453d", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779397680, "uuid": "4b14bc9a-29cc-46b8-89d5-0b10ab69d785", "comment": "Malware payload", "value": "3dc65c75a559b15e60f09abfbdb1d4399cda6dc4134a793930d90e21d4ceebe3", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779397680, "uuid": "343ae623-0bb8-409c-a40f-7857d30497a4", "comment": "Malware payload", "value": "ec747c505a6af2b39b3a15f8bcabbaa6edabc3f7", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779397680, "uuid": "e0ee5c64-a955-41b7-9bd6-eb4793c86388", "comment": "Malware payload", "value": "00b28667c615d5bc18f446bffc889c50dc0fcb6195df9f94f3c622cd6b72b5805533cd7dc66212112c7fd1e4d1289b77", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779397680, "uuid": "80b4a3ee-2a23-4f0d-92c0-1a236d19ea96", "value": "T14374AF8BF0E370F9D91388B25F6FE7F27526361562152C7713E8873007609A65A8AF36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779397680, "uuid": "48787b15-87dd-4fe8-b619-13aab9cbf7f9", "value": "b0a98986e797fdbcd78edd1c67800788", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779397680, "uuid": "990fee61-5a4d-4bf7-a5f7-66599d3f6e11", "value": "6144:5DCfK4ppSOu0Ms/AAmdA9YDa/eIm5aaQeAHqXwwmquBAVU67OqPdiI8j:RkH/A/y+a/nmTQeAHqXnmzBKO4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779397680, "uuid": "70032cd8-634b-490c-9310-2e86846b66dd", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779397680, "uuid": "31c79133-dbbf-4481-9059-9ed2b3bbe5cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779397680, "uuid": "027b8c80-b764-4a45-ba45-95e60ce45d7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76ace82-550e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779365712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779365712, "uuid": "72f406aa-2ba5-4556-8a25-e86f2e7d90f9", "comment": "Malware payload (WannaCry)", "value": "9f7955c094f7f9ec2f1186ff31b79e68", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779365712, "uuid": "064ea7f5-fcf9-4042-b19d-da564a9f96a1", "comment": "Malware payload (WannaCry)", "value": "3dcbc03b738ec69a222ba34b4f97445661f20b9504b23c8843a5f4a8fc9988d4", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779365712, "uuid": "b6b32058-15a8-4fb3-ad8f-cf3439b28be1", "comment": "Malware payload (WannaCry)", "value": "e909b0e91c426c85b1081273f5e1c8dd081a26fb", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779365712, "uuid": "85e4e67e-2202-41fd-962f-1895bf54b690", "comment": "Malware payload (WannaCry)", "value": "190cafdae34531f2a57e34d8a3c8d5da0084da71f02f48fef64d86ee1b27d15ff4023f97b0ad1f1427e6c452b05159b9", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779365712, "uuid": "42a5314c-99ec-445f-930c-63544301a8f8", "value": "T1F936239932BC91FCD20626B484B78E13E2B37C5922FD5B0F5B40867A1D03B96BB64753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779365712, "uuid": "abe6867d-5cf7-484f-8a6e-087f1f05afb3", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779365712, "uuid": "3ab420f6-87b4-4056-9ae7-d9377d27dde9", "value": "49152:jnsnsEMSPbcBVQej/1INRx+TSqTdX1HkQGdhnv:DMfPoBhz1aRxcSUDkfdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779365712, "uuid": "1d95277d-21e4-4c29-8062-ef6d28c6a773", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779365712, "uuid": "22176d94-8faa-4091-bc79-38a781172ec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779365712, "uuid": "698160b8-d1ee-4c00-adb5-f5a5554a84a0", "value": "3dcbc03b738ec69a222ba34b4f97445661f20b9504b23c8843a5f4a8fc9988d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368bfbb2-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372797, "uuid": "edebba11-9d0d-4794-b3c7-fbb54fa5770c", "comment": "Malware payload (Formbook)", "value": "0e9c002e305b2915d650d27af4d27e99", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372797, "uuid": "50b789cc-35d7-4139-b08c-6dbea25210f8", "comment": "Malware payload (Formbook)", "value": "3e0a6b2f26913a5823433c43b4ef8d72477900b447707eceaad0fc7a7f93d644", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372797, "uuid": "4cf3e0c1-02d8-41ed-aa5c-04fbe73304e7", "comment": "Malware payload (Formbook)", "value": "ca140d9860752e2b81ba38c1d5c4d840f5485e06", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372797, "uuid": "3c876330-2998-483c-8c78-c7d3388d108c", "comment": "Malware payload (Formbook)", "value": "a4402ca018848daa6969efc8966f1fbc9ee6a6402a89bb557831ab7fc0fbaad211140252066c67146c4d206cf17f5579", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372797, "uuid": "9b45ff96-4b3e-4d8b-87ea-b6294f2a8967", "value": "T1EBE423020D5C78D1BEF1A93AFBD1D6A0E8801D78E7DCDACC7EA3408E5614D259AB7364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372797, "uuid": "32e4ef4f-c008-42a9-b3f2-25b30fa8e900", "value": "12288:TuXZPzmLEV7CgkQ7kHmCbS3H7r88mRthEMtgBnlR7a63EKybM+f8C:2zmoV7CNLbS3HszlEgglTV3RIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372797, "uuid": "0df28b86-e275-4fea-b01e-78684312dc8e", "value": 709708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372797, "uuid": "ddbc8dfa-dbb6-46f1-a04d-5b13d8b98a7b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372797, "uuid": "91ba3701-79ad-47f6-929d-129bdc4c63b5", "value": "CHN1080769.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ad2660-551f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372800, "uuid": "8bb0d0d9-6032-4fc6-8123-4f436c614830", "comment": "Malware payload", "value": "f23e42bdef32d3f9734b11883eeb5b29", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372800, "uuid": "67330fba-4b31-4126-ac4c-0821f5f49068", "comment": "Malware payload", "value": "3e15be194c99f974e1124bf2877c24e67b0cbd7fc585f375916e7451e69251f1", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372800, "uuid": "aa74f3a9-22ca-44e2-92c1-3b6f0fa79b08", "comment": "Malware payload", "value": "2099b64a796a8f0d58180a1f17fc65a5d2e35c59", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372800, "uuid": "9ff80eb6-5d9e-4fce-820f-28c3b6a9414e", "comment": "Malware payload", "value": "9f9da08d88357019d99a780babc4c3249a86bb27cbe2f97af9cc7a3d40f4888d766c9621916881365bf6a60a6230c21d", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372800, "uuid": "daef6e09-f526-4a38-ab5b-11ed236dd6f2", "value": "T17B450B10CB8C02D2F32227B64BD9A7D2573FAA21670F46D2391C4396272EEC09E61F35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372800, "uuid": "e6e02de2-41ad-4b22-8d33-a235b2bc3223", "value": "192:hSo2BgDLB3FbzNt8gACEgWLvpFr1AXyYEDt/91UkMWX5nGJuv4zdnKT:y81FfNteLvFAX9EDt/xJnfv4zdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372800, "uuid": "588e6b91-927a-478d-92a5-fcc2505384db", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372800, "uuid": "d6126d71-f149-4598-97f6-2504561ee3f4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372800, "uuid": "de9000f8-ca79-4cae-9d2c-0aec3c8868a3", "value": "payment advice.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615380f0-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370721, "uuid": "da7ef0df-2321-4c7b-94dc-940821e5e986", "comment": "Malware payload (StrelaStealer)", "value": "0fac08f4e2922df716121899a58e23d7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370721, "uuid": "668a7969-9cba-4c8b-91d7-8eb50e172e62", "comment": "Malware payload (StrelaStealer)", "value": "3e4094cb04eb6e08868a9f1680410ec9dd905bd42a32f20587a98a31accc8823", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370721, "uuid": "46b1ee0e-bb40-4507-931b-5ae9edf09e79", "comment": "Malware payload (StrelaStealer)", "value": "68ba7c75af38ad33136fdab4c056e6a5a03bf96b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370721, "uuid": "377ad656-dfe5-4256-9d52-8121c2c63f76", "comment": "Malware payload (StrelaStealer)", "value": "b36ea169bf2c3c78c7b7888abaeefebab8f705051bf0e997772ae5304462dd46fd4992fbff3ab2f4a37d3368985c0329", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370721, "uuid": "7a277a0b-23e0-478c-a7a2-0e07919cdde5", "value": "T193759E318F27E9FCEDED1D580C933C6A150445626C43EDA2D6CD21E543ECACA6F2662E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370721, "uuid": "f62c8650-a587-47b6-82f0-b3f685e7bb43", "value": "12288:oyxz0NdrT3il3iffuTaDm3JtTGRsQExSGSIFg:pk/S83UncL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370721, "uuid": "5be5495e-5627-43e0-a215-9e6d41b5647d", "value": 1636838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370721, "uuid": "f1ab0147-2051-40a5-8e2f-36bd38149bda", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370721, "uuid": "eb2b9797-5094-4431-8961-3009398ea402", "value": "1867884701008221669.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636a682f-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370725, "uuid": "2ee50cc0-6455-4e41-8b46-e666cd3ba99c", "comment": "Malware payload (StrelaStealer)", "value": "3fda34ccd79faa77adfd29163d1813a3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370725, "uuid": "b3e26d4f-4d66-4d2b-8b6b-9bd645f6fbaa", "comment": "Malware payload (StrelaStealer)", "value": "3ea9b56c4da85e1e3406b913c2501478d73c48dd94fd0cc1873564086e9bf35a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370725, "uuid": "dc779838-dc34-4b9d-9620-c8499a29bfc8", "comment": "Malware payload (StrelaStealer)", "value": "2b4f01ab432059d362ab313f7a063b729888861f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370725, "uuid": "3fe66465-24eb-4884-b8ef-a3d6673cf8bc", "comment": "Malware payload (StrelaStealer)", "value": "5796e8489c68a432f3a0d569d910940744a80ae222d61bc0e7a38e7c6f8c11e01c58f03ebaaece83f5ec79d8c6d3741e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370725, "uuid": "82a49af8-3709-4ccc-a54a-1163b6bf1dd6", "value": "T1FF45BF2262CB275B6F5ECA5C5C4957242D89BD233C2084F9BD6E078B103DA6F769133E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370725, "uuid": "59e2803e-b7f4-4a97-bb07-10040bcfa815", "value": "6144:AfUXzUH+TZSV0B1k6VIjT1ev0RX4TFi6k6Y4tyNfSF1tQd6k6yS4myNfSF1t46r2:AfTeg60t4Q6k6Ntc6k6vtO6k6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370725, "uuid": "7a4eef67-65ea-44f8-9e57-29ed56053f98", "value": 1236689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370725, "uuid": "c0310d87-7e28-4332-907c-51ac7d302e00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370725, "uuid": "5aed5175-c553-405d-b63e-2200977f7873", "value": "172071917173888714.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0829e9f-5513-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779367955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367955, "uuid": "0ad9ad7a-54ca-4c51-9ae2-f67131116619", "comment": "Malware payload (AgentTesla)", "value": "b6c80f928f7abad32a7971fd27f9c250", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367955, "uuid": "b148fb31-176e-4ead-b447-e747fb27f0a8", "comment": "Malware payload (AgentTesla)", "value": "3eb52e3861beb2dc7607610298919d1cb1f08a6c0746aa5adc06f1da5a377775", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367955, "uuid": "ee18efad-6798-4860-8f88-9f59e0af9d5c", "comment": "Malware payload (AgentTesla)", "value": "ede0b2123e7826f32100cbe84b63e21b96e47b17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367955, "uuid": "dbd4f298-c8fd-4ece-88d8-2411b1ba0e30", "comment": "Malware payload (AgentTesla)", "value": "76c6c4353f6928663850aa99ba9879c5834b8a7e7af4d024808aceb0194c511c8c595c427ea045f550e878f6483ad41e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367955, "uuid": "98c4e91c-b095-4b73-bfc7-5001fcc3d9bf", "value": "T1824400027F88E715E1A93E3782EF6C2453B2B4C71733C60BAF49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367955, "uuid": "aa2f7f43-4201-482b-80b5-2248b4a21daa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367955, "uuid": "af179b92-f87a-49a7-ab13-d09da6c900fa", "value": "3072:2WbqayiqH2zSyo+AskmTHo9rG8KaG5jnTh+SYufzz:1qayiqWm1Isq8KaWTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367955, "uuid": "2cb1f13a-0714-4c2b-9c7e-cb0a7e068adc", "value": 262156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367955, "uuid": "c969b689-c186-4237-a3d2-44341cc4c76d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367955, "uuid": "64e304cf-a370-454a-a846-ec10d3c0d160", "value": "3eb52e3861beb2dc7607610298919d1cb1f08a6c0746aa5adc06f1da5a377775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657c7125-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779370728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370728, "uuid": "3b3586be-f0ba-46fb-bc69-630c5a44bcdf", "comment": "Malware payload (GuLoader)", "value": "be183d9b9dde31cb2c107bbf30fd483e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370728, "uuid": "b5b549f4-fdee-436b-abca-b8b405808303", "comment": "Malware payload (GuLoader)", "value": "3ec3fc71d8bdc875818fd9ebb7bc60ad815e65e9a7520d32b16c5291b09b3138", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370728, "uuid": "caa997ce-f9da-439f-965c-c6e50573b3ad", "comment": "Malware payload (GuLoader)", "value": "f54b5f9be8dd5857540c46c900bf43ca63ac8bfb", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370728, "uuid": "b89d7815-8fd9-4a37-9d0a-36d6c1c1fe61", "comment": "Malware payload (GuLoader)", "value": "e413e12e595b82707ed9575d0ae49499fc78cb10e192fe6e35ec92482a8f9e792e55b0525b93cf3cc86a92c2fbb65abf", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370728, "uuid": "31e3c175-446e-4e8d-9f83-302699ec5472", "value": "T1062533E0441C0AC8C99ABDC484F50667F2BBF24BD9A7E71825C6A5CEB9FCC92D5185CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370728, "uuid": "12d99589-cdef-4040-bb00-dc543eb25d16", "value": "24576:bXjQ4O+VHWMA1126/giZ1Hdlo99d+KUaDV:bXjQ4TZWMyRx1HrC9d+KXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370728, "uuid": "e163e389-aa08-42ad-b7b9-6afcdcec21dd", "value": 976444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370728, "uuid": "1ed0765c-47f5-42a5-aa1d-9db1747475e2", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370728, "uuid": "1993d5ed-1bd9-4602-9b47-660b3fdc3867", "value": "5112024976.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc8cc97-54e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779346502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346502, "uuid": "ec779f48-2f24-4e10-8cda-7dc0c2ce2eb7", "comment": "Malware payload", "value": "b1169d59723c99c68711c795dae0e21d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346502, "uuid": "d56b26bf-f0f6-40ac-b227-d43fd0fccf56", "comment": "Malware payload", "value": "3ee8fc468c1c7af8bbb7bbfb4f4427cdadb418b4c8000aaaa0224046e0b629ef", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346502, "uuid": "4249bbec-467a-4f04-a6e8-5301f89b8cfe", "comment": "Malware payload", "value": "5e33e8f6979f2b6267f4b548ec511b3c3d767555", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346502, "uuid": "523c30c5-ef90-4749-918b-68a57b5fb987", "comment": "Malware payload", "value": "ca026c695ec795c57cb4c395da6ceb7511883c32ba4eb92eacc19319c22f9f4dde8816170cbd0aef9343a9c7d1a24e26", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346502, "uuid": "6c9c9370-8d49-46a0-bf98-b880fa759123", "value": "T15DC523A2AB2A9F7FE1B8F4BE025917675137520303404DFA05DC02D5CDA7FAA3792897", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346502, "uuid": "1bb2af89-e604-4071-a765-76450c8af4de", "value": "49152:67/K/n1nwMwPmRt1p3XZHRbfl8gnFFfYJfK/n1noMwdmRt1x3vZnRbflcg3FFf4:6DOtwMemRD1N3FFfYROtoMOmRDFNnFFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779346502, "uuid": "4029a083-287c-4a20-a94b-2bb7183d86a6", "value": 2726160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779346502, "uuid": "e9bde0c0-ed89-4930-806d-177c9768eeec", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346502, "uuid": "504e3b52-3c56-4386-a139-4e137f88aaef", "value": "update", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3acae444-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372804, "uuid": "2e78ce46-c10b-4199-8f06-29089c36bd58", "comment": "Malware payload (StrelaStealer)", "value": "5f3a78ce0bf6206c6e5a61fd473c03ea", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372804, "uuid": "2094b8e8-0e85-4702-9b62-68144758bcd4", "comment": "Malware payload (StrelaStealer)", "value": "3f00d75c73300972ef6c840d828fd560e19eb8de3a1150ae06165b5dd11ce3a1", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372804, "uuid": "28005b98-e7a9-4615-86f0-cbcfb7a99c0b", "comment": "Malware payload (StrelaStealer)", "value": "4cff41c3bb71b019003c63fa2addd832a7f2063c", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372804, "uuid": "0e40446c-71ed-4541-a132-a7e199732606", "comment": "Malware payload (StrelaStealer)", "value": "b43d1865ed0fb19f9c5e029b10f38616624411390bb6ccfadb569e58be336e113c57356d22bf2a6c1f4edac74b522bbd", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372804, "uuid": "cfda2fb7-72bf-42c7-8126-dae5e2c0d8f5", "value": "T1CDA18E44D792B2ECEC1E5470052B647CA33A70D9E510B4C881FEFDA958284D4AE15D3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372804, "uuid": "b88cc284-b727-4f5d-bb4e-6af685312828", "value": "96:loMRCbypvbcdUKKg2XMjZxLNT7auHirfSIFK:lopbKOU1bcFJNHL0NK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372804, "uuid": "6f1a41b4-0662-469f-8a8f-00d82956572c", "value": 4779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372804, "uuid": "dc8bd457-53cb-4564-8f8d-d3252fb98e51", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372804, "uuid": "b159403e-6ee4-4552-8363-08d25884b2cd", "value": "RG_925_073672_1819684_Komm_Bergmann.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2e8f56-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372808, "uuid": "417debd5-002f-414d-8f00-9e02f0fddf90", "comment": "Malware payload (Formbook)", "value": "f28b5a48bb51aa6a7de1db644d47696a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372808, "uuid": "a4746a4c-43f4-46d2-b7cb-a65ca201cca8", "comment": "Malware payload (Formbook)", "value": "3f3540e185b31c70a7c89bfa8699a34e4c0e19a954a12597ea07791ccdb851d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372808, "uuid": "b9a6cee7-c062-4bd8-8214-150a1e5714b8", "comment": "Malware payload (Formbook)", "value": "129c09236f01076ae20ec384bad05a9945f0945d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372808, "uuid": "37947007-38d7-497d-b229-b578eea326ec", "comment": "Malware payload (Formbook)", "value": "d4e81036f597f4de843d12b20f8632f7025d8f44519a0ef2ec1a6bf3ec22a9fdcfb1445fc31690a14b17cd84048a50ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372808, "uuid": "de78c5d1-e9f8-4691-8fed-91b4e8a692d9", "value": "T1F255C00273C1C022FF9B92734B5AF6515ABC79260123E62F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372808, "uuid": "14e36b9a-2cd5-4798-91ae-04f90636d828", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372808, "uuid": "c4f65288-b2ed-4f4b-bc0b-9385142f7741", "value": "24576:AqDEvCTbMWu7rQYlBQcBiT6rprG8aS+0TmTrKehxZwa8:ATvC/MTQYxsWR7aStarKehxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372808, "uuid": "2707b94b-31f9-449f-8144-228f0cd3697e", "value": 1305600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372808, "uuid": "e7851865-8c13-4243-89c5-bd311019b0d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372808, "uuid": "4949b1d9-8c67-4cc1-83df-8020dbc5a3ce", "value": "RFQ__ENQUIRY_ORDER__202400864.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677dbd4f-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370731, "uuid": "b893697d-427b-4f48-ac47-dc431565e16a", "comment": "Malware payload (StrelaStealer)", "value": "b18a15351d91c5923503c2b6c351df79", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370731, "uuid": "b11c5add-bdb9-4fe7-8947-5e9236064f3c", "comment": "Malware payload (StrelaStealer)", "value": "3f3ccc2609b469467845df7e95578281e786b299a270face36faebdd68429563", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370731, "uuid": "a5faacef-43d3-443c-84fc-b7ec7854a3b9", "comment": "Malware payload (StrelaStealer)", "value": "cb2ec8f7c9a5d82f231706fea5011f67ad5cb8e1", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370731, "uuid": "5f6b0052-e431-48ce-9159-966faac8e404", "comment": "Malware payload (StrelaStealer)", "value": "e2e3aa95031cd954930e0e90e937e6651ccf49794723e5d9dd3c929fec2096c9c65827b89b4bc1bcc14414c57322be8f", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370731, "uuid": "d76f5799-1723-43c7-8025-b2020f3cd027", "value": "T1430412A2D654F07BC611A5284A96D26C8E6122106721DD78837E1A7F30168AFDF0ABF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370731, "uuid": "cd406d55-3808-4e30-a110-f405fe547bdf", "value": "3072:70ORcXrAAu83gIMEHzlJA5U6G9QygKIBK7IKoJsDfBp64l/NhWHW7r1Nwnj:hwAAt3jqG9n3Zm0Bp7lV1Nwnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370731, "uuid": "f8229525-9861-4b4b-a799-5626265bdc97", "value": 174502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370731, "uuid": "63669aec-a675-4659-822b-e8393cbd9a83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370731, "uuid": "d3d5b879-4741-4e4d-8ae0-87ff60bf373c", "value": "Rechnung_2024.20.07527.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42c04e3-5544-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779388899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779388899, "uuid": "e50d2673-c6c8-47ad-8667-97dead3862b5", "comment": "Malware payload", "value": "098fe1cc982b0d494e96da6b8c83f63b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779388899, "uuid": "a4ae4a02-c69d-4c9e-839d-cf8a7d832d75", "comment": "Malware payload", "value": "3f4ca73093efe94aee239c84fa8fc3d9bb95398ca198d2c6d9e6f40a31ff932e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779388899, "uuid": "5a49f70d-1558-41c4-9544-81cb17f40237", "comment": "Malware payload", "value": "1b8cd2557b43ea61ac217c73a38dea21dd096b39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779388899, "uuid": "98972809-ee64-46dd-8094-7aee3b7eae3e", "comment": "Malware payload", "value": "89a246ec4524d6450b58286272bac0428c1c9f4526e96750b2d25cfe34b0bc83afb0bc33cfb7e23601a4794d5f666cd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779388899, "uuid": "e2e79ae4-5a39-40f2-a533-7e6cf6560676", "value": "T158763B87B8924952C4E43A37BCBE81C432634EB99BC7565B6D04EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779388899, "uuid": "7cf66344-8c03-4261-a119-b2965a6727bf", "value": "49152:25xNekq7aBHAYP59wlLVmCveTH2mkGG6pU+5cO78gyqo5E+:gNu7s9h9wlLVmCvetcO78zqaE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779388899, "uuid": "a4f08966-68f8-4a81-9eab-4f1132b6fef2", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779388899, "uuid": "36e2234a-b931-4ac3-9fad-107cf5386a42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779388899, "uuid": "f2cf6eae-79e9-4663-9399-d1db4b9c899e", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb695f5-5529-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779377319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377319, "uuid": "4a6d9d10-deee-4a71-915f-8b355486bcaa", "comment": "Malware payload (Mirai)", "value": "17f7c680889de528cad347d6a7d427a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377319, "uuid": "ccb9d099-ed91-4586-8156-c577b51f66a8", "comment": "Malware payload (Mirai)", "value": "4013e08c3f6d497aa2670f12ebb67b85bc78c19e73b322a74457cb06941f8dec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377319, "uuid": "23571555-5757-4a5f-9080-3448c8b1854e", "comment": "Malware payload (Mirai)", "value": "2d9be284e41e850f9332bb67b4bf9fc69d59fc56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377319, "uuid": "ca5fd111-0e1a-4330-a515-e072bc278d71", "comment": "Malware payload (Mirai)", "value": "5efbdcd90d94c68032847c46b672312edd3daacdd9a439860d5a3f5102e787c2375ef1bd806f163182582fcdd42048a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377319, "uuid": "2dc3d134-803e-4d61-998f-796afb1bce97", "value": "T18AE31A85FC918F17C5D522BBFB5E428D372A5768D2EE31038C255F25378A9AB0E3B241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377319, "uuid": "80c5a803-3b7c-4d62-80a2-c7da3e05111b", "value": "1536:dh0l+bpXbnMmlAECqWIM27Y8EnC9EG4VvvK7xGaxpbl/w5AuXHlNewyw+w7ejhXD:dh0CDMmAvIr7Y8Ee4IFGWAT0aVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779377319, "uuid": "e4cdb07d-2a7b-487e-aef2-16aac81d90a3", "value": 149612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779377319, "uuid": "4a841661-32e2-4534-b505-c39e7b8b68a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377319, "uuid": "95925228-43d7-4b0a-abb1-bb18a03c483a", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ade733-5566-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779403363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779403363, "uuid": "fc7e5bea-370d-4fbd-b052-7230cdf69dad", "comment": "Malware payload", "value": "903b7454f1c68f119105aaba439a5d61", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779403363, "uuid": "bfe3307c-d064-4d5d-b363-69254390df63", "comment": "Malware payload", "value": "402879ff4b368a1dc489d8572137305c84b1983d9539d374f45f815bfa7c1177", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779403363, "uuid": "da825a75-7940-417a-bd70-897dcf90ea06", "comment": "Malware payload", "value": "73e9709cc274539ebb88cc3de35e01ed9658fcd8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779403363, "uuid": "6897424e-4196-4543-a100-45fc0be2c4cf", "comment": "Malware payload", "value": "c09a1eaae26847cc27c4a66389453ce5dd5acb3436747ddcd145e73438a954a69f0868dce390906f6a2503b5e3ff64f1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779403363, "uuid": "be690675-7258-43c9-9e1a-79c39d941794", "value": "T12B91315B7C53EB28A64AB5F6692B9FFC0D3C0EB4CB68053499476279784E34123B5138", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779403363, "uuid": "3941ffcf-5de5-47cc-93e6-a541f74cda6d", "value": "48:7R6Ljf940rkc3bvS4wqiv3/dLpIzpmXPCFlrejkbf5BPIxG2ip9oHx3iHDMV6ZEb:tm0cjS4wtXKxIip+RGVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779403363, "uuid": "fa31c6ea-154f-4d07-9bfd-a06c6c3bbde5", "value": 4429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779403363, "uuid": "4533bf3b-ad81-4e91-bae5-c1719e0dc913", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779403363, "uuid": "e39c9cf6-b8c9-4535-bb95-cd082d4328fc", "value": "123.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbebed1-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1779370740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370740, "uuid": "df63b9a4-7747-4a7e-99ba-141cc851106e", "comment": "Malware payload (DarkCloud)", "value": "1f98de4866002c4a6d400f6fd1bb5dc3", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370740, "uuid": "ab6af169-9a02-4847-bd7d-1b8310217536", "comment": "Malware payload (DarkCloud)", "value": "40573378dd3e1c982e3fda87cf3534b7852d6e5d1e1c311c0c657d73b6aad828", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370740, "uuid": "61f32292-867a-45dd-82ed-e9f06dcd7bc6", "comment": "Malware payload (DarkCloud)", "value": "5781fb72992e517f39bc6ec7761f4369dfca4830", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370740, "uuid": "c8f4c20b-7c87-4b33-b76c-9c9bd3fede8a", "comment": "Malware payload (DarkCloud)", "value": "f12542a238365351f3ecb842f15d56a3e3af21b897cc993998e310f2c95ae47fe77f643ec0d92248e869060b9af33792", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370740, "uuid": "3dd6d49d-e5f6-4d0c-9096-447c3672d7d0", "value": "T166153360790F07943C683920EA3E5E7457DBB993C4E72712E38A0DE9A5FDF2E0B41925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370740, "uuid": "12455c1e-46c3-4398-a98f-8e5973a146f7", "value": "24576:KNF1iVVmTSkqLSjThhdL2kW7mTXUe35pHcPr4NM:KNF1iV4qMt2t6VGPrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370740, "uuid": "4df116d3-6dc5-4011-a302-45da98a3f953", "value": 885078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370740, "uuid": "3da1f7ee-8922-4b8d-a35a-ca7f82cdbaec", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370740, "uuid": "a7e091d6-624b-4f64-901b-75bb9a2fc55e", "value": "QUOTE.7z.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed39a6d-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779370744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370744, "uuid": "f5ab6db3-1b8d-4944-8035-dfeae24fcc50", "comment": "Malware payload (RemcosRAT)", "value": "b2f4ee14abd1f6708d2622f548ff5096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370744, "uuid": "6c11d745-db40-45ab-90b3-92cf8c29596b", "comment": "Malware payload (RemcosRAT)", "value": "40ad06ede0f2075236b2853c63d4d1027c24620333e167ab91e6b79314e7e2f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370744, "uuid": "d1bb89b9-207b-4232-a1c3-b5c6e392efdc", "comment": "Malware payload (RemcosRAT)", "value": "6141e6866a1e3d79aa4d1838d933cd85c2a1bfa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370744, "uuid": "7de17cbc-2bb8-44ff-8b3c-f090c84df7f9", "comment": "Malware payload (RemcosRAT)", "value": "7d9426af2836b8283ad96222a0a8a71d12e8b5d5b607447fc1890d51a4af45038613e6b885cef91e955cd26e6ec4c5ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370744, "uuid": "489bea16-9921-49b2-8c56-14ae6404f327", "value": "T1A5C5BC44B4971DE3FC0454B8E8D231F022FE6E63B0FA69AFDF492D04592663E122697D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370744, "uuid": "4e10125c-e4d4-445a-b912-310f21c3d880", "value": "24576:oSJfBGEJpXmh1/bXSyZgHlgJHscyiMXtuXMC:9fBGei/bSqmIH8XtuXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370744, "uuid": "fc5511a0-4fae-4fa1-8dfc-f2e66f84f09f", "value": 2561125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370744, "uuid": "c56fe455-09f5-4988-b986-10bfba303624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370744, "uuid": "47be7988-5ea7-4191-8f88-f41cec59eef7", "value": "Eclate-0012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b6844a-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372821, "uuid": "df9093ba-85bd-4593-b809-f115052564dd", "comment": "Malware payload (AgentTesla)", "value": "6faa7e5cfd18b8b2a3bc2315f87f8da8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372821, "uuid": "cf99e9f4-a317-4e7d-9b6a-79115501a960", "comment": "Malware payload (AgentTesla)", "value": "40e2b4243746ec7bd1f2c6db7390cacc4c4125d4402abaeb01463185badab1ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372821, "uuid": "0251a6bd-0da8-46e9-bb06-64b4e89636bd", "comment": "Malware payload (AgentTesla)", "value": "61c3a5a3962d90c9cb68b23dea7066b31003f85b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372821, "uuid": "1637fbf0-e0dd-49dc-8338-dee632dace7d", "comment": "Malware payload (AgentTesla)", "value": "0460148f708ca84e067799a794114b41f8f6eaa3d5801b5fd1ac8451eeb7df9e9341615a4bf8f8ad576a813ced1dbbd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372821, "uuid": "bab97820-5290-4e0b-b696-132ed62afa62", "value": "T132D423A0850589F561E4433E5EE473CBCB4EB7EEE9CF960CBE2A55C84195BA817F4230", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372821, "uuid": "136ff43c-3211-4fcd-a77d-21d25da65ca8", "value": "12288:TO/H3GCSbuFty+rajGMiBZdkoMK88kamd2AfqcVVOqWKLcN:TOvxq4TaKr2XdnqcVVbWKYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372821, "uuid": "72f672bf-bfa2-45aa-b92b-5b155e7eb7d1", "value": 605501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372821, "uuid": "e7686dcc-5490-4570-aee4-0676bf6f9818", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372821, "uuid": "f0bb9ca0-851d-430f-9bed-dc70de659bd1", "value": "PURCHASEXORDER-6350.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e769234-5513-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779367790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367790, "uuid": "b1d1ad12-5b53-446b-a067-825b3e4f8dd1", "comment": "Malware payload (Mirai)", "value": "921a866e9404722fa60899740bd8f0ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367790, "uuid": "80a64b8d-bd78-4689-8c00-0b78a4465362", "comment": "Malware payload (Mirai)", "value": "4117510169ad4d007116c6e915ca1250c0aa6ddc828a47647af6a888e502990d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367790, "uuid": "fcf425bc-44e9-4361-b502-1d3b97511e99", "comment": "Malware payload (Mirai)", "value": "b33c86ff6711b7955abfae9d2b72edd7800b7ca5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367790, "uuid": "38064c96-940f-4599-8dde-6cb263ee46c7", "comment": "Malware payload (Mirai)", "value": "ce6a88cf7cba5afef701c285caa889d7986c9e40e4e90b2a1965e7aa710616dbdfd18851416281ba6b7f2333a406a8dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367790, "uuid": "b9f2e8c0-fc81-4053-8227-e0e1a171ec16", "value": "T1B623E881B8D28A5BC5E023BAB57F968D3325A7B8C2DF3716CD214B10378691B4D67B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367790, "uuid": "5ee66c86-faa2-4c0f-b1f2-1ec0241005b8", "value": "768:M3l8XWYgXIsKvHicfjqT/AQqVzIt4KiZly8wlrQ:M3JI5vHBfk4ZMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367790, "uuid": "3dbcac95-a988-4b55-9a99-3a57c5761ff8", "value": 46972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367790, "uuid": "5d997fcf-87f9-41c2-b9e5-3e8fcb91edb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367790, "uuid": "cba0ffbe-9b14-4869-ab4a-991f1072500b", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23128c8-550b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779364441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364441, "uuid": "237fbb39-0938-4edd-8b92-68f1eac13252", "comment": "Malware payload", "value": "cc50f2ac7cfaa0fb0da1199588d7691f", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364441, "uuid": "ff5722d7-e80c-466e-9288-e42cda7f815b", "comment": "Malware payload", "value": "411ddd388c4101ef819ec5e9e0d68542a540d7f622ea907958865dbef2129509", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364441, "uuid": "86338125-9afc-4b48-8eb8-78780ad100da", "comment": "Malware payload", "value": "f52daba178e31b1772af74b8fa2043912145ab56", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364441, "uuid": "d5dfe0f1-f8ac-4b09-ac77-72e9873ce780", "comment": "Malware payload", "value": "6419507fafbf5d4476904b479cf66ee2a8fd598ac2adcb9a5a9fa80982ee714077dfc8626760c66ac5be83ada680953d", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364441, "uuid": "522be6f9-40d2-486b-a78e-1f016d9679ab", "value": "T14B568D4FDEF948DDC18A66744073B502BF217640DB2137CB2BE8A3191F5A6F52AB9720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364441, "uuid": "eed3e61c-a394-47b6-a03f-d9f8076ecc2f", "value": "d6c19ce52e7a53024dfe85f4bb02cea9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364441, "uuid": "f6f3430e-9f2a-4d75-ba5a-2b7ae11b9bdc", "value": "49152:Iomt47G1b9Cjc0+X0mDs5oQE9l1bzxxERmsm6hUWb+Ft4aLXOSFqTVs/fX/x/Gh7:IoqXuIqkmGkCQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779364441, "uuid": "c2cfacf2-6377-4e90-9e4b-44c69d32d45b", "value": 6426624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779364441, "uuid": "12e1d9ba-e1a5-45f7-b7f0-b3127dc0300f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364441, "uuid": "de2c1f16-ff36-47c3-aa1c-11fc95cba386", "value": "20260521_025414_abyssalkraken_fit_411ddd388c.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f80f30-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372824, "uuid": "df3c2d6c-a344-494f-9ec1-dd0b65d90528", "comment": "Malware payload (StrelaStealer)", "value": "2f14f07ab86c39ea46addcb1e76bd9d6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372824, "uuid": "f5479e1c-b865-4b1b-bcda-c032045c1320", "comment": "Malware payload (StrelaStealer)", "value": "41472c6a7c0b333c7112e0ad05246d73d64cc3aa18a0b622e5648099f4eb7dd3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372824, "uuid": "2a49c1df-24b6-40af-b318-c7edb0749e38", "comment": "Malware payload (StrelaStealer)", "value": "9c023dabb66b8c9e8ecdd6cc008b21f9b911022f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372824, "uuid": "aef42c19-ad97-4cd1-94fa-3f5218b59e54", "comment": "Malware payload (StrelaStealer)", "value": "ac6bb59beb8f0c14e387b3eeef34ede99edab6fcc4ecb2b2f3b72e5be83fc457d5052dc2fe3321c200d415508a407e9c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372824, "uuid": "794b981f-8138-481d-baeb-3dbe9e5c72da", "value": "T1D4A12292C722E3D4A488419B12FF4DB6C641A52A290EB352DEF9E041E7F4F91634D47F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372824, "uuid": "10e88d78-adef-43c4-80d1-14deaab2af1d", "value": "48:sEYBt2d1GZDYjHHFaq0i05VQ32B31AkTI8Q32B31kKoC2s2d:s5M8DYcqs5BlAkMqlHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372824, "uuid": "47aa67d0-96a3-4f39-879c-e1620f4fa5e4", "value": 4748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372824, "uuid": "376489ff-3585-4f5c-9dc0-b46e75dc7540", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372824, "uuid": "6667f4df-95cf-42db-90a9-a95a599f4aaa", "value": "6686136911310813388.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727ca06d-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779370750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370750, "uuid": "25f74a8b-f699-491a-a263-8eccc4e88bc1", "comment": "Malware payload (GuLoader)", "value": "426c873d4e56cdfaf652990049222875", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370750, "uuid": "21659a3e-61f0-48df-b68a-1823ed7722b4", "comment": "Malware payload (GuLoader)", "value": "41a58703b602abae9849b85ee30ad4193831499c3df3ddd5a607bef98d44b53e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370750, "uuid": "521e2d40-c3bb-4efc-a0a9-7d4a84b2a65a", "comment": "Malware payload (GuLoader)", "value": "5c3aeca5b990b8eba04e4712ab1d4990e3a14634", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370750, "uuid": "9d47aee6-e6d4-4a8f-82bd-a33c96e1ee77", "comment": "Malware payload (GuLoader)", "value": "8ccbe5cacecf9f5ff1496b920a2e96790b142ff4fc0d548a3b763b613f6cc257a04d47c7c1a299c705297ce0b4a07dcb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370750, "uuid": "fe32253e-4f07-4351-b10c-7756a7b683ff", "value": "T167C42328297D095A29E7D5C5A0BCC6912F321E33CEAAF1C52D69E1A23BCCD1074F59CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370750, "uuid": "945ba8c4-f52f-420b-ad1f-326322dc22ee", "value": "12288:xprTx7AJRdya0jGHp39xhpb3dA4eL8A/bMN/UW5Khaflhz:xNlAJYjGHpNxhpzudgA/usgRjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370750, "uuid": "0194ff92-4268-42d6-9d6f-ea554d8dab8c", "value": 573036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370750, "uuid": "92acd1b7-d224-4bf9-a3e2-c11f5b12d991", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370750, "uuid": "3bb88e6d-1824-421a-9fd7-ae8a3d8a28d9", "value": "WurthXInvoiceX4052616348.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5dbc6b-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372837, "uuid": "4557d938-033e-4250-adc7-9846d2c95c76", "comment": "Malware payload (StrelaStealer)", "value": "5e2ffeae6794236f00626bb1ff6c53ff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372837, "uuid": "d5e46231-5718-4d3c-94ad-0b0c457ec96e", "comment": "Malware payload (StrelaStealer)", "value": "41d04ad5999555d632e0fdf4cd1aba63bc4d4abe319ef699c6b4a09219b7b40a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372837, "uuid": "81bec1fa-418e-407d-be40-4f43ee7ce193", "comment": "Malware payload (StrelaStealer)", "value": "0f57d09f669d8abdbe6c17d4ce09400efe3e923f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372837, "uuid": "998a4388-6706-4095-bcbd-52d3e5143299", "comment": "Malware payload (StrelaStealer)", "value": "dd3d67b25e876303c03000c7d0d6e24d3cf1164c5466c16799a69da3786defd8cba9c53d59f920cfc0451316892292f8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372837, "uuid": "0afc8996-835c-4f70-b084-994c71d2390c", "value": "T1B7B10B758DDF672622DBBBFE275A7CABF0C689C715127AC1044DD000A76624CB1EC8AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372837, "uuid": "ee63fae1-c051-41ca-a8dc-c217537530de", "value": "96:P3Zl5rj25MPVD2NCik+Ak6zCik+KNpTVA7S43:PJX8MRGCidAk6zCidKNpTViS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372837, "uuid": "2d3cc29a-3c21-433f-bc33-e46cbeb9b8d4", "value": 5252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372837, "uuid": "a0782ad8-b4db-4c5a-bc49-5144486a67f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372837, "uuid": "794f2acb-82cb-4264-b2b9-d1bc168beff9", "value": "2781550901433424563.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c27934-5568-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779404100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779404100, "uuid": "5335e33f-167a-4787-bdc9-4b25e6744aac", "comment": "Malware payload", "value": "0d4ffbe4b91c35e1f5de4f7b5e7f11ba", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779404100, "uuid": "8e7411ff-5da0-4dec-8436-f186e25b52ba", "comment": "Malware payload", "value": "41df81e8603f0c6dba43b03201a2045c9b0a9bb8311c269fc041cfb12281529f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779404100, "uuid": "fda9d096-5ef9-43f8-9315-e23f4f6508cc", "comment": "Malware payload", "value": "89d231740f1609982d708b6c3291b35fe6d9a0e9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779404100, "uuid": "abf18d4a-3fa9-4a23-980e-f4903b22e723", "comment": "Malware payload", "value": "03ceb09c1d34e20eb09da9cab190990f7f2315967b54b77541962c75af641aa0ba2f3d5bd3382fdec1c3caae92a3b18f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779404100, "uuid": "7a1e55ae-b8a1-4f56-a2ac-d78d60d72471", "value": "T11B633BA0DE5403665D0B17FEACA06F608679CAA6142210F5F6DF934DF00A5BCB37FA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779404100, "uuid": "e9c2fa8d-ecba-4776-95bb-88bcf514cd69", "value": "1536:yJ+Lym6bIQhia1aXqaXyXQRvfFlm2BYLSiQ:ywm7bziXakWsfzmHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779404100, "uuid": "aafc45d5-54b2-4c40-b587-281184c45191", "value": 69056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779404100, "uuid": "ece1e837-e00e-4c37-8afd-1218e45e4591", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779404100, "uuid": "926c6760-62f0-4972-b61a-486699d18158", "value": "Documents(1).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ba3b88-551f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372841, "uuid": "1eceb309-4753-4f1b-a290-0712571a04ce", "comment": "Malware payload", "value": "bef7926f9576b3d55c1218f574720925", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372841, "uuid": "0c6ff23f-26ac-48ee-abd5-782ec7d6b326", "comment": "Malware payload", "value": "420bd100f588443dae4005c49f2fd0abbbea8ae8375046ba1bcbfd273c92541e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372841, "uuid": "70c32463-0e89-4e1a-adca-6795c0ed547f", "comment": "Malware payload", "value": "c8162bcc7bd99bc7de96128ea6ec112e567128e6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372841, "uuid": "a7794e5a-ec6b-4014-82a9-ec5419beab59", "comment": "Malware payload", "value": "6716ec526ba052dc12ec7695ddc49ab25ae72489348b127f6849e65e2fc40f1f097ad4fb5b2fb73ac9bcece1de1f4bbc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372841, "uuid": "0272a578-dad2-4e87-8f5e-fba844d94cd7", "value": "T1C141B5F22236EBDE984933F0F08EB14C5D96B8BB6501C92E4B1B40B2C5C41ED64454BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372841, "uuid": "6965a1d6-7d36-45a1-a6d3-77698db8dad1", "value": "48:Vwuug+y8INQ0JCgdd+L6XUJMdP4aYY64aYYPW:Wub8INrLdd+L6XUJMdP5YY65YY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372841, "uuid": "7ae3c73f-e2b4-4bf9-9b75-7c24b9cc5b8c", "value": 2138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372841, "uuid": "61e92b39-d6d8-4138-94e2-68639d40f64c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372841, "uuid": "c16fa6e8-e78d-4919-84a1-80f78e0d9457", "value": "810537711104415741.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5857271b-552a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779377578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377578, "uuid": "fa50d771-c24f-431e-b426-708e79766576", "comment": "Malware payload (Mirai)", "value": "8e3dad4146a085040a056a8df43ef400", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377578, "uuid": "de367b96-d79f-4083-9743-d9387fe90134", "comment": "Malware payload (Mirai)", "value": "422918c803f9d9acc4d7a61c31be465408a278d466cd73597aa2332ed7c830ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377578, "uuid": "0efb40c3-679e-47f2-8287-206dca6125d6", "comment": "Malware payload (Mirai)", "value": "c78a03b28c496b01bb7242e9d0f6d2da50198c99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377578, "uuid": "62caa5f1-cecb-448b-8c94-bcb5d2b0cdaa", "comment": "Malware payload (Mirai)", "value": "4117e9c16c33cc1f6ad2e7cad133e51815aa838470f8628118c99e5c2835bb0e3ed860e46766bb448b54e978ef78cb0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377578, "uuid": "b0b0120c-67d3-48a1-af57-4d6e70a48a88", "value": "T1DBF30946F8819F15D5D112BAFE1D028E33271B78D2DE72129D24AF307B8A9BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377578, "uuid": "a1a5980c-4817-4caf-8140-b78c420f71f5", "value": "3072:xsuXTwe8rzfQt6Q8XQ9aWyASUnLT6AUqkRC:fwek7W8XQ9aWHSUIqkRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779377578, "uuid": "02cf0513-9fc0-4e0a-9582-859c9480da7e", "value": 159792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779377578, "uuid": "e9a1457c-1286-4bce-a244-3857b34df524", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377578, "uuid": "0dd5f190-3e8e-4e87-80aa-a1df3ea3acd2", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47aa2b57-5544-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779388717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779388717, "uuid": "673f0c95-1feb-43b4-95a9-c7b704fc97d0", "comment": "Malware payload", "value": "0e79aa6f58b57fcc519e1fbd6b058c00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779388717, "uuid": "ec92875c-be97-47ed-815c-d1a02f611987", "comment": "Malware payload", "value": "42573c9d1a0619bfbb0dd7a8bc9893b338861ba2523d8e26341e9fda68bdcdf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779388717, "uuid": "4c671f79-344e-4f6f-94d5-ef4f8bea6e0f", "comment": "Malware payload", "value": "bef74dd07038205975cee728ea4cef088e4b608e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779388717, "uuid": "6a53dc34-9264-4a3a-bbc8-8a33932148ae", "comment": "Malware payload", "value": "076159529d7749540817050e9ad11eb2e720af12a8a6681f31879b41b16756f53b9a5d13c3dea74e607706599fc537c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779388717, "uuid": "265cc5c9-dbf2-4067-a442-844c7ff05edf", "value": "T1E1761957B8924942C4E43A37B8BE81C432630EBA8BC7165B6D15FE383EBE5D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779388717, "uuid": "1b207a00-7325-4564-84bb-8a5a19cad0bf", "value": "49152:oagRD+x5fl0OVbZyGENsVhsPWMqaO7DBBJtTpiB+MuO5EB:o/Dol0OVbZyGENsRD7JtdiB++EB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779388717, "uuid": "1d5453f4-4d98-49c0-adaf-6f75481a3663", "value": 7274680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779388717, "uuid": "610ee835-40a9-43bd-891b-dac5254b682e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779388717, "uuid": "f8b59790-ca49-40bd-a586-b0639e0c67fd", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748bbd4c-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370753, "uuid": "97abdd87-687b-4dee-aaee-4ba875c61a4e", "comment": "Malware payload (StrelaStealer)", "value": "a19b646944c770204ae2409ab2c408b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370753, "uuid": "cc2802ce-7543-4f76-a398-7644df1cb951", "comment": "Malware payload (StrelaStealer)", "value": "42ac6a8a89aa9e68f832909cfef7bf55f2c5a9cf961516f6207254ab6d570640", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370753, "uuid": "52470b25-4edb-435a-90f4-1a417999b0ac", "comment": "Malware payload (StrelaStealer)", "value": "da9e7b8ea79d601f4fbc8a2bce33bdc29f52a942", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370753, "uuid": "3b562002-1d17-4ed5-baa9-9ffcbafa6b51", "comment": "Malware payload (StrelaStealer)", "value": "bab727cd3cb32940d991f456bfe7625be96583a4257946797148d684f63e1838895542ddf2c4f44ce168906b0bf67300", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370753, "uuid": "217a05cb-053b-4005-a2c7-933799d542bc", "value": "T1A52403E68AE3B8F1769BC90E1C343846E609D093057D77559CC51DE2FA127A8E7E023B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370753, "uuid": "750b2a76-05ba-44ce-b8a7-ee0bb812e25a", "value": "384:20Z/LNtynpbICOvgAwV+CuZawfi4ucwgsaI/VdVov6A3e:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370753, "uuid": "145560fc-7b50-4fed-bacf-1780cd33748e", "value": 216079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370753, "uuid": "ef8e3885-ef27-4b84-a631-06baab08c5ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370753, "uuid": "7fbb6425-470d-463b-8e1e-dc82e5465ede", "value": "2468120394653511905.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d5e311-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1779372848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372848, "uuid": "00020507-4220-494d-a7fa-634155863e74", "comment": "Malware payload (VIPKeylogger)", "value": "1958fc5b75d507c6ee629a1f71a5d119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372848, "uuid": "642fa5fc-870b-479b-aa24-9c8b97b9485d", "comment": "Malware payload (VIPKeylogger)", "value": "42c82e1d79c735958322ed175e661aee9854ce6436c07e9c6621f2687469b04f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372848, "uuid": "11aad196-712b-4eba-a8f0-b2b0e3049dcd", "comment": "Malware payload (VIPKeylogger)", "value": "4613f8a896624f483607c2e97794904ee7dd1e74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372848, "uuid": "77dd21ce-bb95-41dc-a779-29d292b09be2", "comment": "Malware payload (VIPKeylogger)", "value": "727b1cbb2fd67e0ab29fb94773ae1de44ceb61ab3a6fcba87ca494b5da27a406fb4c4907f7c2bbdff6d1893f4aa0ac93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372848, "uuid": "c51a517b-bb80-490e-829c-a51df899aeb6", "value": "T17555D022F5C58036C1A222F39D7AF7DD56396926C326D1B723FC2925CE71181EF29722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372848, "uuid": "dd70699b-15ee-41cf-9bc9-c75893787630", "value": "a46a46b6741b96758ff5cf06d0c4c13c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372848, "uuid": "6d5443c8-24ef-41d6-9a54-8e87e5727b6b", "value": "24576:pRmJkcoQricOIQxiZY1iaX7K+tOJB0Q+yOCpRxUS9nY/U50pHlRTliPq:mJZoQrbTFZY1iaX7xtq0Q9OSRxUS9opR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372848, "uuid": "99e9f981-d7c7-49f7-baf1-cd134c706e21", "value": 1366037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372848, "uuid": "34c8eb19-28b8-47e5-858e-a7076ef670da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372848, "uuid": "00035d07-c1c7-4ace-8609-6755b8fbb750", "value": "New_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9884e67d-551c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779371673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371673, "uuid": "f3ad0973-82e5-4833-af32-577a0c8ccce2", "comment": "Malware payload", "value": "655dbcc9058fe5c6f48fcaa250db85d8", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371673, "uuid": "2fce732e-2726-44ab-bc3c-71ed97b7f99b", "comment": "Malware payload", "value": "434bcd1d3436e8a41d4753e8339ba951323892287a8460da094e24af544e3c08", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371673, "uuid": "706835f5-c54a-4054-95f5-210f18e141ba", "comment": "Malware payload", "value": "ee450c54ad6f9a021811ff2a0b447f04a5ff4d96", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371673, "uuid": "8aae2803-1508-4470-ba04-8c739267a749", "comment": "Malware payload", "value": "acb7c892607ec613e0b7ff97e124853f3aa5ad6242ebe9da3f604623308ca9c3001f6eca40a6ad9ef9bc2d6d54056439", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371673, "uuid": "26846610-aec2-4abb-8807-1ce7ff95863d", "value": "T19FE19F2C3195E2A1DCF9512204FC586A3CEA27647BDCE71F290EF67481760BD5B24941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371673, "uuid": "a79adf7b-f3e3-441a-a967-19775a723f3f", "value": "192:F9KOTzT9xDQECTpl8rDCrpAGGsiFrp63IVs6BOeKGSZZwV09S:v1zT9xQJSr+qSkrp0+suOmSRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371673, "uuid": "dbec61a8-1898-4552-bbfb-f00475f61205", "value": 7212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371673, "uuid": "68abcaed-9a81-44a4-82bb-59fac0729ef5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371673, "uuid": "5d31fa8f-becc-4896-83fc-4d8d248c02aa", "value": "Scan000342.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cf31ac-551f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372854, "uuid": "ef4b546f-909d-458f-a71e-7921598f38a7", "comment": "Malware payload", "value": "ff2bb4ba66c9d225aed172458d2cf4be", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372854, "uuid": "a15f6a6e-331d-4a54-961d-faec63ddda96", "comment": "Malware payload", "value": "434c52140b345657e82d139c83fd924ae4a6d09673401bbb632847adafa8cbd8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372854, "uuid": "0723f039-153d-4925-a007-de71ce091f7f", "comment": "Malware payload", "value": "d77ea4bdcdd050604e3837e1309f1ab659606aed", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372854, "uuid": "8723813f-8da6-479a-b2f1-4c609f90621a", "comment": "Malware payload", "value": "96d035fbeb9f5126f4295cdc8eb6433bcd30165a16039f86405ab5a74b9f604cb1f6480bb414962b1a29c790c0ad887e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372854, "uuid": "1db1b00b-560f-40a7-8b20-d91a03880818", "value": "T19B623A85F281379F1ED74396A0017377F97DC022070E13A4D88EA21E714A96CE77EA6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372854, "uuid": "41f87245-a949-4a2a-9786-3cc0c0a05f20", "value": "384:Hs9QICoAFsDxpaH4lX6SflBbcCfb7/lQSZSs:H87COvaw6UiCfbys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372854, "uuid": "8f6eecf7-8fb4-4765-adcb-537726171787", "value": 14653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372854, "uuid": "c2d335d3-eaf5-49c8-bbf1-d0031ab930dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372854, "uuid": "d9cd8292-1806-4402-a3a6-6268a9029b22", "value": "11734169601251423567.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2d3c0e-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372858, "uuid": "7d9edf36-bc24-4355-b735-5e0f7ca88570", "comment": "Malware payload (StrelaStealer)", "value": "c2e3c4847cf12220d33f5ff5e310a9c2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372858, "uuid": "fc232899-f1eb-41db-afc5-d3607ac75abc", "comment": "Malware payload (StrelaStealer)", "value": "438fce55de8d3e949b054332b416c1c910340aeede947279ca3802382aa1d9e3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372858, "uuid": "5db16b96-2353-4031-936b-0187249802a7", "comment": "Malware payload (StrelaStealer)", "value": "c3f7616a13a3a3266954566df62483dcf9a455ba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372858, "uuid": "5d55f16d-cd53-4ca8-9c83-dd1ae2bb8911", "comment": "Malware payload (StrelaStealer)", "value": "e46da4a2007c2abf30a99ae1c75f371951a457c8f821c68b5cd9ecc8af0d73f0cf6ddfe940fc4f7851e69cdf41df0437", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372858, "uuid": "439e3452-5b03-4e0d-a548-67b0ab0e9cff", "value": "T14BC1B715B25EE70965A9EAB640F3DDE4868043D73C3AB997C244C36035248CA97F3DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372858, "uuid": "97e88759-7015-4682-976a-c01d4acb0ace", "value": "96:QR8B+4al/fTf/WPNXJ5N9RSKSX21H37sCOqqqrEAkciOqqqrE8q+:HqlHTHWPLb9RVJ377bEAkcibEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372858, "uuid": "2c0ca54f-6323-4ca9-adac-a28ef8a35661", "value": 6007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372858, "uuid": "0ecb4dc4-7e44-4588-936d-357038f1649c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372858, "uuid": "ceb3c775-d174-4a04-b797-cf7bda09be04", "value": "30713313742988730538.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d972487-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372862, "uuid": "92fc6e62-cbf9-40c4-a9a5-cdb5d8cd4aaf", "comment": "Malware payload (Formbook)", "value": "62e8b5cec6b748bbd0be757bd4fda660", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372862, "uuid": "496ab36e-15fe-46a0-b198-d439d622544f", "comment": "Malware payload (Formbook)", "value": "43a1dac3d7b5719c790f07cc02f4fbf5b4513f4498a2afbafa66d0450b311938", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372862, "uuid": "ad9abf60-d022-4b0b-9e46-82dc0f09ff45", "comment": "Malware payload (Formbook)", "value": "a60619f6a3aad39b7639033bf4323455b6a67378", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372862, "uuid": "4204fb2e-d427-4c5a-96bb-ac281c0405c2", "comment": "Malware payload (Formbook)", "value": "673c7c4e702450ba7d109a908b87b9697fb0f5d4ee46b9aeab39d73a045de81ada2663e4d0584bd3fffa64c82bc29ee7", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372862, "uuid": "b9b899bc-8218-4ad7-ace9-5e7a202969fa", "value": "T116B423C4E94E7B0BEFD9B61941A67B4BF90A90219B0DD4961C63783FF617057E00A633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372862, "uuid": "32d7af77-4709-49ab-80b3-67e29c2696ae", "value": "12288:Nwt9g7Zsqpmx/qbMs2FqO6v/fwdxZwG6uhRB1DEl8VdV8:8GZssK/qIzFqn/fuxZv6iB1DEWVdV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372862, "uuid": "56312708-828b-4605-a834-c7901edb4f98", "value": 510802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372862, "uuid": "515c3844-0e06-4374-8650-ac585408d740", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372862, "uuid": "4cd0c087-e085-4306-85d9-534180ec3c5b", "value": "EX777915904751.PDF.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff4c8a7-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372866, "uuid": "1c1b48c1-4cdb-416a-ba94-c5949002f76b", "comment": "Malware payload (AgentTesla)", "value": "fcb6fac02d209a28426ceae55204a1d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372866, "uuid": "0093f737-aa34-489b-86d3-80e9c468a2f2", "comment": "Malware payload (AgentTesla)", "value": "43a2c6073372bf816f692f04f7e62af6cce6434f0e9b2d57143a42453c9a4169", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372866, "uuid": "3be82a9f-5179-49f8-b3ea-67260a3297f0", "comment": "Malware payload (AgentTesla)", "value": "03bcbdf455aba14eb855678549f187c8836fa4d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372866, "uuid": "5aed85e6-09f6-4f75-aa36-42989b8e8562", "comment": "Malware payload (AgentTesla)", "value": "44aee906ce32ab2103e40ed1a92f97e6967afafb0c253f113d90da1c274b27ffefd4fc5af106fa123c8b0d4b5f71b1b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372866, "uuid": "16998fed-bf20-44db-a137-939ac333822a", "value": "T1CC2533ABF1A29DFCD83A28F5E03BB7C6D13DCD4873495684045A26E5E0287F170229F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372866, "uuid": "011ea182-4661-4cfa-beab-a34a51d947c6", "value": "24576:Bv0Nm7UX6sso7yyFdOWogNtarHYfDnEqECChmxdMjmJoTL7F0RUoti:Bvam7UY+ymnUCDE0Chmxujmo90/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372866, "uuid": "1288e99c-c8c9-4cba-b903-3e633ba7d0f5", "value": 991138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372866, "uuid": "54ed6a81-2b44-4afe-8fe1-b2f0786ab5b3", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372866, "uuid": "25f296a3-f6a3-4ff6-a4de-a1478a99c52d", "value": "RevisedXPI_2024.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d785f4f0-54f1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779353310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353310, "uuid": "4cba0146-0638-426f-8ebd-41d06949fd8f", "comment": "Malware payload", "value": "fb0a4751812ea734d04b039166011807", "object_relation": "md5", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353310, "uuid": "18185fdb-5d34-48fc-8601-ec970aaf8a1c", "comment": "Malware payload", "value": "43e1eeecfb27cce96006641d0f25b0134b013999002295fb756cbed84a1210d6", "object_relation": "sha256", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353310, "uuid": "f6991965-d8eb-4d3f-92fd-fd741c6f87a0", "comment": "Malware payload", "value": "776c31a351f1140d3feb1a87eb7383188f7478e0", "object_relation": "sha1", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353310, "uuid": "a622dc82-1b22-4c60-9662-239a7d72ce36", "comment": "Malware payload", "value": "6bae2cb382494423ca092aace5c7d1fbc8a5c531869a57f0cce7bf5aab97a2820d54831833083c6431b7a5f7ebeb6b27", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353310, "uuid": "dd99b52e-b882-42f9-a7a1-99ec9530b245", "value": "T197214701FC5AC0B1CD77EB1278AE510D7EA25108A875B012799CDC7C9B54BFDD644046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353310, "uuid": "f297b4f2-7e41-4480-a8d6-2ffb29c33ce7", "value": "24:vpLMLW73rL0kJ8r28IOkZiUaXNf29AJ/Anh2SZzFVeh/WSHv9WKBKpXj012:vFMi7b98rIOk47sARg2EzO4SHMKIpg12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779353310, "uuid": "b14eafb9-24cb-41a7-8de3-d96836095554", "value": 1204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779353310, "uuid": "6e23ee5a-baa5-4cd6-8376-c3b877275657", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353310, "uuid": "31d32826-ffcd-413f-9937-43d412a642c5", "value": "43e1eeecfb27cce96006641d0f25b0134b013999002295fb756cbed84a1210d6.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f1e52d-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372873, "uuid": "c4a4cc58-d33d-425f-914b-dd64a9e6e4c6", "comment": "Malware payload (Formbook)", "value": "dfd2def4a46540b5c10ee501984e0fcc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372873, "uuid": "a3564632-90a5-46f3-94ea-e3d412e7a6fa", "comment": "Malware payload (Formbook)", "value": "43f3692b11d881f48b5832f783d5d206cbde6fa9245ee5c1edc555e899bd489d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372873, "uuid": "98413770-ee33-445a-97bd-be53e9764c74", "comment": "Malware payload (Formbook)", "value": "289b4dfaaa45b4716d18406b96f285c9e03b34b0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372873, "uuid": "0d4f7359-01a6-47bd-a27f-21f857d11651", "comment": "Malware payload (Formbook)", "value": "450684b620773ce7b642c58b127cb5622eda3ed50eb5f36f305312adc3da8a0161ad576e08c7d92759815ff1088b07fc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372873, "uuid": "99b19a24-1697-4c25-8d56-08558a1be8d8", "value": "T14AD42375533B272D73EA5002CC62F660C62A7B9FEE5FD0AC8081B06D64728CBBB1061D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372873, "uuid": "c206a0e1-df51-4bc8-b6af-790a52cd88a9", "value": "12288:V6fhfryRLhj4BWY/QBsZAl6iH5wNOfXNnt2mw/uHvx9z4yog9MgrMnmy4Oz:V6fhzyLOoq+AiH5wNsNnYmw/+vx95PSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372873, "uuid": "8179f1c1-a9ba-43a8-98ec-b742fe9de10c", "value": 648925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372873, "uuid": "d5287326-836f-426a-98d3-b59b65dc1124", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372873, "uuid": "3648f986-b74c-4194-b389-2565b9a58eef", "value": "Shipping_docs_(2).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664db02e-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372877, "uuid": "979bdce5-75f4-4bb8-a268-fb2e69c81c0b", "comment": "Malware payload (Formbook)", "value": "79e58ffd8ecf7f7a96acf21f848431a5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372877, "uuid": "75e55b6e-1301-4796-bbed-8bfa2d85475b", "comment": "Malware payload (Formbook)", "value": "444214fd9351f47c4097f58d94e13f6927200477ad0afad25655ee7304710f0c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372877, "uuid": "23799356-46e1-4c04-82a4-8ae81c4fb33f", "comment": "Malware payload (Formbook)", "value": "8fd6743092fd9963ac43ac616649a37645ce8726", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372877, "uuid": "e0464992-c2c6-4ade-b3e6-61be73a91bab", "comment": "Malware payload (Formbook)", "value": "3f1ef93262fc744ce826069ad5937bda05c2c8f7bb8eddfbc0b3b29ea5e5c7f79c835d4281ce80866ab747b62de393df", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372877, "uuid": "1fa01037-f1d9-453d-b155-54c163079f70", "value": "T1BB253397BB8FA0489695548FE3F9B09B82CCE14637E71C7AA20E171ED1D9F025CD3186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372877, "uuid": "4dedc1ab-7042-449c-a730-ee30fb05621e", "value": "24576:171RXNpfwio6uE9IfH61WOXauY0/9rtXj9KqJAJE1N:17T9WPE9I/61zXauYSrtoqSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372877, "uuid": "49fb9ea2-d79e-430c-a35c-6e970ceced61", "value": 1045270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372877, "uuid": "ffb998dc-97c8-4903-813d-490f8246ef63", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372877, "uuid": "f43162b3-9225-4467-a858-3b45036be791", "value": "109282983728.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688cbf34-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372881, "uuid": "bb17d367-67fa-4bcc-b74c-b081a31614d6", "comment": "Malware payload (SnakeKeylogger)", "value": "e532407150c36a4224593543c220336b", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372881, "uuid": "feaa6c9f-58b7-4031-a658-f1f5decd180e", "comment": "Malware payload (SnakeKeylogger)", "value": "44581b154d23c3e98a321f42877a781d053726ae6783e2199d4697609d9040d1", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372881, "uuid": "0fb5c87d-481e-4743-ad65-29d0cdfd19b5", "comment": "Malware payload (SnakeKeylogger)", "value": "64dbc721e7126de8aa17123e3744be31f991401b", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372881, "uuid": "5d543f41-bb82-4578-b71f-ebaaa08d5a25", "comment": "Malware payload (SnakeKeylogger)", "value": "12cbd4cfde701c9b451e0c13401410f3ca47aad6f3334fae8fa10c493b722016052a501d910354af05253a8768faf2eb", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372881, "uuid": "6f8745bf-c82f-43f0-b959-de557026f495", "value": "T197E423A929B960F5AC6D864FBFEC1D1C526A833C40D97CF4BD1792BB182C28397415EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372881, "uuid": "753b6414-eb38-4c1f-aec9-5beba9445cef", "value": "12288:+t7YGZR3uW7WYExYC7+WixEZzRg1aEBPiKEqaglX4+sbSj:+t7Y8R39qYXC6ruzRsaWPiPq39dsb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372881, "uuid": "29e093f5-b922-48e8-9587-6d1329f39186", "value": 657214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372881, "uuid": "11febcff-c1bd-474e-b0d0-010557cff63f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372881, "uuid": "f6f9b461-7c0c-43f4-b3f7-0311d8762d56", "value": "Payment_Reference_SOA_Pending_Balance_Updated.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a01e9a6-5514-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779368239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368239, "uuid": "7a86936b-002e-41c8-9ca7-b530eea52a0d", "comment": "Malware payload (AgentTesla)", "value": "14aff0bca8769663faddcf8967af9138", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368239, "uuid": "5d73e57b-995a-4c9c-848c-4d323847eae3", "comment": "Malware payload (AgentTesla)", "value": "448d1ef0738ff541e142eb01dc6adf6c9697d481882f091ba523c842bdcf5361", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368239, "uuid": "77d37e68-2ed7-420b-b9d4-71a8a38f4bd9", "comment": "Malware payload (AgentTesla)", "value": "1aebe7dab3f0adc64e1e6dbd247ea9752a3fdbc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368239, "uuid": "8983d42f-62b8-4dd6-b499-c3265b86253b", "comment": "Malware payload (AgentTesla)", "value": "2cdb6e431a40406cc7299a682d619c7672f9ebec5082aab3728b1a3fd0ac9f7d7c76c0af2d097e2789d661c9934bcb4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368239, "uuid": "e530888c-86aa-4ebe-b33b-da8cf027d94b", "value": "T1BEF4D17203404366D2C867D4415BA91E51B6FA6634A82B85FFF22ABFEC15FD36C34263", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368239, "uuid": "59bbbdc7-64f0-4a50-993f-9c4509ba3e58", "value": "3072:ikaojD4+VdA3lnbhW6skFeBwHCFczd3N7/7AXMNg0VT:ie14lbZRGmdd7TyMNfVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779368239, "uuid": "1023f3b9-baa2-4706-a831-245daf9ee1a0", "value": 788961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779368239, "uuid": "f5fbcf4c-b885-4c0c-b0ba-78f388c0b9c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368239, "uuid": "c10d1f28-cc68-4e49-8c18-d450ba92a491", "value": "448d1ef0738ff541e142eb01dc6adf6c9697d481882f091ba523c842bdcf5361.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783a83c0-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370759, "uuid": "2a0d6440-c627-4a6d-8dd7-4a7b1f51c11f", "comment": "Malware payload (Formbook)", "value": "0534ebd934694b61f75e64ebb943727b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370759, "uuid": "0e1c9b1b-dc73-42e6-8fdb-87c14c0bf7c3", "comment": "Malware payload (Formbook)", "value": "4494d15f088cc010a46a8652f8ac650405b032fe9b630bc62c8d653ab53fa17f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370759, "uuid": "982dd53d-b789-43fc-8991-5c3d1d25116a", "comment": "Malware payload (Formbook)", "value": "5eb646d10dda22aa2bfc40f3b9319888e3b492fb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370759, "uuid": "ad30486e-778b-4e74-8eb8-9c880c276775", "comment": "Malware payload (Formbook)", "value": "4466376439288ec3f1918e916bcfd792b4d13ad8cee3d6846f18255aa9c9d3096a0abeade6e84a8c843bbea89c912547", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370759, "uuid": "2fa17697-06da-4ac0-8231-564124a41dbf", "value": "T129F423DBC2FF1FD520FB1E5DED7B0686ED172705F4B4E217E4823A429A70A39216811A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370759, "uuid": "83bd132c-72fc-4e7a-94f2-1d725edcefa0", "value": "12288:Efysbiv07mFTD0GG06l9ODSZv19pvQ2QCvHLzyuxraYN0ZTqhA:EfNYUmJD0GqmmDX5VrWuFaY0Tf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370759, "uuid": "ff95c95e-98b9-462b-bf1e-e2a007167e0f", "value": 747271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370759, "uuid": "c059499b-0f92-4f25-8788-d1ab9a20a816", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370759, "uuid": "9d00a5fd-9f6e-4800-8cfd-f851a528036e", "value": "Purchase_Order_of_Eltra_Machine_Consumables_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ace59d4-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779372884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372884, "uuid": "1aec498d-0aea-46e1-947d-524eae5cc132", "comment": "Malware payload (GuLoader)", "value": "db984c5635f3f73025e30790b6d34680", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372884, "uuid": "b8c43891-4ab0-418d-aac5-44bd243073bd", "comment": "Malware payload (GuLoader)", "value": "454a1d48f0d9d5527564df1b97d8d99d471fcf0d9194d408e6e5100373ddcfc5", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372884, "uuid": "d031f851-534b-46bc-88d7-2d741c0e4165", "comment": "Malware payload (GuLoader)", "value": "1e7d8e2fa38ac4da79f1ec19ef8aef30843edb05", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372884, "uuid": "2ead082d-73bc-4e3e-89b1-37c25e1298d0", "comment": "Malware payload (GuLoader)", "value": "4e04d2efb01bf4e9f0052b034ca70d988566e20901120e8a84fdfa6c31ea1917b936a4c62b7f41d60ab04ea9c3031bba", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372884, "uuid": "c78b7175-5bbe-4c1b-a3bc-bb2474968f58", "value": "T1AD8423216065C0FA39AEA8E5DB4FF1F70A8CF5ED3800F15C35A439B65C365663092EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372884, "uuid": "cdd519c9-6d98-4421-887b-f511fbe84405", "value": "6144:nHF+Hwco8Ya0zB0e376ZAZHsStuhw2S2XRilDL9BjkKXIxXWMVEKEW:nH+wcJ0zmQ76ZAVZCIgRSL9BjuxnhEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372884, "uuid": "eb1e86f3-b5a8-48d2-b297-1fff5391e3be", "value": 382725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372884, "uuid": "488002ec-0ac0-4042-aeb3-e237caf5424e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372884, "uuid": "e353e3bd-df23-4e5b-b700-75420fe0811e", "value": "IMG46375758375835Slangebiddenes213.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609becb1-550c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779364707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364707, "uuid": "2e928ef6-2997-42af-9617-b2cc622d7bf9", "comment": "Malware payload (Formbook)", "value": "e34e6c1a8fff68ecb84ea040c9011700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364707, "uuid": "669fcc61-feb1-4b7e-8982-84959c32a849", "comment": "Malware payload (Formbook)", "value": "45f3d30c8fa7eb6b0d1193d8e92011e3f9fee2473e29f33386d00acb1b71b1e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364707, "uuid": "2943e527-6e49-4f69-a88d-134b3580c60e", "comment": "Malware payload (Formbook)", "value": "65945b91c477878fc6161f51c5fe9e249e827619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364707, "uuid": "d1cfd221-6272-4df1-b850-2e0e2df43323", "comment": "Malware payload (Formbook)", "value": "54e6935dc7f4c29361ee6269f6cfd30f2c4cc8107caf079ab4e2b8dde9708c205a7b70d16bb91d21f255060a0d45b61f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364707, "uuid": "9114a992-e086-4b50-b6dc-3319c91e3e9b", "value": "T16135CF0323E85A58F9BA9B3955B417344BF6F906EB31DB2E7E4A41AE1932F40C941733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364707, "uuid": "01cec758-a843-4c8f-ad6a-dfd44b7343b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364707, "uuid": "f9003d59-e9e6-4c07-b0e9-a1f6e4f67b6d", "value": "24576:x9EhFMxO+Nm5olKEKU7oyfJuz0Vy+3Rzky:xqhFMXNSooTCoycAy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779364707, "uuid": "3de7034e-886b-4f15-b942-5abbafbd498d", "value": 1145344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779364707, "uuid": "76f1039e-a70c-4473-9842-e89499e7f728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364707, "uuid": "6c12c84b-45b6-4a61-a8c0-fa7f012b34a0", "value": "NEW QUOTE.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cffd877-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372888, "uuid": "cbef9a06-0dc6-4c46-a58b-dbec4f80b892", "comment": "Malware payload (AgentTesla)", "value": "8610a421f8a3661de85dc1d86bfca588", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372888, "uuid": "b6193174-ae2b-47f0-8c90-0b915b641e2a", "comment": "Malware payload (AgentTesla)", "value": "45f9405b13f47f0990180f96f7ac1a91c39c30ac58230a20b91debe6eed812e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372888, "uuid": "7b252d25-0184-4020-aa23-310221b0d264", "comment": "Malware payload (AgentTesla)", "value": "3082199d08942cd57349adc6dd04aa9a5c4e809b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372888, "uuid": "779dbe74-d773-4228-a59a-2dbd4c522f42", "comment": "Malware payload (AgentTesla)", "value": "9e80142a013dc5ca990148fe5384da73ee86830c00ab0a1ba2e6e2d3f0f08c3bb0d31d3a9a0efd0c7b1618f9b02b853f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372888, "uuid": "5c4ad18e-f03f-40eb-b607-a2478cbeb70f", "value": "T1043423C81A99300A9007CE65F63D58F09BE5CA716B43C19B390F3CFBF86557C9264AE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372888, "uuid": "26dee28f-98d1-4fbb-9495-293c838b5543", "value": "6144:wVBkfLnrdPuSpDaqRU4HdlqCYlzJJ24JdL:eBkjrBt/RTHdlWzL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372888, "uuid": "b46f1ad3-f4de-4233-a063-540cea76b75b", "value": 249338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372888, "uuid": "80349bd2-b700-4b70-923f-ab96e769865a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372888, "uuid": "a23f15d3-ec19-4478-b7d7-60d529980106", "value": "New_Sale_Contract_Ref0948949.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7f400e-54e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779347441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347441, "uuid": "55cfff37-a54a-4497-b6f1-5a891dc6e292", "comment": "Malware payload", "value": "7a74fccbec6945f3b52b751e20f6a1e4", "object_relation": "md5", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347441, "uuid": "8994e452-a2ee-40f7-85b3-f9343d33eec2", "comment": "Malware payload", "value": "462f0e3bbf92d47f676df6e0f7791d981fcad6e0b4eb3985148f47a169f200ce", "object_relation": "sha256", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347441, "uuid": "6e0aae88-1a07-46fe-bb1f-4c15e000687f", "comment": "Malware payload", "value": "3a478f8bed82628b92269c5e3314e6e492c38efe", "object_relation": "sha1", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347441, "uuid": "b3747b71-1772-4065-ba22-e3e8dd7a8aa6", "comment": "Malware payload", "value": "7d01a8c7b887b5242c551eb5ced5c69bc29349ced7ad247ad26be5bf8c94edfa1856d5eaccc13d9f11e0bad6e36983db", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347441, "uuid": "6405c7e5-c8cf-4d13-9979-65aad4ff26a6", "value": "T12C112183A31902F9C0F22323D0CB4346DB58B47D42576E1004724649FCB2EDE87DA3C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347441, "uuid": "9dde7577-50d8-4e6f-bcbc-4cbf29a9dced", "value": "24:R6FrMFr5W7JQ4UrsOJ9GYE0r38e7CUyPnqT0LCyA:w1M1E7JlZOJ9GYE5e2UeqT0Gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779347441, "uuid": "e6492d94-5242-44c9-853a-c68f63c16bc8", "value": 937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779347441, "uuid": "a5a403fc-3e0f-4d2a-8068-2818cd9bab85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347441, "uuid": "cd1f5998-9cb1-4fed-9ff0-f0fe357542ed", "value": "462f0e3bbf92d47f676df6e0f7791d981fcad6e0b4eb3985148f47a169f200ce.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22435e0-555f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779400465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400465, "uuid": "7c1435b7-7b67-4223-ba6f-0b52c12f3d08", "comment": "Malware payload", "value": "def4e179ceb62411ddccd00043b26bb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400465, "uuid": "b69b2ac3-fcd8-4e2c-a38c-0dfbebf1a5c3", "comment": "Malware payload", "value": "464d0fa30cf02848cd5b87c249264df532f11c116af32358c1d7fa35d0579476", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400465, "uuid": "12150186-68ff-4e21-bfb2-1822fce441a7", "comment": "Malware payload", "value": "577ed095137e5083a705347cae0c88bbafd1a6b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400465, "uuid": "878c61e8-3d0a-4af0-b78d-68003c157d6e", "comment": "Malware payload", "value": "6efaeb58c868d2d8aa03f26d09c381847fcb8014fd902db54a89fef24d6e159decf6ccf9142d7985d4cb936153f0ab17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400465, "uuid": "86385e1b-7594-4c01-8c5e-d8eae2b6eb67", "value": "T1AB25E117B788C96FD5A320715BF68234D7F5998086FB852AC6645B210EEF22ECC17BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400465, "uuid": "15513e95-0f66-404c-a037-4cd0f1f3d030", "value": "24576:EuYI7EAR/C44bXMINiLbLsLet/FmTG6UvNe3J:5X79R/6XabLb6UvkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779400465, "uuid": "57e4a1e0-f755-4faa-8118-9bbba7d5a6bb", "value": 996258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779400465, "uuid": "168e8cb2-ca5b-490b-89b9-13dcaeaedeb1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400465, "uuid": "8beb4149-3342-48d1-9245-8ea85e9630cd", "value": "einqgiy.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a31c68f-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779370763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370763, "uuid": "b6a7b3cb-9bca-41b4-9988-0af3f9601482", "comment": "Malware payload (MassLogger)", "value": "3a5a08209312d7c27b2e13f4ee8ac3b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370763, "uuid": "9be33dfc-7bb9-49f7-ba2e-10c82dc5237a", "comment": "Malware payload (MassLogger)", "value": "46b4563ff4f520413f9bb29876c39398a749c03efcabd02b5469803b8ca2892c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370763, "uuid": "1aa5ee83-8093-407a-97b2-546c3ab5d2be", "comment": "Malware payload (MassLogger)", "value": "368faebea6572bf79897158b482dcbff9295ee76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370763, "uuid": "0576a981-4c07-4757-80a6-22e355e1cfd2", "comment": "Malware payload (MassLogger)", "value": "29a55024ecf7b87ad1bc80e0352e4b5360310145e2efa85310355ed1aa39fdcfda6e44a4b92c66f399e35c91221503bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370763, "uuid": "f819d4b3-6285-4851-ae5f-8526ad724c71", "value": "T12D25BE2373DE83A1C7B25273BA557701BEBF782506B5F86B2FD4093CA920121525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370763, "uuid": "8f0c3651-388c-4a8f-b364-14c5bdcbe43c", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370763, "uuid": "6f392759-80f2-4d0a-895c-c209fd02de5d", "value": "12288:/tb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSga4/Nf/amHXfn6A:/tb20pkaCqT5TBWgNQ7a4/BdHXfn6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370763, "uuid": "3bcc56b4-94d4-4e81-95f4-77c8dc38cb24", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370763, "uuid": "1f469ec0-65cc-44a4-a9a9-3c15d470fd4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370763, "uuid": "533282a3-697a-48cf-864c-d78904b22037", "value": "N_\u00a0o_\u00a0v_\u00a0e_\u00a0m_\u00a0b_\u00a0e_\u00a0r\u00a0_2_\u00a00_\u00a02_\u00a04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725fffae-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372897, "uuid": "2b08c81f-f98c-4211-86fb-1913a2d0fbce", "comment": "Malware payload (AgentTesla)", "value": "90bcd6fd70164646e7c97b391dbd1b3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372897, "uuid": "149976fc-4228-47fb-951b-8ed34133cead", "comment": "Malware payload (AgentTesla)", "value": "46c14f54405d6c75a0ba41465e754314f586546d12135ef3d584b79fa75dc698", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372897, "uuid": "8f0791c0-5e62-4343-b888-70c475b2ba06", "comment": "Malware payload (AgentTesla)", "value": "a423ffdb66d51740911a95e0e8a7c6865868e47c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372897, "uuid": "6aa79d9d-7c05-4455-a368-e3c1807853a3", "comment": "Malware payload (AgentTesla)", "value": "e4d0008a7c815ed95aad3d0c439183d39247cfb72fc48a45999b6714130bd8b32d13606af88c8374e48f2a1753f75f7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372897, "uuid": "8326d8ed-d1f3-4ad8-b20e-9b3808bb8953", "value": "T17ED42335EBA59360CD7C9FF200166D6E5BBD12BB1414E95E2FC3B0C5CA67B0C4892A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372897, "uuid": "6601265a-08b1-4df8-8b41-3fe001423ddd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372897, "uuid": "f44ec60c-1f98-4485-bf16-7a0859f8abad", "value": "12288:3iuaKWgPgvpBMBRCSHFwaeAFVTF+lovIiAZAcXDrXiZP8d:CngoB6KWFwZg7mMIiSAcXDrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372897, "uuid": "b180d3f7-ddd3-4e02-b8c0-41a159330a8f", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372897, "uuid": "a462fdf1-7971-40a0-809f-4cb030f2e851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372897, "uuid": "1e06c255-62a0-428a-905c-e5101479452a", "value": "PO45120992.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745eaa84-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372900, "uuid": "9726f45c-a263-426e-8050-5fa85e3e6e4f", "comment": "Malware payload (Formbook)", "value": "96835d7696ddc0de6e7dc8cbb8376f16", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372900, "uuid": "5683d1b0-ce89-4d3d-8f7d-398a109b705e", "comment": "Malware payload (Formbook)", "value": "471f90253f1450ed29d38c346860cb624ea7406f0fc8e3f54c00ac5ae4664cd4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372900, "uuid": "cb75bf04-0cd3-4e62-b071-10f6dbfcf817", "comment": "Malware payload (Formbook)", "value": "d0d0cf178836f91198714bb7e0cd15b372b46b4b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372900, "uuid": "77af228e-d08c-4c06-8ad8-89483db6b048", "comment": "Malware payload (Formbook)", "value": "ba30c60b113adbb54dc382bbe8af9bfa7601128eeab88d896f24fb2a681ceb780c0f001c41dffd0b328d905c2c154db6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372900, "uuid": "80dfdbc2-b56d-48b8-9f93-3ab6a286e9c3", "value": "T137D29276991F2915C9CB6793740DC86364D60D6A7820E42478ACE3D86BB264CFCB4CEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372900, "uuid": "d91c70c6-cf5e-4e89-b69d-c0ff16f51d6b", "value": "384:FzMKK76JtZ09tiDH1qrToP7BZqhBqvrlWIAGiHvRlxFuDKs:FzMKHJtZWiZZ7BcwleGivJF8Ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372900, "uuid": "b2ca179f-808c-4e01-b172-511e9514c35c", "value": 30800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372900, "uuid": "71cbbcba-66f2-4c99-94f3-6b21e481bac3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372900, "uuid": "e73a8889-9fd6-4ca9-95e4-3f5e8502ef07", "value": "PIRF_19_-_24__RFQ_064-C-000418.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76889372-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372904, "uuid": "67f540a4-a617-42cb-a45f-84749cfc2a99", "comment": "Malware payload (StrelaStealer)", "value": "5cb65df48deef4fe43c15a2243df325d", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372904, "uuid": "20d45169-1d4e-4a57-8f4c-a277b19fa8da", "comment": "Malware payload (StrelaStealer)", "value": "472017998cd00f3cac074d92010d9affa227450d3400f5e99e7b3792f17a6c94", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372904, "uuid": "31bacb98-7cc2-4ab3-aa35-1e4a03e290ae", "comment": "Malware payload (StrelaStealer)", "value": "7ada11821b79a60d6bc4fd6f2ea1a496fe63f1ae", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372904, "uuid": "8459a0d9-21b3-4e58-977e-066c62e510c7", "comment": "Malware payload (StrelaStealer)", "value": "8933951990c05a1d68fae0d3584d617394125812b82e4cd5476236f5070ceb4c6d01246affba89c524da3db7222a318e", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372904, "uuid": "12d5c00d-43e4-457d-a27c-b737bc28557d", "value": "T10231DAD8FD26D02BFB7DA9F0261F7AD8124E28C484630103E5E683396E711031A585CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372904, "uuid": "977eeaca-2e65-40e4-9cec-85464808d273", "value": "48:9roLH/pp2FkS+awCYGS0BeiR9C1U/KI6FjNjA:c/Psk3CYytR9SUd6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372904, "uuid": "5ba1906a-e684-4429-be41-59ca926d9389", "value": 1564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372904, "uuid": "c9cf0cfd-0a09-4fc5-b44d-0eba1d025381", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372904, "uuid": "210675ec-ede8-424c-8b36-f05aab7820f9", "value": "RC000073893-SB0002915-240701-1_eBill.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c348e52-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1779370766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370766, "uuid": "f5a22d91-2de7-4702-998a-c7eeb4f2e85f", "comment": "Malware payload (RedLineStealer)", "value": "71da510bab006ad649bdbd7e8d4d6b4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370766, "uuid": "09e009d6-5718-4846-a529-c12a0e75df2d", "comment": "Malware payload (RedLineStealer)", "value": "476cc1fe35e33d4d85763d170a06b654fa4c8994bc64b9ccaebe98c51abacbae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370766, "uuid": "33e254d0-2294-478e-b44e-113957d09a20", "comment": "Malware payload (RedLineStealer)", "value": "eea1c10a47c0cb8fc2c48e10b912d15a2fc1fa9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370766, "uuid": "08d2cac5-2f1b-4131-97f7-6f5b9778975a", "comment": "Malware payload (RedLineStealer)", "value": "b035cf83e389605e0d40def285b46bd6ef3273f9e5a8d725ba88b5c5c297a0fbde62918816da2fc7cdf87a77ba72cd51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370766, "uuid": "43f2ebab-465b-4a95-8abe-7b9742cae9d4", "value": "T16C25235BC41CE198D87236B198A8D7BE92239F31D4604FB116F4BE833573E9C81CA59E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370766, "uuid": "1dff0f0b-b356-4265-936f-c9a0782fb2c8", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370766, "uuid": "5aae1982-b2be-4067-bd8f-a4ff222903c6", "value": "24576:OiUmSB/o5d1ubcv/FC9hRNezCQDgqK86Jjm2mq+Dzd:O/mU/ohubcvtCXyCQDgbMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370766, "uuid": "093bfc18-6a5b-4975-afaa-21f6c03fefbf", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370766, "uuid": "3e371848-f0da-4922-8d99-dc5357b196bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370766, "uuid": "fdffb1af-bcb3-4232-a084-33f4c227bc50", "value": "DRAFT_BL_&_MBL_PO_NO_ECM1D2403-29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4737c8-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370770, "uuid": "54fdd30b-ba01-410f-ac13-efb04cae3e8d", "comment": "Malware payload (StrelaStealer)", "value": "126926ca875b9c4f611c65af582b0cd5", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370770, "uuid": "30a930d1-5384-446c-9232-5008f578cc36", "comment": "Malware payload (StrelaStealer)", "value": "47891c0c16547b1ce5c3fdf7d2485f1aef0b508cb4401776c742f19478100625", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370770, "uuid": "fa96a15b-9c17-4028-ac4d-532048d8de69", "comment": "Malware payload (StrelaStealer)", "value": "ae18264754d976f631ecfebe535bf2f495b2eb86", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370770, "uuid": "7c13d24f-037f-46df-b935-60374f6a6f59", "comment": "Malware payload (StrelaStealer)", "value": "4dc45bf0ca3ee232e1dc1d776d4d885fe0dd9cbed0b7388f06d734c84cc6e21ccd2c594b6f4b9cd813dfcad5754b6dd6", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370770, "uuid": "4a70059f-e794-4c36-9800-daf7753c6799", "value": "T1B86423B0528E5E28A5998CF6CF71C53DCC10FCF66C97804EA033AEBE5458622AD63765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370770, "uuid": "6fd1ac58-11d4-4101-af43-0eb345b3d7f3", "value": "6144:bOC1fMTjwoq3dy3viGhHBfKi8Y4ODbD/EgBsIyyWhf:b5iYbcrBm6b5Ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370770, "uuid": "7de38e07-88f1-47bf-a611-922a8aafc867", "value": 309176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370770, "uuid": "4eda406e-40b0-484a-a65e-26d6e7bd2888", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370770, "uuid": "67c93bd7-8a9c-4e7e-b0fa-0c74220850c7", "value": "10397_Homer_Rechnung_202409091109152685.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa60d7f-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372911, "uuid": "90fc8e7b-7819-4de0-ab9c-cf1492ca103a", "comment": "Malware payload (Formbook)", "value": "056656980fe3359209c38762599b989b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372911, "uuid": "5edc7f7c-c64c-4326-a102-b8f9d40f2c93", "comment": "Malware payload (Formbook)", "value": "47b83081f2da796f67fe059603d92a4bb58a7447e47b480ec1bfa43deebcf044", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372911, "uuid": "a7ee5323-dd29-49a7-8c2b-f0fc706a5639", "comment": "Malware payload (Formbook)", "value": "8a3a3504d8ce25ba5c9aafee10035714aa9ce2dc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372911, "uuid": "b882f9cc-bc45-42fa-95c6-e7934cfdedc5", "comment": "Malware payload (Formbook)", "value": "e28c6145bf48a6bd35b82fe2e5272a3d7bcbca03143d36d1a7b9017302b93d1a12568b92a522dcbf845d851765651af6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372911, "uuid": "a21d3625-1f3b-4d5c-a823-4b33eb96f3e2", "value": "T10C4523F842AEBD0AE6431F668E8B32F5F1DD090A61F3509A81E8D520798C1F569F5E34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372911, "uuid": "082c8a1d-1ace-458c-a3f6-bb3b63365201", "value": "24576:fex4dbhIkWMwTsX3xlrPZwHzvx0OFQB/7T1LHb0Fs4:Sn7m3f7UFiXlHsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372911, "uuid": "7fd0d6c8-d20a-4674-a574-e6663b5875a0", "value": 1267417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372911, "uuid": "c61021ed-4af4-4dbb-8e9d-8ba8dca4dd54", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372911, "uuid": "66c6373f-26f3-43ef-9681-8d2394ab9234", "value": "ITHitech_Park_Project,_Bangladesh.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf2410e-5514-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779368217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368217, "uuid": "454921a3-2bb0-4014-9b26-30846446cf4c", "comment": "Malware payload (AgentTesla)", "value": "a8094b9f686c2233e1eeb7819046724d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368217, "uuid": "8103e961-c6c6-42d2-873d-6c310ede056b", "comment": "Malware payload (AgentTesla)", "value": "47c96c9117bfcdbdb223f63f643e74fc0c3e4023fd30060491a4dd186ec24b5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368217, "uuid": "9981fb35-6403-4dbc-8c38-2e79ac8ffc1b", "comment": "Malware payload (AgentTesla)", "value": "ad7445e4890a9499312c8117d509208275f436e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368217, "uuid": "ce72f903-6c5d-4676-950d-278128d7b737", "comment": "Malware payload (AgentTesla)", "value": "2dde46658c15918c68d83d62d4f666a78ccd9a4358e223a208be3cc7b63f646dc81911fea838282a549de03be1123e40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368217, "uuid": "48a026d2-2f74-4a28-8f7e-2a52a48d9db0", "value": "T1C4852376AF6A6F3907B86779102D8E5C96B003F78C76BC91B39C68572BD9B40801B43D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368217, "uuid": "1f1523ce-1544-469f-bc45-007099c61bfd", "value": "24576:/dduNrYf6oJ2GThLZi3jByI+ifuq8QuvQmJdduNrYf6oJ2GThLZi3jByI+ifuq8F:/srupTIiiWqTu5srupTIiiWqTu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779368217, "uuid": "f837dd93-bb4b-4404-9e62-753aca282600", "value": 1850960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779368217, "uuid": "c6cdf61c-916b-42b2-a9cb-4f273cf8a4d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368217, "uuid": "7537a886-6998-4908-8a72-8a07ebc1f9d2", "value": "47c96c9117bfcdbdb223f63f643e74fc0c3e4023fd30060491a4dd186ec24b5f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09af9059-5538-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779383459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779383459, "uuid": "543bbfd1-76e2-4699-84d6-2b3661f6364d", "comment": "Malware payload", "value": "1e3bcff7a6a58fdb8a94c69968178f29", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779383459, "uuid": "f14b1002-643b-4a38-8973-c7ecbdd63780", "comment": "Malware payload", "value": "47e39ded56e6db46e715a341fbcc136b36a314e25bc40cc627d22f7090fdf948", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779383459, "uuid": "3bd9c5a2-9edc-44ec-a831-8c6ba5ca2a29", "comment": "Malware payload", "value": "8c9e2d30dcb3e773f3fd65bb02a96737d91224d5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779383459, "uuid": "ebe572b2-a01e-452d-9baf-706e7745e646", "comment": "Malware payload", "value": "15ac4b92ddd0b69f964dd10cfb3dbef32c13bc3d6a5c7db0fe9286ac2a7296a29c2fac31950ce1a74216cc1cd4b2803c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779383459, "uuid": "1fa2b2c3-b01c-46d4-abde-b751d1f67614", "value": "T139416FC5B181E2336EE7CD1339E585046282B8E2DACB6E09E9D47CAA8CCDFC57461752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779383459, "uuid": "3c06c664-26df-4d96-8fb4-aae2ea5ed499", "value": "48:iplNelN4LsplNRlNPesplNxOlNxo3splNclNunsplNrlNR8splNWlNA1splN1lNa:iTSQsTZ4sTkwsTgosTvQsTqwsTJ4sTF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779383459, "uuid": "8c909eb2-e5ab-4f97-b16c-7c27af1a8de9", "value": 1888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779383459, "uuid": "3db918bc-9400-4edd-b063-2e4509f2811c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779383459, "uuid": "d14254e9-c9bf-4389-af8a-11e05814ae15", "value": "47e39ded56e6db46e715a341fbcc136b36a314e25bc40cc627d22f7090fdf948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab58bde9-5514-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779368268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368268, "uuid": "4ad10255-ec76-45e4-9303-b55817a5d859", "comment": "Malware payload (AgentTesla)", "value": "35483a88b037497031a3c018378319ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368268, "uuid": "d629c68c-3f1a-4e0d-8fef-d52cef255d4a", "comment": "Malware payload (AgentTesla)", "value": "47ebfab2cf753207795ed5e62aafff36eea4b57f21be6f5fbf4f7aa5647d7ff2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368268, "uuid": "a75f6f89-cce2-4a94-a65a-ae2a0c18268f", "comment": "Malware payload (AgentTesla)", "value": "5ba55e7343ee9640d748ab9abcca26b2799f16b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368268, "uuid": "d511e4a3-5eae-417c-bfed-382fbaa0b558", "comment": "Malware payload (AgentTesla)", "value": "5a755318f950ed639f5328ea84ef2976ab861cc60f4ade631923af5880ce530712915ac795a8d139562a50f645be8361", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368268, "uuid": "dbcc7bc0-6ab3-484c-aedc-75ee94945bd5", "value": "T12DD53351CE471EAF2E3CD22130B35A255DF4ADA09069F1A3BB3E5075EB8EE05827B056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368268, "uuid": "7997f701-fe25-4347-98ab-5ddbff62745c", "value": "49152:+ZVNd0DAR9lPZVNd0DAR9lPZVNd0DAR9lY:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779368268, "uuid": "fca5bb2f-de20-4f7f-b353-2ce165ce0c5c", "value": 2872434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779368268, "uuid": "39a77a78-ad76-47e9-9871-b1f5ead05a9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368268, "uuid": "3254e513-01c7-4a3a-9770-e2766a465bcc", "value": "47ebfab2cf753207795ed5e62aafff36eea4b57f21be6f5fbf4f7aa5647d7ff2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc1c64d-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372915, "uuid": "f764dc6e-31ba-4eb3-965b-2193c299f435", "comment": "Malware payload (StrelaStealer)", "value": "9a38bb8870b20966902c4e4b91192697", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372915, "uuid": "7053f7c4-f328-492d-a4c7-6958d7d7e05d", "comment": "Malware payload (StrelaStealer)", "value": "4889c1683ff9be39c6fdfc9f1def785309c7a9ab74d89a3bf4f6e4bca4990caa", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372915, "uuid": "89be3cf6-14e3-4be5-a3e4-b4dcb3bc7f26", "comment": "Malware payload (StrelaStealer)", "value": "b34def34a9086584a3aece3e740a0431bfc03dfd", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372915, "uuid": "8b458817-a9ab-4c70-aa26-cd02cb7c2307", "comment": "Malware payload (StrelaStealer)", "value": "2cbe94438012df7baa1df57dec7724586057e50fd5c59b903bde4f06cab96dde953ae47ec4b75ec5c72f4cf39f9fb073", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372915, "uuid": "08c63665-0642-48a4-8f80-0340a49b6ce3", "value": "T1BA41CCC1AA36CE06BEB81C4775116A281D549B653B2CE4F88CEE0803C8DEF5E090BB17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372915, "uuid": "877db437-64e6-46e0-a339-df6ee3cc5708", "value": "48:PM78t5g4IlZM5DaEf5uEw5bGGZ+0I860J+0Idu:/tOGlxw5ns8edu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372915, "uuid": "4694db9a-e3c7-41ee-8a18-f5ebf2103158", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372915, "uuid": "2dbc8fd8-f19d-45b1-9cb2-16382e40e03b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372915, "uuid": "61b209ba-f03e-43cd-98a0-179680929027", "value": "3045730206188164798.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804da80e-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1779370773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370773, "uuid": "48c42e7c-dd76-4da9-b50a-4743426e7123", "comment": "Malware payload (RedLineStealer)", "value": "a595ccae950c519c92c19ff59e400c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370773, "uuid": "cdec640e-a70c-404e-94c2-9a1fdd9a40a4", "comment": "Malware payload (RedLineStealer)", "value": "489724de42867ea5123e311cab7fa980fcc9ffceaaea5c2149b216e178a1c9fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370773, "uuid": "b69823bf-b0c9-4e11-83d5-09c55f907e7e", "comment": "Malware payload (RedLineStealer)", "value": "dfc4c57a854afe5586189ccdd65b9310dbb4add9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370773, "uuid": "a129df06-6ddd-4a61-abcf-5393b3af000b", "comment": "Malware payload (RedLineStealer)", "value": "1d823f7d28add998bda1a23cbd31b1ed8326413b43cc5cabcadf7fb22ade12b8aec219846bbe681716d5ba6028175071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370773, "uuid": "d1134356-15ad-4ed1-bc4d-b9345e13954f", "value": "T17965BE0273C18062FEA691F30B76F6DD56BC69168123A53F13BC1979FD700A1DE2E662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370773, "uuid": "bf1c942b-2a62-47d8-a314-f02910e03351", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370773, "uuid": "6524c3bc-2196-4442-b93f-d1ac32df0960", "value": "24576:t5EmXFtKaL4/oFe5T9yyXYfP1ijXdaUboDrmuL8mih8V670Gk9TPC:tPVt/LZeJbInQRaUEDaL7C6W9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370773, "uuid": "1eec2605-f8a8-45b2-9ea5-7042b7b95d96", "value": 1452032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370773, "uuid": "06210bbe-7463-4b5f-bb13-d1e312dd6b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370773, "uuid": "20e170ac-a836-4f1e-aa39-cc363bc2cfd6", "value": "Payment_advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9394088b-54ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779351908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351908, "uuid": "bb488c3f-51c2-4e0b-b16d-644170e826f5", "comment": "Malware payload", "value": "4207667462f2fae0eb1df345b1ddf232", "object_relation": "md5", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351908, "uuid": "0f0f8690-9a74-49ce-9443-ac38d3afea5d", "comment": "Malware payload", "value": "48b71d867950da3f6ba5a4dd5f8abfbe9ffac5a81e1029e539bc92eda5adec64", "object_relation": "sha256", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351908, "uuid": "456b293c-ee22-4de1-924e-0039c7e9f827", "comment": "Malware payload", "value": "8fbec3a8166c6b30674f1e80eb0ebf35fcb1a8f7", "object_relation": "sha1", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351908, "uuid": "94a46b7b-a4f0-4a3d-b1a4-92d72ac02eb4", "comment": "Malware payload", "value": "a1618d0db60ed996c4f40271cb89304825717c3196c287bd694bbbdd6f5a11e407b376a0751189f2d537e72e0019b336", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351908, "uuid": "1a572a6e-7b21-4352-9e24-6b3781b5b4a6", "value": "T12371DE0293ED4626E87B0B3869F7036333B4F8149B63976E2D60025D3CA03645A31BB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351908, "uuid": "326bc049-44ea-4135-a57e-c1132c113989", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351908, "uuid": "cc34643f-e74e-4d72-ada4-9e3d4609b4b6", "value": "48:6RbB+bfSx8ajcAkH+kihkvAUmFWHx1ul6a3Oq:AB+bfSKq2H/i+vAzsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779351908, "uuid": "1bb42235-cba2-4625-8508-ced5fb9b8219", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779351908, "uuid": "bf7be4f4-44de-4297-8f45-e0ca00c838b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351908, "uuid": "84c937af-a634-4e27-9030-3c2e2dc7cbec", "value": "ax5mxqku.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8255eafb-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779370776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370776, "uuid": "5a32b03c-4837-4d6d-9309-4389b627e001", "comment": "Malware payload (SnakeKeylogger)", "value": "83591cf1d8bc47787ba3745d7544abec", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370776, "uuid": "54fbb7a9-6056-4b90-b5ab-b485708a8a18", "comment": "Malware payload (SnakeKeylogger)", "value": "48bb30fd0e12538f0e4fd35cfec2417a16902e1ef49f32b26bdd7a51344b324a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370776, "uuid": "c77d0b37-4f92-4907-bd24-d11cf8a40715", "comment": "Malware payload (SnakeKeylogger)", "value": "bb3c42c73163d95fabbb000cc4269737e7d42dbe", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370776, "uuid": "492fbb02-1259-403a-b1ab-de399f13fd50", "comment": "Malware payload (SnakeKeylogger)", "value": "6610a15e8f62fda44e8493805f660238bd84a6f69ace57d7f02e841232c9db20a4a4e62b9a732d0c721ae9b082f72799", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370776, "uuid": "8d197cc3-7f46-4fd0-91e6-db317a5e4187", "value": "T1B5B2E159175877BEB6F3341E4886B1A14372A233FDD6F52EBE30E12725093928932C5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370776, "uuid": "46940662-8b73-4630-8aa5-67072a21a4a8", "value": "384:gzs/fmcoosdEhIDXQuzIfmuqHDhNBvDWeQ3VAPUMC4hN5hyLtiBpSTG3PX0nj8KO:gzsuch5I7QgFuyXBKFyMMrlh6Y+GfEj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370776, "uuid": "dfcea130-d7dd-402d-a510-1e220d8a415a", "value": 24486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370776, "uuid": "a131da1d-2ae0-45b5-b806-0aa62b732f4b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370776, "uuid": "a06243cb-0cc1-46ef-9cff-06fdd8f3e8de", "value": "INQ02010391_14112024.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd191786-54f3-11f1-a769-42010a9c0008", "comment": "Malware payload (GhostPulse)", "timestamp": 1779354125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354125, "uuid": "ad587c95-e508-4c94-a1c6-03e54f00c1bb", "comment": "Malware payload (GhostPulse)", "value": "ffd499f00ca3194c3ffa902006eb944a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354125, "uuid": "a6e8ca94-8510-46d5-bd18-a421d8e54ae8", "comment": "Malware payload (GhostPulse)", "value": "48bc78012d3a1a1e8a9b1a67b0970edb73b7352408eefafb7bcfcf4ebce9509a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354125, "uuid": "3621ee62-bcbb-4e3a-9d9c-f768e46cba94", "comment": "Malware payload (GhostPulse)", "value": "12f5612eaa0d3190af27c49335c9f65ff200b469", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354125, "uuid": "0fbff710-e6c5-4120-a6e1-01d0da53bff4", "comment": "Malware payload (GhostPulse)", "value": "5c3e3a81d5ae4ca8e145345401598030abcdfc1cecaefdbc16424a4a47e585e7b655583554f9172c570d738f25678a4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354125, "uuid": "df23bfd8-50b1-4ec5-9aa6-2a8cd5861d08", "value": "T1B5D44A03D67291F5E9B6C1B842A3663BBD707418632467C7A7849B724722FE0FA3D316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354125, "uuid": "74be6318-90b1-4ef5-b79f-756ace5e7da9", "value": "81184a9f7e2b304efdf1fcfabdac9864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354125, "uuid": "63d92e82-8aa2-486e-95c3-bdaee1159799", "value": "12288:Ejccjai4vo6cRb+4QScSI7Bb7ncDt6y8yjLt4D94NnDB:EDio6cRb+RLSI7Bvvy8h4NnDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779354125, "uuid": "b5608a36-1ebd-4628-993a-cd3f500e5518", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779354125, "uuid": "7de45812-b7df-4110-beab-fdb93be45bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354125, "uuid": "c468c549-9946-4965-b2f1-1c98898d4dbc", "value": "48bc78012d3a1a1e8a9b1a67b0970edb73b7352408eefafb7bcfcf4ebce9509a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8086de33-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372921, "uuid": "8ecd0912-6202-40dc-8065-e6b259940a6f", "comment": "Malware payload (AgentTesla)", "value": "c715bad351683b37a4bd3b0adbaef59d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372921, "uuid": "47c28f36-efc7-4ec9-88e3-c96cfd3761f5", "comment": "Malware payload (AgentTesla)", "value": "4939a85f4d5273ceae12055211e39b16ece905ded95f7c5e2ae5c37e3aa9727b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372921, "uuid": "1be399b8-a34b-4033-8bee-c1f6cd572713", "comment": "Malware payload (AgentTesla)", "value": "306404915b22eba32756801cf4dc89fe02f5ed4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372921, "uuid": "899c8d06-c069-45a8-9745-cc95941073b3", "comment": "Malware payload (AgentTesla)", "value": "08980a1e465d01006c2bb3b8329585c92408f995d70aa7e7d80a337425ba2ef8e502ac5dacc3192507f0aceab70fa352", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372921, "uuid": "d1587c11-372d-4932-bdb1-253f4330696a", "value": "T1D9E4239C3A510B6D106ECB1F98B57E27E5E1E800DF0947F1AFC7AE85C723856E21E825", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372921, "uuid": "08fd784c-29c2-473b-8a53-2a4e1a5a9345", "value": "12288:x84XlX6eYIl8BEc8zoXWHpKpUKrB/6J0LXplI1557Zk41k1uCUhQgRXSQr:11XkIc80XWHprKrl6Cw55dQ1u3hQgMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372921, "uuid": "8b88ec4d-6dca-45ec-bbf3-6e649e2c8453", "value": 701861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372921, "uuid": "e2ef18ca-7e61-4423-b125-957f0acaee98", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372921, "uuid": "ff5383ef-9093-47b9-b1d2-fb96838f4bd4", "value": "PO82200287.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e284f868-5513-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779367931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367931, "uuid": "42a310bd-dfd1-4512-bc0e-b9a7dcc68604", "comment": "Malware payload (AgentTesla)", "value": "a5257c6382201e6dfd4d2fb648249e6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367931, "uuid": "7587c801-5700-4f39-b96b-025bebd2bd93", "comment": "Malware payload (AgentTesla)", "value": "494a7a3fbf88feec0bf056a297e0a17ad122133af3194c398e01d60821649bc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367931, "uuid": "a9cd8c21-e0e7-4d30-b899-7bf3b8696a80", "comment": "Malware payload (AgentTesla)", "value": "6e750aed8f579e347085d918d6a4009c7870e54d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367931, "uuid": "3362d164-cc6f-4d8d-b810-5f8dffe5f1be", "comment": "Malware payload (AgentTesla)", "value": "36f40bea1c25e29c0f8ba7c38f182ccd60548e3fa78c62918b871222730b0273c5d6f8865c77614df422646b4efb0991", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367931, "uuid": "1165c941-e0e7-4719-a7cf-e7395684adb0", "value": "T129440F027F88E715E1A93E3782EF6C2453B2B4C71633C60BAF49AF5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367931, "uuid": "35a9624f-8a42-4681-abfc-7a7000931b56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367931, "uuid": "7ac1aed1-2485-4a5a-a2f7-2b7124523868", "value": "3072:5Kliq6CyZVc/2MKc2BLIg0THo9rG8KaG5jnThgqYufzz:Iiq6CyDY2Mk+sq8KaWTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367931, "uuid": "7dcd1b6b-1147-48f9-b0e3-22871e5165bf", "value": 262156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367931, "uuid": "7d711a2e-eab8-4a89-afb3-4b8994c80714", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367931, "uuid": "a3264506-3f6f-4294-9d0a-e340c3cddeda", "value": "494a7a3fbf88feec0bf056a297e0a17ad122133af3194c398e01d60821649bc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c840c1-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1779372925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372925, "uuid": "30176891-6b52-46c3-8ec5-1f81238c03ad", "comment": "Malware payload (VIPKeylogger)", "value": "6c2e7bbd888d31bb79886546301b8cdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372925, "uuid": "dfc278be-5aab-4741-8324-079e633e894c", "comment": "Malware payload (VIPKeylogger)", "value": "495a9aa04b3ff3c9b3ca588d077fb6cd60e239b66ccbd9e75c5ca748ebd14700", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372925, "uuid": "9f69ea08-a16d-40ed-94f1-fbd7c217fe21", "comment": "Malware payload (VIPKeylogger)", "value": "364b068db9fad7c3460f1f60d46f87bf7b6aa39f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372925, "uuid": "5c8009dc-3389-4027-8899-12ff4c1c69ef", "comment": "Malware payload (VIPKeylogger)", "value": "5bbf8d525d294e2fe8f577b865da883746148430db13e50f015e58dfe413404e778c6f67311c86dbc0651e75f6e45d19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372925, "uuid": "24f28d35-57f5-4a3d-9f97-760cc78aa434", "value": "T1D705231172A80B23E47E9BF98A78990013B1BB3B5542D32C5D92B1DDAA69FD0F250F53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372925, "uuid": "0bfa38fe-90c2-4bed-89a6-99f6423d9a21", "value": "24576:oJFQb9UtqZa4aVw+BUXp/TeAhI8VciDba9J:CVtLw5hIUcOeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372925, "uuid": "ca4eda4e-4788-4f2a-8c6e-474ce2f09837", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372925, "uuid": "0cdf5ef3-c86d-4ed0-9aa7-6b8d41e855db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372925, "uuid": "3c2662af-3253-438a-8320-4734fb5cb0a4", "value": "DRAFT_File_Request_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850875d7-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779372928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372928, "uuid": "b3ffc94c-7ddf-4582-aab1-8df03fa5fea9", "comment": "Malware payload (NanoCore)", "value": "733ff66fd05f4ea7df05d3e059eaca0c", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372928, "uuid": "76ac9765-e98b-47eb-96f8-319d8026760a", "comment": "Malware payload (NanoCore)", "value": "495e2b4857d10756b10de34f9741157f30bbc02663fcb70f82c8af95886f3d39", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372928, "uuid": "46ab00be-5267-4b3f-b854-8dea109e4417", "comment": "Malware payload (NanoCore)", "value": "37fcdb0cacefb8cd0e9961334aad72cc443e627b", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372928, "uuid": "c883be45-7544-46d2-9292-4ba73f5bbc25", "comment": "Malware payload (NanoCore)", "value": "4513faab5724b7657ae660fcd7f62875bf5b5f5f2be383c602f2fb4849bdea2993821efa40a3da92354f2a233baeb442", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372928, "uuid": "f5a143a3-2435-43f2-b7bd-2ebb7468cccd", "value": "T1CDF4238A809182EE998EF41BA56B27BED087D4DFC7B3C94435803E214FBE55424CDB6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372928, "uuid": "41291476-074e-4d59-a797-974bbbe9b53d", "value": "12288:LAyun5p+C5eZaHr3Nvcjp/6ir5txtza630SoVnHkW/B7skhcozqrSPtJ96eroLlz:LAymcaDNsp/6u7xhaO0jVnHkChnzqG0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372928, "uuid": "6b13dd90-c413-43c7-8939-4670e84750d5", "value": 775562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372928, "uuid": "0534c032-be9f-4a53-b70f-b38eb486f793", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372928, "uuid": "0e82cd3a-5d12-4320-b4c0-5d8e00bf6b09", "value": "AWBXNO.X077-5767613500.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874ca08f-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779372932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372932, "uuid": "33b6bda9-0e36-42f4-8b58-93e7125adf58", "comment": "Malware payload (SnakeKeylogger)", "value": "c714eb0f3bbdfb7d2b34ca457d1f8575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372932, "uuid": "2485fe60-3f37-49f8-92f9-18e9ad66bdea", "comment": "Malware payload (SnakeKeylogger)", "value": "498f7bf34e8e067e036bebc978ab35e74b9a3ef31cc6ff58d8542a2566518e7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372932, "uuid": "6c90caa5-e959-45d6-845b-6cdb47148e77", "comment": "Malware payload (SnakeKeylogger)", "value": "6b2af48778c9f44112d619189d0d702f8af72b9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372932, "uuid": "80838b5e-5d75-4a37-b048-e866b5b1addb", "comment": "Malware payload (SnakeKeylogger)", "value": "9bc560118c7ff0f865a7afd160622371fc74520879ef56e01f904011a7ecf69c1628704781857e96afd9698d5299a2f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372932, "uuid": "fe4775d3-6daf-4db6-91b6-a11e927099e9", "value": "T134E423A66581CC49C15263B7C0B9CCE99AF07430EE957B798B80F2CF1835342D647BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372932, "uuid": "1de24797-d5e6-4df3-a4c4-8882db965ab3", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372932, "uuid": "7961c899-5542-4e39-8390-cf3ec595c2cc", "value": "12288:BsHzOUNUSB/o5LsI1uwajJ5yvv1l20SPuDeBuPUBuov++TZVSoI5lXPtJn:IiUmSB/o5d1ubcvxS+UgoPTV+Pnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372932, "uuid": "5c353af3-ff5f-44b2-8209-0789a8f29706", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372932, "uuid": "80169035-b480-4d42-b442-9b72d8ff11b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372932, "uuid": "acfc0193-1de7-49bd-9bc9-f48432dab59c", "value": "PAYMENT_INVOICE_RFQ_NEA062E23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845be93d-551a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779370780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370780, "uuid": "4fcb1546-8622-4e4e-a88e-77279071d284", "comment": "Malware payload", "value": "a3964cf2008239fc14870b95e9b3d879", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370780, "uuid": "d0a7e152-7863-44c0-b9cb-3d2f42b9b3c8", "comment": "Malware payload", "value": "4a13c0323e2d2e0a3bc0f1517d128e34b972a8ebd334827a5870cc835a15ec32", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370780, "uuid": "0fc8e4e8-9b75-48df-b6d1-96a888270fe5", "comment": "Malware payload", "value": "86dcf9a685c77a483dc63883f98b3e4fca1fb105", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370780, "uuid": "45106955-9268-449b-98a3-85c07bb2721e", "comment": "Malware payload", "value": "151746755922470f10e77a8fb9d2cceef3880aa93754caf5763937f1a08b9394189d1866055bfb2fdb77598c1309125b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370780, "uuid": "cc45dd27-de51-4599-8ae9-574ed0d1b931", "value": "T1AE93DE8F6701A306A6B3E18C11412C668C06C6728E9D1B47B5A88DF7D567D9F30FE73A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370780, "uuid": "6153ade6-167a-4ede-aade-84a51ff7f91a", "value": "1536:sAynTdZKUq4BPSPGlW2zz7vsI1di1IVY2hbHF/FgG6dN9txF4sa:sA6TdkUq4xSPGlW2zz7vsI1kIVfhbHFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370780, "uuid": "3f0c6bb9-528b-49f3-8f5f-3358cd5bd665", "value": 94563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370780, "uuid": "c1f7fe1e-1c55-44c6-8b5f-ae4fa97083be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370780, "uuid": "9ccb1e8c-4e83-4a14-b612-9899ff482180", "value": "2383810437268825731.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf47c288-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779373026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373026, "uuid": "2fd74965-7a35-4ca4-ab76-770415e1b5ed", "comment": "Malware payload (RemcosRAT)", "value": "6749c78d0a4d9d7d8011ee4a27352fed", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373026, "uuid": "6d5a20e7-a80a-4189-949d-e9bce8fb08a3", "comment": "Malware payload (RemcosRAT)", "value": "4a2e412c63653810125e36d8b9f7dbbc54d0de8c6beb3af4a5135234faa9a9a5", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373026, "uuid": "bd60d061-5c72-4c3a-8883-e5b37a1fe368", "comment": "Malware payload (RemcosRAT)", "value": "797af492d6e5404a56808aad4f9589151386585c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373026, "uuid": "99d32f52-dbca-4066-9c2b-1b88b9a5ab3a", "comment": "Malware payload (RemcosRAT)", "value": "91a2be01b173128ba339853ac60d93f537687580ab8560a76f2a819da9e918c0d59756ace5f44f00261ad6f4019551a3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373026, "uuid": "52d36d29-fc42-4e31-84a5-323e7c8e66e1", "value": "T166B28461FE8146E2AC4326FE8C8931706A74CFB6473614E8F6857354A80D170BEA9DFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373026, "uuid": "cdfa5a86-39a0-49a6-8b67-a96c9b7ba969", "value": "384:jG9N7p2lSDgovFWSs+zfK7/Az/jRmrMcFc7D+wqdvP:jG9zfDgzB97y7R4M/7DDqNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373026, "uuid": "7fff1b22-3b9a-4dd7-9ac0-76ec834ad591", "value": 23922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373026, "uuid": "ed973170-b9eb-4501-808f-2e7978b9fece", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373026, "uuid": "1d3d01c2-d8d6-4bc2-9e0b-02a197d7fd03", "value": "Payment_USD.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86580aa1-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370783, "uuid": "111d99c1-a273-44c6-94b9-9967ddcdb655", "comment": "Malware payload (StrelaStealer)", "value": "c099c7808170482c158531d70ea535e6", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370783, "uuid": "3b1e3f58-43c5-42cf-a160-b177eb15b880", "comment": "Malware payload (StrelaStealer)", "value": "4ac650eef996ded4e10693d83c1b3c320e647d07c9902db338262b62070ea3a1", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370783, "uuid": "23a989bd-50ba-4817-a8c4-6153844fe26c", "comment": "Malware payload (StrelaStealer)", "value": "8fdfa9f6790915c5ff28d6a1cac7c38df514c8a7", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370783, "uuid": "ab5fa462-174b-4bd6-bf8f-2b5ceff0883e", "comment": "Malware payload (StrelaStealer)", "value": "013dca2bd9e81adb6033829c27e7b79f099140d8b818c54d3e650d9177c3386a7c45cb191ff1c8df5fb3e3d6589aeec8", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370783, "uuid": "2757693e-8028-40c0-9eb5-17ca7b86f24d", "value": "T1D36422C3EB2B89F9F58FD1B5035B6DDCA2321EC60D182AC98809DDAD9E95F4C34B9141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370783, "uuid": "8396d9e9-16a9-40b4-a07d-d831d9e2c6b1", "value": "6144:PEmIbcizd/IBdMS5rC/JYINcqHnYBmKx/u5oaUBoS4G9nIXNsDl6oz:3WLJ/KdP5qYs2u5omEIxoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370783, "uuid": "2ae28ecf-39be-4279-9833-331bd5be1e81", "value": 310302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370783, "uuid": "08cd1a09-7792-449b-8214-ac839ad92c99", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370783, "uuid": "7e68088b-a50d-4fdc-97ac-22df6373d572", "value": "STR-0022382.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96478edb-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372957, "uuid": "631bc5fa-624d-4893-bf79-4573de440eae", "comment": "Malware payload (StrelaStealer)", "value": "06db6e5d84bb7241da233369f8673a57", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372957, "uuid": "b5ce4acc-fcbb-4e68-8665-722d628d2026", "comment": "Malware payload (StrelaStealer)", "value": "4af63e13b92adf790a70e3167843cf380596d7c68818c72ccca0bddb50583e0d", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372957, "uuid": "b3377460-2609-45b4-ac11-4b281cfc3b39", "comment": "Malware payload (StrelaStealer)", "value": "4e7051c3c5c5e9721b97f48ca549c2aa766c4094", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372957, "uuid": "66996b6d-c168-43c0-8b0b-7ecf6e5023fc", "comment": "Malware payload (StrelaStealer)", "value": "a6e38aafa48621822ee1eff9bfa61f80228a66e3432f9cd607380787b8df58fe6de407eb72686df0b141b727eeb84158", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372957, "uuid": "4bac430e-dd20-4997-9a63-6c66de7fdb14", "value": "T10F31F770D68E3B20CBC1FEF083962F1E28860548A08149485D48A8C85CD95C197E536D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372957, "uuid": "dab8532c-5f6f-46a2-9841-7b39442256d9", "value": "24:9AmhOH9fmfVXC6+ivwRIYDNq480TH9Qw6p2N/jjqgihJbf7TISde0aw0+ThXsf:9byZmfVydQ2x4MH9Qf29jjqgirfIS80u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372957, "uuid": "42022236-07d0-4a4f-b1ca-c95dc7f06228", "value": 1517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372957, "uuid": "24313341-4708-40cc-a219-f7d28cc49f37", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372957, "uuid": "5eb724e6-634b-4c5f-a696-5c9ae693144f", "value": "Ganter_Rechnung_163910051.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985fddf2-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372961, "uuid": "dfa57e54-f089-4f78-9825-89a25ea2eb2a", "comment": "Malware payload (Formbook)", "value": "211465b929320f79ffd3e1725e270845", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372961, "uuid": "14779fed-598a-402b-bfc3-346628052aea", "comment": "Malware payload (Formbook)", "value": "4b56e377565bb5bc13aae283bbf48bf2aba704ad18aeef5158c26159a862d3c7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372961, "uuid": "40e3dfdf-635a-412f-9aa3-4c723b75cc5a", "comment": "Malware payload (Formbook)", "value": "f6997b461149a3a71730b9986d8e574564001f53", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372961, "uuid": "17a600ee-31a4-4702-b327-63fe09d0c86b", "comment": "Malware payload (Formbook)", "value": "063a60f6f9949b783d923d98d71e88c5ff03b1a7f57824c2c1ac56b1821c48d4fa6ec1232d42530a12d2ec3a8779c0b5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372961, "uuid": "a24f01eb-33cd-4dc8-80ad-9d59bfd6c7ab", "value": "T1E7F423E35C296ED9D2BB2945B732CCC295250D74732FB537ACB2B94A14833F77249062", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372961, "uuid": "6d55a991-1cb2-425b-ac12-58c22562a5df", "value": "12288:E2gS2i8DaiKGotb/QDWXFZ6F3/ZjQ6cxR0uCffdDObxSlYnvjGM1C2VufvbL:E9S1QKGoKPZM6c12JKSlabOAuLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372961, "uuid": "24750942-651a-4add-b751-ab11430841ee", "value": 739869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372961, "uuid": "bfe0febc-cde2-4a91-b92a-11f69afa2ae1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372961, "uuid": "3a437b63-53db-4bac-9ad5-ee5c42208117", "value": "Inquiry_PR#27957.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf3f649-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779372967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372967, "uuid": "81f1ce04-5b6f-49f5-a395-8c4737e59423", "comment": "Malware payload (MassLogger)", "value": "623b33a151443c8e7d71d6e699afc5a2", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372967, "uuid": "197d9cb3-396f-4e30-8c27-e96a7627d4cd", "comment": "Malware payload (MassLogger)", "value": "4c2f87c10ab9eecaeed2619a2f3e3b6513bac85304f89c8b07bf4052896a729d", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372967, "uuid": "f771b3ab-0144-4fe4-9f78-9ca9dd536f8e", "comment": "Malware payload (MassLogger)", "value": "4578f9ac09aec883f0fcfd19c3d69a61cc4b6f9f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372967, "uuid": "95ec2e1d-ac13-49b6-87f9-07ab45146195", "comment": "Malware payload (MassLogger)", "value": "c2603667b7b768e644b3d0eb8caa142a6b237142673daf50c76f2eab6583be00530d567bb02d25dc5aac6cca699f9ea3", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372967, "uuid": "aa3b437f-9cec-4324-a55e-57e7c153fed2", "value": "T16205E00393ACD221FC3657F2A5145592137EB627A2F9D320FA8C25DF5790F206E98B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372967, "uuid": "90e9ff0b-a145-4585-ad0c-e461d70e0b50", "value": "24576:hsFctkAv97hIPdvWyO9NtJjTBgLlLqnkb:hsFclxhudxO9N/nBGLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372967, "uuid": "9d798f58-179f-461c-95df-172883adcafd", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372967, "uuid": "799b8f32-90d3-4141-9a91-c2013d9d9264", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372967, "uuid": "c2e15911-4c02-4985-b4eb-74853518a947", "value": "Swift_#7562024.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f94638c-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779372973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372973, "uuid": "e3be77a4-3c78-4714-a9f4-5b924f79977f", "comment": "Malware payload (StrelaStealer)", "value": "80b877d87e535db4a47b8fac618e7204", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372973, "uuid": "8a80d4b7-6177-4fea-a78e-91fe79d6b34a", "comment": "Malware payload (StrelaStealer)", "value": "4cb05ef0d4a1b55fa55b657ba0c244b944f277fd66655e9ec047d28ecb333ff4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372973, "uuid": "94eccf69-26cb-4703-8d69-9417dc353f14", "comment": "Malware payload (StrelaStealer)", "value": "c8fa13cc4c58afac5ecdbb04ffd4b4d469c00229", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372973, "uuid": "18d7e5af-e4c0-4551-af29-e1f677a17e32", "comment": "Malware payload (StrelaStealer)", "value": "eda7d2165b32aff82d276d039d222ca5d6bbab4bc5e90207883ab3826bf33500c4b7d961d1b6bbc0a1deafb16ea9846c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372973, "uuid": "03a098fe-9b07-4066-b02a-596d0f6ccae6", "value": "T1D3C1EAB4F6ECA30752AC036A4FAA37C8458AF409571C769680E60FD9FE751E4B36C4C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372973, "uuid": "4a213925-095f-4b51-a350-a29e8afe4142", "value": "96:4XhweX810SCFZL0IoQEZQvqyAkR7suQvqyvz:4meX8iSCFZgILEaiyAkR7s9iyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372973, "uuid": "f0908b8f-b60b-48b1-9839-3ac605d527d7", "value": 5635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372973, "uuid": "7732b8a0-42b5-4ea4-b0f6-d104edcd5922", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372973, "uuid": "9c4218c4-e135-4186-aece-f814b3cd23e4", "value": "20207242741666618717.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1af1d61-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779372977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372977, "uuid": "694507a9-e12f-484a-9cc8-a5ae7ade98fd", "comment": "Malware payload (RemcosRAT)", "value": "88ad99bd08e94b721914d8368c3a259b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372977, "uuid": "45d38f18-caf7-4f3e-b29b-5282b6c94764", "comment": "Malware payload (RemcosRAT)", "value": "4cce5506593907c3db78282849ed41729ca7cf737e1d38cb82dc10e27d92ff16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372977, "uuid": "b01a21ee-891b-4ada-8801-4dfe180b76e7", "comment": "Malware payload (RemcosRAT)", "value": "8d6518f2ea260d9835c3ed7190808fc263ed010a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372977, "uuid": "8e51511d-1d93-4e06-887f-b3bb78867657", "comment": "Malware payload (RemcosRAT)", "value": "49e6633f0280793d30c7d16ae7a447015bebc3023526a7f5b745b264d3593222c3623b95ca0dee8bc7c0a9e044ed49b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372977, "uuid": "b66cedcc-5a4b-4b00-b5e3-9cbb4b95a09b", "value": "T18E1523E2A199E407E9861BF00932E3751775AE4CA517E323FED93DF73852F2424482C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372977, "uuid": "856f1636-6875-4285-8ef5-81ffc3a01261", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372977, "uuid": "418dfcfd-0236-46ed-b008-e9b6831aa636", "value": "24576:qQ/EymH4hro8jGqj56ulEJ8v+FgFOfY823:3yHGrhGqdFlECv+CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372977, "uuid": "325b1726-4be9-42d6-9cc0-64b64d10ffed", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372977, "uuid": "07b0f2bd-f1eb-42e6-aa16-38ef0747da10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372977, "uuid": "daf32c40-5d6d-49b4-b5d8-bb5febb831bf", "value": "J-230512-31246_-_111553_-_31246.pif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5438616-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779372983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372983, "uuid": "9c3a1e4b-f57e-45c0-9d44-f7b8a9e58b41", "comment": "Malware payload (AgentTesla)", "value": "dc0037fd57c1037629b9d6e395afacaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372983, "uuid": "b26590f3-4383-425a-b8b0-c9fd395622ca", "comment": "Malware payload (AgentTesla)", "value": "4cf48ffc9f596563aeb6d774e5f222c8ef639f62df9dd87c99c7be32f71643c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372983, "uuid": "0da38e65-76bc-4c72-a1c4-dbc037ca6d2a", "comment": "Malware payload (AgentTesla)", "value": "29b4eabb66705c5e8e71f9dfe1e326a38c158a70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372983, "uuid": "bff37e0e-269f-4807-8523-f33eda38ac24", "comment": "Malware payload (AgentTesla)", "value": "40e5aff62335102f2963b9427171316328039f63206bc3a63ff7fbb94e8b6b35031183f9e9a30ddb8515a835ef21cda6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372983, "uuid": "c87cfdc9-b38d-4e1b-aee3-a007bb1aca25", "value": "T19815CFAC36107ADFC827CD368AA82D64EA60647B570BD203A01705EDAE1DAD7CF145F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372983, "uuid": "bb8dd301-dd06-43f7-85fd-3118ac68cf95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372983, "uuid": "970a78f6-6f0e-427f-aea3-be8a08dcadeb", "value": "24576:f9AbZrDsvuihNm79wtt8JBknBOuHqPPcnhcyx:ubZ25Kot8JBOvKPA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372983, "uuid": "4251ae18-4126-426c-99c8-10f2a2cee34a", "value": 931328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372983, "uuid": "05b6cf63-39d4-4101-b0d7-acc2bf812222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372983, "uuid": "7890fb73-b7ea-4e08-b158-efd218fa8b8d", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a03a6ba-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370789, "uuid": "34987dbb-bbd3-44e1-8722-5fcf7d00e4e4", "comment": "Malware payload (Formbook)", "value": "0391cdd3d3e25350a85fb73d01eee6da", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370789, "uuid": "3f4c78df-72a8-4872-b76b-578af80703ca", "comment": "Malware payload (Formbook)", "value": "4d2f66196a008866b05fed0c8b9bfcb80ac78496fca7d3e1916502574cd5bb4b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370789, "uuid": "c4e404b2-e699-4137-8f8b-54c15c82d380", "comment": "Malware payload (Formbook)", "value": "11830090cd89525a2d8ab334020979e2e0bed694", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370789, "uuid": "961ffe5e-6ea7-492c-bb5e-54cadf8b9ef8", "comment": "Malware payload (Formbook)", "value": "dcbd1dbb58b864128cfa516c87debe27ce0ac02fae5035883309f0f2de25143f91c8f327859398e468ff2da54fdc0f4f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370789, "uuid": "e7698f6a-4969-4c18-85ab-ac924df67169", "value": "T15EE423C495E5E4C9CB3CC6679DEDC7F4C3A224E24E15A13FB204E0F9AA7251A51BC0DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370789, "uuid": "4ac38a2f-c08d-47da-b4e7-a9a1cb9cf22c", "value": "12288:v843kKO2l05+oe7vLNCZJ0Ic6T/yELG2H84EMeJJwU28FYrzBOd2EndHTd2RJkk0:v843kAw+drLNu0Ic6TaE62HbAJQHzG7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370789, "uuid": "e84d8dd0-a926-4deb-9870-45afdab9ea02", "value": 705958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370789, "uuid": "8daafdda-4770-41a3-a9c1-bfd61f0af73e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370789, "uuid": "89e5fb6c-9059-4ffb-ae06-5ad67652bf20", "value": "Quote.lzh.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68aa7fee-54e8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779349259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349259, "uuid": "22b733b2-35e3-47d6-991d-9d45d239b3fd", "comment": "Malware payload (Mirai)", "value": "045b439c1411f7a113d9502aec5da17c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349259, "uuid": "26a49c98-370c-4b64-81cc-6d3adf54bdb8", "comment": "Malware payload (Mirai)", "value": "4d3a11c0d32c34fd8b4e803dcfd843e2ecbce805f26f2618632aaf7b2b831137", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349259, "uuid": "d8459cfb-f47d-4e57-af84-0a9c459970c1", "comment": "Malware payload (Mirai)", "value": "fd38c4550c0e8ac8cefbecf0ca7fc364ffb6054f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349259, "uuid": "d45dc1c3-a34d-4dff-83a9-b9eb54b87019", "comment": "Malware payload (Mirai)", "value": "5d91375e8dfba983563cd635dcc5f7d32dc105fb307fdeec44bafc26a52cbd6a294bfc9e99948fa469df4354351c322e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349259, "uuid": "bd037b2f-057f-472e-b6e9-b1c4c920bb93", "value": "T13DC3AE87B78B1091C86206F447D70BDD6EA3A1055F2B98F33C6D763E4A760EF5A0A781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349259, "uuid": "3b08fdb9-76ec-4eb3-9112-a2db3b2e049c", "value": "1536:R6iRRTzd0OvAjSLuYWcI1AmoMk5x9FlKCi4aOD/xGp91pjg7/+/LWy:sGfZoGCcI1Anl5x9Fji4aODsjjg7+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779349259, "uuid": "8b17e971-1bdc-4681-afa5-8c9cf95a96c8", "value": 124644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779349259, "uuid": "222e8108-28e5-4f23-8410-85ac8daa4207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349259, "uuid": "4f5d303a-a5dd-4e69-87d0-4a431c2fb3db", "value": "bin.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74573a9-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1779372986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372986, "uuid": "324f9351-0185-4303-ba75-7cfd5b7c6039", "comment": "Malware payload (VIPKeylogger)", "value": "7374aa27050a0543b78fa171b7e697d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372986, "uuid": "6538f54c-8db8-4518-871f-526d44503755", "comment": "Malware payload (VIPKeylogger)", "value": "4d780feaaf05d77f3600868d3d6be2cdaad7eb85dd80745f619fbdc8642fbbe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372986, "uuid": "a1cdbf12-f1f2-460a-88eb-c4dfdebd8c5c", "comment": "Malware payload (VIPKeylogger)", "value": "1a6e5d101d04a1733ffa1a99970ffb4b6d2fc7fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372986, "uuid": "395cd69d-6cbd-41e1-86ae-eeaf797a3338", "comment": "Malware payload (VIPKeylogger)", "value": "2de9f2562975f5ff3933b6ff0301c3e6ddb6bf83f8eee38d434ee538e64e54d175ce4056966c55f5155dde98469a09f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372986, "uuid": "b35722b1-92b4-4f4b-9fb5-c122b79f496d", "value": "T126150205327D9F02C4B14BF54872D1F457F9AEAEA821E70A4ED67DCF397AB140A0264B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372986, "uuid": "f091416a-f645-47a4-a97d-5d17c88b948a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372986, "uuid": "c4f4d894-24ea-4112-bd53-83302da25199", "value": "12288:F84+jrixlaBVXReup5NWHsnLZWFfMmglYFIwv/7BWH2qwgSUI:Fv+6xlajdNWHsk9MmgEbvj8GgVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372986, "uuid": "99e160f5-3fc0-4716-b4cc-9eb19d8c16a0", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372986, "uuid": "43a92062-98e0-4b01-980c-68f319a2daff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372986, "uuid": "72c2afcb-f254-4a6a-bf0e-c8197412bbc6", "value": "##Swift_Copy.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c04923c-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370793, "uuid": "9c34c21b-8a39-4bca-9ea9-c2ca88d4a0ab", "comment": "Malware payload (StrelaStealer)", "value": "508c48595b2053572068a271902bf742", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370793, "uuid": "91aca495-fa19-439b-976f-28304533111e", "comment": "Malware payload (StrelaStealer)", "value": "4d9d77633ac42f9292fe53280b018a07e764bad0fb85f3dc3b34f569b96b1ec3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370793, "uuid": "7b4427ae-02a1-4850-8c66-8dac24a6ffba", "comment": "Malware payload (StrelaStealer)", "value": "bf937fb43c12e989428d6110b42f95744f5770cc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370793, "uuid": "9cab6cf2-837f-49cc-9a29-34174daca87c", "comment": "Malware payload (StrelaStealer)", "value": "98841b2b5de2851e7fc4be77da4fce9f2412bc75945e2112f8915456d4968cf02b1d28d020358237d95cd6e659abc72e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370793, "uuid": "34b7f7c1-606c-4bf7-bd27-ead21dc5783b", "value": "T15E45098FEFE86D7868E896D906A4F2DF0CD44D346B5588C4626FA4A71BD20CD2717C32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370793, "uuid": "588a6e11-ab74-4268-ab4d-d3ab6150601c", "value": "24576:dk78PI9P7WWtTdVWD1fl8/Yiu5xubfqyh0U051KVTOMP5/+Uc9AXvchIxmRndzaJ:pMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370793, "uuid": "2ebff802-7efd-40e0-9d42-a86b188ecab5", "value": 1251112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370793, "uuid": "5de42387-1ce8-46e0-a5b5-67b27cb15b81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370793, "uuid": "7690b3eb-a026-443d-ac9a-78d6d7833501", "value": "1563822753819813559.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6dfa6d1-5512-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779367402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367402, "uuid": "08afb5f3-e9bf-4411-8e94-63b02ae4ad10", "comment": "Malware payload (Mirai)", "value": "a7842200d5a0f5e328b518412f0d525f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367402, "uuid": "be3d7757-efb6-45e6-840f-e0ea3bd575c1", "comment": "Malware payload (Mirai)", "value": "4da962cc5991e5a8592e0af6ffd825cf6e0addad06d3d5a37e29a9cb400e1d86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367402, "uuid": "75d745ea-0b53-4160-bfd4-bf93191ba397", "comment": "Malware payload (Mirai)", "value": "d9bb646c0aa02108fb5bee7da81aef63b36a8f28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367402, "uuid": "06ada1aa-649d-4059-a575-1b34bcdda675", "comment": "Malware payload (Mirai)", "value": "40ca1be17ba13cc8a86b72a402e0a40a53b07e2d7a79b7e52c7f20a3918f577cb7d9dac72bd7090e83b90de012444a61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367402, "uuid": "3b4dbd4e-40e7-4df9-807a-ae343e06eb0a", "value": "T10863012AAA27E4C66B70143B17EB8B82605228FCBB95B837554C451D6F5210EFEF910F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367402, "uuid": "f60a981e-8854-4647-83cc-fec3567a264f", "value": "1536:AoheD013LokXmLhhdf1xtf2Ujci3bndNULofAxpeWPqLNri:AIw013LQLzrndNULo4xcWCLNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367402, "uuid": "f198e8c8-de85-471a-9bd4-447d608e802c", "value": 70400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367402, "uuid": "4b7baf8b-38a3-4189-99cd-97bf8dbaa7d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367402, "uuid": "09cbdda5-07d9-46ee-aa8c-0caa05b0e028", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95f3e08-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372989, "uuid": "44fe8cf3-0c2a-4d03-aa91-398b79bf893d", "comment": "Malware payload (Formbook)", "value": "f384b064e89c9b2e15ba21ea9f26e3c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372989, "uuid": "204d2299-f5da-4fe5-8704-a825f9ca4704", "comment": "Malware payload (Formbook)", "value": "4de51fe054d8c489dc9b4f7f58e49f23a5cdb3dba8c5d68e92d4a0be3440a257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372989, "uuid": "c3fdf592-9c75-4518-b42c-2a2b49cee5d6", "comment": "Malware payload (Formbook)", "value": "afdc4a9bb13fe9ce9cefeb92053698c89124ebad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372989, "uuid": "d7a0a78e-f2a6-44d5-9b25-d61aade77bbb", "comment": "Malware payload (Formbook)", "value": "d2fe862bb7fd7e063a359a58a9aec87b4f4adbe6276e276a0a50c2e0cc1444458c5c426099d2118fbea015e3c2238c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372989, "uuid": "446c9cec-6c64-4da2-a50d-b8698c0ac6aa", "value": "T1A845BE0273D1C032FFABA2739B6AF6055ABD79254123852F13981D79BD701B2273E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372989, "uuid": "4d674e05-6ef6-4e4c-8184-9b1f82d211b9", "value": "649f6ed9a4d576c154bbc0357156a4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372989, "uuid": "5776acb4-64f4-438a-851b-bde1aeca7aee", "value": "24576:PAHnh+eWsN3skA4RV1Hom2KXMmHamYwhVo6eOPLq1/5:yh+ZkldoPK8YamPhW6e8Lqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372989, "uuid": "ad9f4195-35b4-44dc-876f-e345e9b63560", "value": 1165824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372989, "uuid": "96e42014-aecc-43fb-8e18-facb6fe286fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372989, "uuid": "8dbd03a8-367a-4a1c-b35b-32230e2e2e46", "value": "GSTP_-_K3E0035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1fa0f7-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370796, "uuid": "bc298236-0ae7-4318-8b2d-3ee771ea7680", "comment": "Malware payload (StrelaStealer)", "value": "0229551429e55dbfdc95c47b565ebdcf", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370796, "uuid": "86931383-5016-41db-b2f3-c1ec2dad8c8c", "comment": "Malware payload (StrelaStealer)", "value": "4df1765b0416e7ddab0ea2b2c7dd9f362c10d62b57181af4bc3e0c94e8026e9e", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370796, "uuid": "6ab92b40-a520-4af4-8ce5-5395ead7b378", "comment": "Malware payload (StrelaStealer)", "value": "349ffc24bb655f2c40f3a3e536a78a616685cc4b", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370796, "uuid": "a08d314a-6b89-4116-891c-5c073f5800d2", "comment": "Malware payload (StrelaStealer)", "value": "87bc0baa9daf65443daa0c7463201e53c841347513fc6994a884e738d717486e27af3802db316ce6a9accb0d61179a12", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370796, "uuid": "6cb7dea9-dcc1-4987-b63c-661eeb591d79", "value": "T11AE31279498B9AF7C29E2832ED86FF41E027F34BD0CC748922B234885D75E554BF5426", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370796, "uuid": "574cb329-a0e3-4959-988d-306fd1263164", "value": "3072:+K0+uI6TogReEqF6f/jHsiyetAccVWvH/jR69ljofLADgZsGY:/033TogB/7VaVWvH/jR6josDdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370796, "uuid": "509f6b9d-1e46-49f1-8c34-f37b350a855f", "value": 147894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370796, "uuid": "3c176f40-94e1-4022-8664-b6dfcf39dbf6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370796, "uuid": "ea212c59-37d6-41f6-9824-45c93779c6ed", "value": "NettoX-XRechnungX-XNrXR16961.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8d3b2f-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779372993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372993, "uuid": "d58c6d59-e443-4ae1-b55c-3c433ae0d875", "comment": "Malware payload (Formbook)", "value": "443c39be232508f4dd8e138b0b33aa79", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372993, "uuid": "f1570702-c5bf-46eb-94f0-bd29b1ec4374", "comment": "Malware payload (Formbook)", "value": "4df2715b659594ac5529ac219a2579f5890e26b8f2fc08aeaf300230c7a752ac", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372993, "uuid": "b0ee6adc-6783-4c2b-bcff-39e4e45eb719", "comment": "Malware payload (Formbook)", "value": "cda8ca78743d5e68a29b11a07642e3497e1a9652", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372993, "uuid": "6bdf0d0a-1548-42f8-a290-e31eacfe8d55", "comment": "Malware payload (Formbook)", "value": "83cc6c6a0de63279186a401134ea4ac6bde25a0b6fbd724b96e087966bab9a463fcaed24d3bbe43f78e70595852d8de3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372993, "uuid": "9274d6e2-477a-4e2e-930a-adfefa55c01b", "value": "T18405332A35B9CE180142D829DCCE8F73B53EA392663E44FEC50E6B387F5C1359A49472", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372993, "uuid": "4f16f44f-8735-44b1-89d3-21395478df1e", "value": "24576:tW4wJVehP6rGYBaIarFCBnvWR5q16LVu8:tMqVApXBnO66hu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372993, "uuid": "019cb03e-bb22-4d95-90d0-2392efa419d7", "value": 864040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372993, "uuid": "58bfd072-ff81-4347-a474-c7a77d39792a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372993, "uuid": "1d011b7f-8e2c-4905-95a9-d583a6bb900b", "value": "Docs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10eb70c-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373002, "uuid": "1bc41a15-3b02-4d8c-8475-5a1d40edfe31", "comment": "Malware payload (Formbook)", "value": "a5ccdf21d6e98e4b7ce4507ef81c49e1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373002, "uuid": "e8d20f52-5aa9-43e9-be26-be19f25accfd", "comment": "Malware payload (Formbook)", "value": "4e2acbf5261ff8755f19dca669ab69aa4e0362c6d2b07a4cf948b3d80b29844f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373002, "uuid": "5c53705f-495d-4816-824b-503356587bb6", "comment": "Malware payload (Formbook)", "value": "252bfb3d7a2a9b2fef3bd74b2b0e5107f0cda734", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373002, "uuid": "cd4a2d53-6f33-4d73-a3ba-a6691ad7d2b0", "comment": "Malware payload (Formbook)", "value": "e630b2c56f27548ec35f27259fc9f123a7756a72a84ba511843267df00a7a531de42fa44d43c3a8a327c99db75ac97dc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373002, "uuid": "fb8e1de6-2451-48ae-bb01-d9628134fe63", "value": "T1B7C4230D0CFF22249F4585DE66BF890B37894A2DF16140BB174E7E92AF13192ACD59BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373002, "uuid": "349d7003-eedd-42cb-bc3d-252a62489703", "value": "12288:rZY8CLt+QboWS2tgDVA87DYOfM+ScXoS29GYMju4JRxHZ7Uf1mdp:a8CLIQbowyDVBDYpvcXoD9kz0Ep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373002, "uuid": "a25abf7c-0192-41eb-8576-a6c7b1fd3ac1", "value": 592675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373002, "uuid": "fc3a603f-207d-4e69-b1b0-cc0494f3929c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373002, "uuid": "0e806aef-a9ac-43db-9da7-8395c126a582", "value": "RFQ31072024_August_order_pdf.r00.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5337885-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779373009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373009, "uuid": "869c541d-2765-4abd-8f82-59528704cbbd", "comment": "Malware payload (SnakeKeylogger)", "value": "90a5fbf13d12725470b1a9256f623183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373009, "uuid": "f677996b-3997-44e5-82dd-a2005cf6c1a4", "comment": "Malware payload (SnakeKeylogger)", "value": "4e31a886cd81ca02100d96b6b1475085dbe02d7c6f3fc72604be3ae64a56d1e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373009, "uuid": "bed8e8fc-a333-4bcb-b842-f58642587ce9", "comment": "Malware payload (SnakeKeylogger)", "value": "d658ce6ee79a03233d9d2a5430c96414a7a7e134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373009, "uuid": "f3619408-3eed-4d75-9624-67e73441ac73", "comment": "Malware payload (SnakeKeylogger)", "value": "4e6124484004d66bac805f5a22da806e99316fea6bcf3cf0e7ca32d1ef654152a4b430659483dc6d75d861fb6903db58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373009, "uuid": "11499ef7-5391-44de-8108-87e7c7b6341f", "value": "T105250150B26B4E0BFD194176CAE175F001FDAD03B8FAA26FDF902C690451BBC99259F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373009, "uuid": "bc7a78ee-69ce-48f0-8a1c-a5ba9807d7fd", "value": "12288:z0BZrV88zjzUGUqllruPleLuKWSCmnozuOtNMRnLLUQ2q745i:QXV/aMlyeLxWSySsbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373009, "uuid": "f7c6494c-942e-4fa3-a2ad-fe1be1c13913", "value": 1012865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373009, "uuid": "5aaa9865-8285-4119-91bb-cda67222fc06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373009, "uuid": "83088c8b-86ee-4fd1-9a92-32dd8294cb20", "value": "CW_00402902400429..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90357fe8-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370800, "uuid": "aca1277e-e3b7-4da9-9513-d4e950ed6aeb", "comment": "Malware payload (StrelaStealer)", "value": "091108d80c0addbe50bb0e3754d87692", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370800, "uuid": "12c3e1b8-1d5e-4379-8564-67775b2b6074", "comment": "Malware payload (StrelaStealer)", "value": "4e8047787d857f978665c3484724018c08547bfb26359e8453a72cac7ba95508", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370800, "uuid": "e7ff294a-348b-4bf2-a323-007e57e7cbd0", "comment": "Malware payload (StrelaStealer)", "value": "57684484b3394b6f4adcb2b6c4fec142efc6fa5d", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370800, "uuid": "22123be7-f6ac-46cf-a045-2e1cb124d615", "comment": "Malware payload (StrelaStealer)", "value": "c373404888d71009698f2bd9254e4c4c258a992269191a7c90cdc01048678dd471bb2809a013e6680da33187e9cdb382", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370800, "uuid": "43cfd67e-86d2-471d-aa62-b287da248ef8", "value": "T148542365133BBB3F8791E6606444B4EE8ACA4667F3FA83DCB464B61190157AE0AC2374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370800, "uuid": "f5c097b5-3a69-48d9-bc6b-68f96497e761", "value": "6144:IP7xhq86+0K/ArjaAUj47tSQNx82cJQ6HaeioT6ljqdJYHtd5MYHzu+:IP7b960/Oyj6cKJeTUqdJ2d5M+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370800, "uuid": "09b2de75-081d-452c-adfe-61520a584140", "value": 293975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370800, "uuid": "77c4cbd9-df65-4ab2-8806-ca5ea5fbbb85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370800, "uuid": "a7595559-5bcb-45d1-b420-6287bb79f8dd", "value": "02029256.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a5a682-5512-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779367403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367403, "uuid": "92fe1f9a-a738-4e9e-88b7-733fb68a231a", "comment": "Malware payload", "value": "2d9a7c273a4cde0f01dddf80e62bc011", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367403, "uuid": "4b2f7eb2-0c84-49f5-a702-e0adb9936014", "comment": "Malware payload", "value": "4edb5ebf61568da3e55d5e050b2820cc650eeafc99da56cea66a3ea2858526e8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367403, "uuid": "09713b63-4876-4368-ab10-59b55ace279b", "comment": "Malware payload", "value": "3ed069f2783d5a7b373ac2153de92f2476514f7a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367403, "uuid": "1f2abaec-0c3a-4e71-97b9-d07b47706c04", "comment": "Malware payload", "value": "ea7e3861d1ea90a18156a7694b7071389187b4cfc4a7a814531d28a53e1a08d6f9d927152c1547551bf6fd56954fefe0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367403, "uuid": "dc2fc40f-2ab8-4c7c-9438-3028dc25fba5", "value": "T190136D6526953C25AE99883B5C7F2F0CBDA983E2304491DDBFCA3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367403, "uuid": "d0c2e6ec-9362-4329-ab83-578279ba4ec8", "value": "768:Ir9NyXsZztCp9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:WHusZ/co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367403, "uuid": "59b7e206-aae8-4935-b71a-afa1e9ccef62", "value": 45529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367403, "uuid": "90aa0a66-da0e-47f1-a888-f0d52683ebec", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367403, "uuid": "73437d5e-4960-4d7d-a3a9-b4e609559b93", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a71e51-5529-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779377298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377298, "uuid": "33123bd4-b6c5-4442-a6b6-d332c2e61526", "comment": "Malware payload (Mirai)", "value": "a88ce4f8b5a256d85bbb58f043207b73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377298, "uuid": "9ffea591-eace-4286-87fe-75a2530e8706", "comment": "Malware payload (Mirai)", "value": "4edeaabbecb0eac98ab1f84594f8f353e2bbb7f93dfeef95a5f8ed1778d56ad3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377298, "uuid": "0d8b4234-973f-4305-8c7d-bcc9504eb060", "comment": "Malware payload (Mirai)", "value": "f264ca79aa9dd0e395f20cde23b91535fdfd9610", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779377298, "uuid": "051288ae-c8be-482a-a69c-347a5e0664cd", "comment": "Malware payload (Mirai)", "value": "8628b263e748483c8e65c819736062327df05c171f22bf831a7536c313cce5f77294f28b1fdb687edf8e31d4907c4742", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377298, "uuid": "cd046661-86b2-4b09-8274-a26129c1b1e1", "value": "T1C043F123AA536400F36029793F599FA70B431FBE81D93D17916827D17A93B58CB383A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377298, "uuid": "0357cf70-239e-4961-b1b6-f2f020427222", "value": "1536:4mcTNb+XHROC8udziixbUf0/wYkZPvtGIbi5zizEvmYzd:4LTg3A30ziiNUgitGIqizEvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779377298, "uuid": "712b54b4-7f14-4c56-9043-4775b977723c", "value": 55336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779377298, "uuid": "84fe985d-27e5-43bb-a2c2-3817649af516", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779377298, "uuid": "cc68f9f7-cb1d-4b53-b925-5ec35c913323", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ab52c9-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373013, "uuid": "be189553-02c4-4506-8e09-f602b9289e4c", "comment": "Malware payload (AgentTesla)", "value": "bf1a3b425334960a131abfb01f3760be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373013, "uuid": "3a595815-19bd-4879-9fa2-e7c645f93609", "comment": "Malware payload (AgentTesla)", "value": "4ef7532d3ab58b665c23f51f3407a360a26c393722b9db2f0e1614d55b1984d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373013, "uuid": "59696e78-7a6a-4c9f-aa00-be3d376a6441", "comment": "Malware payload (AgentTesla)", "value": "7aeb3f26764cee8b2425a27a4008b635b754421a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373013, "uuid": "1b7d6b7a-d83c-4e8a-89b7-82267d657bf5", "comment": "Malware payload (AgentTesla)", "value": "cd4e830ecb5b2f2c7088d0ae76b30f0e0d5d127c6587942643876f5c228d8786e8d0e30115d85a127047e0679628a366", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373013, "uuid": "659b3af4-34b2-4235-b29e-d6b9974c998d", "value": "T17DE4233CC6E69331CC11B208F20D8E0155C8E4F5A95E9A796CBA98B0CC5E29957F4FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373013, "uuid": "31b5b178-2528-4b27-b1ac-6c91a5e87d96", "value": "12288:my5eagr8JfrCkWkv2lQrruF5wagF3JJlPkSwx95KiC/R:myAtRkWkegre5waevlPkSwoiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373013, "uuid": "8bd25131-842f-4b00-a282-a210da60085b", "value": 664287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373013, "uuid": "bd99ec7d-9ce5-4f44-b789-96b8cc0c755f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373013, "uuid": "d2cd8467-092b-4012-8075-8410114385db", "value": "PO_20248099-1XX12,300PCS.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba180483-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373017, "uuid": "3c5d4f7f-7f5a-4209-87a5-e770cb8be88f", "comment": "Malware payload (StrelaStealer)", "value": "247153ce772fae81fc703667cb0a7a4e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373017, "uuid": "f8316e3b-5e60-44be-b48f-6ef51d7d1cf6", "comment": "Malware payload (StrelaStealer)", "value": "4f20ce5f07596bc3fd4b741aa8544764722a71e7b198af08108f0f319f947b53", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373017, "uuid": "1ee947d9-c526-40b4-9231-9761a5a7e562", "comment": "Malware payload (StrelaStealer)", "value": "6686eb4d5a67476076c2f9d4a710038609f808f2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373017, "uuid": "0e48da35-271f-4db8-ac55-fab60a45534e", "comment": "Malware payload (StrelaStealer)", "value": "018e2d7fcddfcce8d1d7669d1dab2719ea069111ce4556598beb7d73566ceb3794543fd60af18f3598e853fbd7040bb3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373017, "uuid": "db4c4cf6-a665-4389-8ae3-4201bf1b1f11", "value": "T1D56145C1EC45680C2B116A57EAB7421CCECEB5762685C5E54B8202C3C0D8DBEE3B46DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373017, "uuid": "392dffdc-4919-4ee5-a17c-28d45d6f0f9f", "value": "96:Vsw/SJKh1uSvpQEXEGL2+xk6b/z88e+1LZJ/V/z88e+1X/G7Fy:+MB17vpJRCIZ1LnBZ1PO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373017, "uuid": "e3ef2463-f7e3-4311-8587-25df16157de3", "value": 3194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373017, "uuid": "d265c7a3-a047-4245-a335-c7d63c8fd4ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373017, "uuid": "69fd0119-5453-43b7-99b6-051bfa3153fa", "value": "28242154161725019266.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca49ce7-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373022, "uuid": "a09fcf33-2bb7-47f6-b49b-268da505e5dc", "comment": "Malware payload (Formbook)", "value": "8ccf5d15410293725ae078f46bbb3660", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373022, "uuid": "b0ea8901-780d-4083-b5f2-daa10ea7239c", "comment": "Malware payload (Formbook)", "value": "4f26add8faa0d3480c5a43a8a70644c981dca1c5b1f981d7e12ef6a57cad6ac6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373022, "uuid": "cfc85802-9252-419c-8de6-33c18a0856a7", "comment": "Malware payload (Formbook)", "value": "9c308260e88aac22c77f18e635ae37de1eb3370c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373022, "uuid": "8ecff9b7-611b-45e2-b8f4-9a132006d475", "comment": "Malware payload (Formbook)", "value": "c5a6710263aa9406920dc035c0f6c09caba8a040c08b1960f727783209cfc60789fe2bd3fbf030d9029eb24b8ac59d65", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373022, "uuid": "c9ac27b3-7ea3-47a2-a6ab-92e5773a97ea", "value": "T1F7F4236C0FF62D5CEA2F167CA4D2A614358B2101ECE186DF37EF685DCC26041B25DAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373022, "uuid": "5188f8f4-3d2c-4f96-a461-5c64f7b22e63", "value": "12288:5x/Tf+YIO6yiM5xbwi/KuHVB0BCBtkZjGXtbIZsK4q4z7NNTH2rztrXjXvnRNjgn:5xT+iUG5DLmF65uOVnN2t7jzUSh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373022, "uuid": "912a2523-9ba7-4a25-94df-0e94cf0efa36", "value": 774813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373022, "uuid": "32fe8c8d-2e1f-41d8-8fb4-0f921a5316a5", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373022, "uuid": "e0770135-4a6e-43c9-9a1f-d0d55f7ce258", "value": "Quote_011679.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1336ee4-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373029, "uuid": "a9e26506-453b-487a-8bd7-f668d45db141", "comment": "Malware payload (AgentTesla)", "value": "2ecf54ee91a7b0cfc6c3547b9efbea9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373029, "uuid": "e600e134-b9c3-4543-8b85-3a8d53127b71", "comment": "Malware payload (AgentTesla)", "value": "4f2a4610ae993ef2bb40549d1fab210f06391cf8cc659039e4534ba2e063216e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373029, "uuid": "73d8e814-54aa-44d3-96ed-c11490a8191c", "comment": "Malware payload (AgentTesla)", "value": "aaa875664652e579286e99a4f9cf76505e066f3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373029, "uuid": "765ddf6b-860e-4487-bc2c-cbce33cad871", "comment": "Malware payload (AgentTesla)", "value": "7b72d64d4eb3ed7066c7162567ed01db23ab1d25c572843d71b91754228be07e9522e3a0e04f82f96ddc47cf9db0b3e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373029, "uuid": "7661e27a-4897-4d58-8465-92b85946362f", "value": "T1729423C654F32C539F9538D29D8B42C6753E04EB08FBDD881B1A8806E7F70B64667DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373029, "uuid": "0c157219-d186-477a-951f-4c64fd4eaaee", "value": "12288:7Uh+y6bIYxMtgWGGoxczBWROqPy4nUwpFr0Ja+Vj90+KB7:7uQM+ugWw6aDIgGj90b7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373029, "uuid": "3949cc22-95b3-4d35-a781-5bbfabc50f2c", "value": 417868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373029, "uuid": "621103b3-849c-48f8-b048-88ea908cc225", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373029, "uuid": "d16cd1f4-b499-4553-85b0-2093132659d6", "value": "RFQ_New_Order_-_57m\u00b3_LPG_SEMI_TRAILER_7_NOS.tar.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c431ccfe-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373034, "uuid": "70463f27-ff1e-4d30-a9a1-55d9c843c5b4", "comment": "Malware payload (Formbook)", "value": "bdcd5d7a60158421a3f64a2de6c8f6dc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373034, "uuid": "ea5d3e3b-6f6b-49cc-8ca0-b401cce20c5b", "comment": "Malware payload (Formbook)", "value": "4f2d5e6f2a1bedf7e9dfdf9c7d1b5fffa8e8becf30a1e4ea7e044c10e1e7288a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373034, "uuid": "f03337d9-e98d-4c11-b80a-b15dc0373211", "comment": "Malware payload (Formbook)", "value": "4bc71aa9f3cbc8b75515b65566273fcbbf8f0a7b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373034, "uuid": "0db73614-9b9a-4f12-8aa7-88fc301dfca2", "comment": "Malware payload (Formbook)", "value": "5c5876ee6085556aa3bf4432e10835097860e31e5f6a562798f98b72750dd5a5972451c9d3b0215501633db9895a6c90", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373034, "uuid": "f0c6e642-bbb0-4938-9845-48ea396f8646", "value": "T13A32C082962F9061B8C559DD186B402F57311F32B77EE3D03A5F32EFE403489F296A58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373034, "uuid": "69045d50-ec40-454c-8e2f-056f612d79df", "value": "192:O/lZs9jXqRhBQGAqmdezF44FucgtYSNkEOIQjdU7ROq/wdiHHwsehTJSwujZa5my:O/lCJ0h2ezF448ztpv2dU7RcdZXSJjQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373034, "uuid": "b3a3978b-1fcc-4f50-ba0d-0306710846d9", "value": 11448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373034, "uuid": "e914c0f1-6bdd-4e03-a5d7-4de03c10627e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373034, "uuid": "1ad29fd6-9659-4d8c-95b6-1165ed19c54a", "value": "PIRFX19X-X24XXRFQX064-C-000418.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829966c8-5516-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779369059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779369059, "uuid": "7cec4e64-ea07-4a36-989a-499c327d1403", "comment": "Malware payload (Mirai)", "value": "2edf9e5f3d7b40d1e0b09a913c2042fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779369059, "uuid": "2d124acb-aedb-4895-95b2-bce9afcfe192", "comment": "Malware payload (Mirai)", "value": "4f67bde280eaf7776ae64b6d5c176bde8d25dc563265749b7acacb980e32667d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779369059, "uuid": "7f1dc0dc-c766-4b68-bbbd-db8b8f33d157", "comment": "Malware payload (Mirai)", "value": "da9477a292bfb31796de1ccbd0bfe3281cccc877", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779369059, "uuid": "fcf361c7-3e2c-4637-b6af-846924cdd422", "comment": "Malware payload (Mirai)", "value": "5ac41c737b28229321f403c92a905cd4e66a806c7067eae254659b453b0954cfb474fad04c94b74e099938f02329e098", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779369059, "uuid": "876de767-69b7-4443-8957-8ec0d06487d3", "value": "T11433F16151AED5F9D731207FF83C82CB36E0156050E6B3830A684DE47A97EA9B87A2C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779369059, "uuid": "4f24f671-8605-4640-95fe-677a44eac55a", "value": "768:EZRrc+o9gLyqUE444ZV9RlbuzvthVMGEBunOvP1gCkuYxB6JOiMp1PgK0Abdc4gG:EZaELy93KZ7MFrP1ouQB6JOdNhGztzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779369059, "uuid": "ae86d7a3-9489-4b4c-b997-c14d94aae73c", "value": 52704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779369059, "uuid": "1e5ad8bf-67d7-4f1e-80a8-e357094e5b4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779369059, "uuid": "0848d36c-4979-42d8-bea7-aee1e2424f58", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7139bb3-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779373039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373039, "uuid": "0eccd5cb-ed85-4f7d-8377-026d53fdf6bd", "comment": "Malware payload (RemcosRAT)", "value": "1e65bfb2e3560511abaece97fb492dbe", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373039, "uuid": "f3ce8efe-7edd-4281-b179-8e7e954ee20c", "comment": "Malware payload (RemcosRAT)", "value": "4f72cf0e0b25e6ced9b8953daaba20ee0136a42bbb7a7c043cef55e8c4836452", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373039, "uuid": "e230f993-d577-4cfe-b3d2-8b89a986a9b6", "comment": "Malware payload (RemcosRAT)", "value": "622fdea750079b7b069a9ca5425c22e2848e8eed", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373039, "uuid": "3c157a71-2c52-4a28-81b7-0e17e229d093", "comment": "Malware payload (RemcosRAT)", "value": "2963ec263e04fca28d3f70e0164ddc67baffb5fb1bf9a90641695fd71bb8651754d2dee3883bae4c3ca7fcf98886da2e", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373039, "uuid": "a5a9fa95-3b1c-4f8a-90d5-62f774821c06", "value": "T12CA36579B539901AC945CFFA7EC45498D31A02D260FA3EAEF48DA1BC770264C9474E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373039, "uuid": "cda751cb-4ac5-414f-a8ce-ef9cc62f36d4", "value": "768:XChzMKHJtZV0FakVhrbDA617P0yPyPUtHw6bOjy310Y0T9ZOfX:S+KYhrzYyPgEgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373039, "uuid": "a80e555d-42b3-4e73-8838-b29f7b7b8346", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373039, "uuid": "9230b510-5b06-49b2-9a13-0df48459451a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373039, "uuid": "760f6aa1-6328-45e6-9502-5b0df5b22b4d", "value": "Q.24.35454X-XTSMX00110724402.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d08536-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779373044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373044, "uuid": "d00a4c7f-5e5c-49fb-872f-81d6082e74aa", "comment": "Malware payload (RemcosRAT)", "value": "65abfb8e9d9826013abda9cfa4c0955b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373044, "uuid": "fc7f20a8-8046-4689-af53-c6763a489418", "comment": "Malware payload (RemcosRAT)", "value": "4f79aee020df7bee4d64ecf90245a133e11af2ada8c97abef214cad1eb6797a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373044, "uuid": "46228299-3c70-4b1e-ae81-bc7bde55499e", "comment": "Malware payload (RemcosRAT)", "value": "c5e70f60b5ef43b5940ea362a4a0e9a120d77a1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373044, "uuid": "3a7a4fa3-17ea-41bb-9c70-4891183579a8", "comment": "Malware payload (RemcosRAT)", "value": "eb886341aa6da4ed3cf64b31655475754e2c436f2ac7007c8e7a36251ab1a08db79e6ce6c86ba9155462ed65634f5c5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373044, "uuid": "eb8be343-7a2b-40a8-ac40-a6e751432f56", "value": "T1B715235AF3DC9D93DB6E833FA341521441F5E04372E2D6DB1DE81DA9BCCAB40A490E86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373044, "uuid": "a2f66016-aaa3-4504-99a0-7841273cc08e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373044, "uuid": "b6619e12-cbb5-4367-b0c4-47a269613585", "value": "24576:mYnFOK7tdLREhqZ012CerBIhtyjqTfr9p:miBtPZg2NrBky2Tfr9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373044, "uuid": "9533b77c-8606-48d2-8e56-ed9e2fff19aa", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373044, "uuid": "a03a2bf8-7bb8-41ad-90fa-9d6746437ba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373044, "uuid": "1d680c2d-ceb5-40e5-9636-74b71012cced", "value": "PURCHASE_ORDER_419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7bb163-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1779373052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373052, "uuid": "72e360dc-6f33-43ed-899d-748837915c24", "comment": "Malware payload (VIPKeylogger)", "value": "175ebbfd0addfcf7ba6ee693d6b4725a", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373052, "uuid": "f24d7e25-9cdf-495c-867e-1227261521a9", "comment": "Malware payload (VIPKeylogger)", "value": "4fac0a82f59562d52b964ef719c76324216b7e7fde676aea9ce77eb72a66c5ae", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373052, "uuid": "52f8d888-0d11-4b48-9140-16d98bc40f41", "comment": "Malware payload (VIPKeylogger)", "value": "b6ed96de2724071ec53d2c46a1a1fc354e8e56c4", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373052, "uuid": "88e99045-0b08-4c38-a0a2-998fde130f06", "comment": "Malware payload (VIPKeylogger)", "value": "f7f90b8f6ef6a5d464027c1d06e7eaf5e8a911caf9f780dff879bd2a9ffcf921d69f81b8e9ceabca8a6156d5807308bd", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373052, "uuid": "1e6283ea-7bbf-44e7-aa14-2cd15b9063ad", "value": "T10115F10532799F02C4B14BF54872D1B447BAAEADA421E70A6DDE7DCB3B77B140A0274B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373052, "uuid": "b83d3115-2ced-48b3-852d-91f317fd7e73", "value": "12288:t84+jrixlaBVXReup5NWHsnLZWFfMmglYFIwv/7BWH2qwgSUI:tv+6xlajdNWHsk9MmgEbvj8GgVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373052, "uuid": "aad53ed7-8bbd-431e-9c1a-92d13826b35f", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373052, "uuid": "e99802ef-79f1-4940-b99d-165c8c80b93f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373052, "uuid": "80fac4bd-8caa-4f17-af6f-66f530b15f8d", "value": "##Swift_Copy.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e86bc9-54e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779347944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347944, "uuid": "b2192bc9-d3b2-4829-8a38-8969f520022b", "comment": "Malware payload (Mirai)", "value": "7c4c96e7499a2e451ce4d0f34736510f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347944, "uuid": "fd36215d-a98c-40bd-9974-8d3780ec078e", "comment": "Malware payload (Mirai)", "value": "4fcf278fd91fea5105c1603a7d09d1528cccb00fd07ae4ed1b029b5e2a0a7d45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347944, "uuid": "20373c4b-1c3f-4b77-b43b-1a5ff02bc737", "comment": "Malware payload (Mirai)", "value": "bdf11611cc97473f2905a53398d7db21e8adf73a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347944, "uuid": "de56aed5-340d-462d-8bd6-4cf6968cc1cc", "comment": "Malware payload (Mirai)", "value": "2a8110807966a12e672ff6d9c6f7df3248f1a89df4599bdafb73384454d99ee3fb5799e26f1a0f68accbda0b6528141b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347944, "uuid": "aff217ef-b0f5-4f1d-93f8-5fa7ed79b79f", "value": "T10083BF23DD251E98C15489B0B0F2CF762793E4E881871EB79AD5C5ADA053EDCF502BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347944, "uuid": "c9bee1fe-41b0-4a2f-937f-59d990413aa1", "value": "1536:6asuwYGtPvFwCYL5kaRc2nKCzcr77NQjlJ1Cr+cAGjMQ:6juwYGtPvFFYfRhKC07GjlJ17/ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779347944, "uuid": "a4456cfc-ab92-459f-9b7a-85e7f21bf17b", "value": 83780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779347944, "uuid": "ed72afe0-d9c6-46ca-b689-ea742069f8bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347944, "uuid": "da1886a3-b419-4de9-8226-1926e855bfdd", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d170a525-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373057, "uuid": "1947d120-b12c-4a76-8436-24da687a60ca", "comment": "Malware payload (StrelaStealer)", "value": "6cc733b47e99485283eda8d95a2edcd4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373057, "uuid": "51da00aa-5b67-4e50-8e2f-0a15c87d9539", "comment": "Malware payload (StrelaStealer)", "value": "4fdfd3543b498890ee40e1d9a3d9ea1296102974a04d2d4f2ecbd226e7648b9a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373057, "uuid": "58173377-f0cb-4add-b92e-f4ea81466b60", "comment": "Malware payload (StrelaStealer)", "value": "2b9bedc75bebbdd02dc5fe7d9594dc081f0d3094", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373057, "uuid": "1499ebd1-3206-459c-94c1-72dd74b9ef7e", "comment": "Malware payload (StrelaStealer)", "value": "4d4e22d52b2b3423b3b194572f6181850a2bd2ce7f2c9bd7501af840f1b9d3461dc4ed3abcae5334a60d5abf4b81386d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373057, "uuid": "5e878366-9b42-4770-8381-af60c18dd518", "value": "T1A9C1A8A69EDF252C4BBCCF47179A06484A95D2F72394D99DD2C8A41CADB524F32330B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373057, "uuid": "dd4634b1-756b-445d-81e4-d970e5b6ae92", "value": "96:nm3rIXV85fbHgE9+wFqEgKN5Jepul28WdQkrWdn:n4t5fbN972KN5Jepul28WdQkrWdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373057, "uuid": "07c7a90a-ee15-4c9c-ac04-ab3b4bd4ded1", "value": 5910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373057, "uuid": "fa8d0744-4011-40ab-af3d-eeef4922e783", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373057, "uuid": "3ad8d746-3937-409b-b2b2-ec34a4dc0d4c", "value": "20575186242786811325.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41e4050-551f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373061, "uuid": "5794584b-ead8-407e-a71d-b9514b50677f", "comment": "Malware payload", "value": "932d2b72c4281383affd96218e4d28c2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373061, "uuid": "3df6411f-b8a6-4018-bfff-51289531e275", "comment": "Malware payload", "value": "5004304491fcef92354d9c0258cb47b3f257f429caaa4633ffea6f9b8d8cb2b3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373061, "uuid": "9d1a270b-f501-4564-916c-70c2ca760a22", "comment": "Malware payload", "value": "164fd887433982bba42763692cd3c8ce60a31aa5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373061, "uuid": "7c557cf7-5768-418a-a204-c1c15d71f3c8", "comment": "Malware payload", "value": "421a1539de2a9ad1d0f30b96ab4ac941466409a5f5948ee8ea0f0d4436fd987a1c516cb8156099d456a36a5e01c4ca9d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373061, "uuid": "802381ba-c585-4991-893e-32b3f8516811", "value": "T197A3025A1A364DEEEC4928F5DDACDD71C920382A963DC708C421C2B52BDA27F65C50BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373061, "uuid": "b37b637b-6456-4d08-98cf-14da1fbbb2f5", "value": "1536:DmW/ibpZxUaH43rimssd1KRsjY2ssI7zdnoPOOgGjN57QOEQKF0etq6s8FXB8ea9:DnKVolimsPm7GzRSOOJuT85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373061, "uuid": "0379841e-cf18-4b15-8108-e139f31cb390", "value": 100323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373061, "uuid": "86e5672b-c9d1-4c7a-bad5-ed30ab87f8ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373061, "uuid": "7e8efb76-7a0a-49ad-a2a2-658f0d93917a", "value": "CTMXUSD70kXSwiftXCopy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9026e71-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373069, "uuid": "1c218cd3-b9c2-4fac-87f1-4abd22c7c1d0", "comment": "Malware payload (Formbook)", "value": "95e2da3e16bf0d1665190d02e6bb1696", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373069, "uuid": "3bda386e-4422-4651-bfa0-8ea1f00e616e", "comment": "Malware payload (Formbook)", "value": "506badf6ec405e758294c77bf56a6d02027d7f774801b1ab847b89ec1217aa7c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373069, "uuid": "3e9477a3-8801-4806-b9d5-b3e30f784ae7", "comment": "Malware payload (Formbook)", "value": "e06dd85efdd192a2e5f2829e4bbcba1d5f7b6904", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373069, "uuid": "6d631250-51c6-49ec-b36b-1e20c54faf2e", "comment": "Malware payload (Formbook)", "value": "8ede7e8af4dc6aca2f124986252c96960376c43431c08ab6a4f4ea0c323d56e1f19de7749b0f265b1eb42785d0cf2c62", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373069, "uuid": "bb0bb818-4a59-4f16-976d-db45e53787e0", "value": "T183053361E99F335460A7F44D8E850C9E05EA630C2BE84AE146C77097039CEED9BFCA75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373069, "uuid": "e93dd20d-d184-4bdd-9319-ca143743774f", "value": "24576:uhR8QsCtiwNufsq3QiG0O5KsBPm81sNwEkT+JeHfVvJEA:lzAiGL5KsBOaTEkSJufIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373069, "uuid": "d69f723e-1b9f-4ebf-91bb-6cad057da9c5", "value": 850415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373069, "uuid": "3ab2de9a-03db-4c93-aea6-5ac3f069b68b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373069, "uuid": "609013aa-8f4f-447b-9aa3-98f0906e408b", "value": "New_requests-_124.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3d0e67-551f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373073, "uuid": "b6a0d32c-ba4f-4f20-8882-c290d0910e4d", "comment": "Malware payload", "value": "ff707ba5d0fd4e73e3ad5b1e6157dccd", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373073, "uuid": "b7db9705-40c7-47bb-ac56-3b5a9ef68fdb", "comment": "Malware payload", "value": "509090e9d5e98b9445ee3783c37cd5e59cecdc92e683e2329627cbc29ca73ccd", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373073, "uuid": "a61988e3-51c0-4a08-aa5b-afe051497f2c", "comment": "Malware payload", "value": "a72e59704058c54d930cf7cae234d1b5509466ae", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373073, "uuid": "3600fd0d-20fb-446d-94d0-dd34b86712f8", "comment": "Malware payload", "value": "9ea765f5d6bec042c07abea4e3f161dd4f1afd22517f862f2485cac9f9c4d82d5af17283044989ce8a44ab0b6be3eb23", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373073, "uuid": "e6bf9afc-99bb-4518-b7c3-290d79c7ec06", "value": "T184625C35F586354B2D83419BF40213E3DA6DE0345B0B5260A4DEC35DBA8F06D966EA3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373073, "uuid": "24c7c610-aa43-4c48-abe7-97d5be331ccb", "value": "384:+gpLVBoQu4HWrfCHfAzpddhddn7a8JetVZB+Ml:Dtu4HW5zpddhddnLeFsMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373073, "uuid": "892a7102-5ce2-442d-aa0e-78b016a165f4", "value": 15180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373073, "uuid": "afb14bf5-5bdd-40ed-9c85-f2d862eea5ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373073, "uuid": "687f2fea-350a-423f-90b6-3deb95cac728", "value": "2950428276197768463.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959badd7-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370809, "uuid": "9ef37171-3c16-482e-a517-6bbe738480e2", "comment": "Malware payload (StrelaStealer)", "value": "875db9c40832706036f3c137b6385022", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370809, "uuid": "66eec4e0-41ea-4fe7-b3fa-81ebc549a460", "comment": "Malware payload (StrelaStealer)", "value": "5107ca41f278b95d129ed4a39b3e07f03e3c9a0270f8e207308a5ff3782ecf51", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370809, "uuid": "6d9cff95-7d6d-4283-8824-390bbf72b0f9", "comment": "Malware payload (StrelaStealer)", "value": "2260bec08535ef4005abbe58679b4ffe0befb4c9", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370809, "uuid": "638d5ea1-e4c7-4fa9-aa6a-d3dce8fa1cf7", "comment": "Malware payload (StrelaStealer)", "value": "7665f086b87c15d79d1db75269962f7457be1577fa65b63cefa301d5439542870643c67440b0bf441a9bbd61a3315ba3", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370809, "uuid": "526ec170-c14f-4036-9274-5ba2147d3d69", "value": "T17A31C3AC91E8AD90D57DD2B863A00FA7E0D0F761A01DC1A3803E95805EB197FDF13C8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370809, "uuid": "6b793124-09f7-4de4-bff7-5e7e80428c39", "value": "48:9agjvHtKh6P/Iny5qAJauteolX1PODG1wPZiTQn6CK:4WEOgy42teYYsqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370809, "uuid": "3d03a4c2-cec6-4593-bbcb-4ae2984fba34", "value": 1619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370809, "uuid": "dd96aa67-a9a6-4ecd-a73e-ea6a29d4dfc5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370809, "uuid": "15851551-4937-433b-87fc-9b91204f3b23", "value": "Honorar_AM32024111904030_Waldhauser.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c90f70-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370812, "uuid": "811c1928-fcfb-4eb4-bac3-5941021a31dd", "comment": "Malware payload (StrelaStealer)", "value": "abe261b040104d5f8fe6e2c34338084b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370812, "uuid": "df712a2f-758c-4559-9e71-32aa3d1b1bd1", "comment": "Malware payload (StrelaStealer)", "value": "510e3783e11d0e44604325bd8c8f2351a0a6a8025af2dd608e1c7a60b59a6b54", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370812, "uuid": "f1e04e13-4042-41fe-af84-9de3f3a9fcae", "comment": "Malware payload (StrelaStealer)", "value": "548184f43cd65251667ac5c62746ce81cccb6f49", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370812, "uuid": "1b5ab1f3-8eef-46a0-a031-fc245c6500c6", "comment": "Malware payload (StrelaStealer)", "value": "4e4d21a3409a5d02e0c9fce782700e3afd8734931a5add25894a4d03b5197b5b5d757c1b681ee007368085d364618249", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370812, "uuid": "cc41fb0f-7619-4f09-bf0e-967980168df4", "value": "T1EE54469FEB336EF316E1B19B33521C9A4D4D58D9043D53368F68880E982135FA39E369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370812, "uuid": "c0a38828-43ac-44ef-bd81-980bce1e51a2", "value": "384:etiTBtEU0ZK9eX3rxRLkLQCDYpFNhDR/FeKG1gOxvBcBjUvmHwyFT5MViRAgyH/x:etijE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370812, "uuid": "ede7b482-7caf-4670-8f3b-f15bd7fb5ae7", "value": 296791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370812, "uuid": "12cf4c66-b530-49c4-aaeb-24eaf09375a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370812, "uuid": "af0f3644-612b-4496-8b76-ca59eef30d65", "value": "673523447326617451.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb70eb6-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1779373077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373077, "uuid": "c27ad127-ddd2-4ff0-b8c7-0aa98e175da5", "comment": "Malware payload (RedLineStealer)", "value": "5e313568e103d97c167dd55a3647a88e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373077, "uuid": "12fb5f59-3c5d-4d8a-ab83-66687de68eed", "comment": "Malware payload (RedLineStealer)", "value": "51153f65c2bb9f656f351159660ad8699f8dbf9a4bd16cf19c3d06e846e2f2d3", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373077, "uuid": "2d60f235-c83d-4611-b4c2-ba0df551bed9", "comment": "Malware payload (RedLineStealer)", "value": "7df3fc1d7c0f520bf501ffa7b991535debf248df", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373077, "uuid": "79ea5b70-a25e-4b06-bd9c-02fda4ac79ef", "comment": "Malware payload (RedLineStealer)", "value": "786683045f56e5904960c439cb82f8f5728b5dda17369e74eb4c071c174f35eddd3b102acc244d4e549735818a407ccd", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373077, "uuid": "fbf9dace-4562-489b-a320-cd9ebdf28656", "value": "T1DC2533BE929E1EB814145EF942CF4A7DE8E8C7B1161AE3E1B8387F5B1084D4D4B6318D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373077, "uuid": "eda231ef-4928-4977-b6d9-f01656bf2862", "value": "24576:DU+Q7KyXetgm08epTQbXWmCc5hAq4fpBM5+7Y1MhenVw:DU197pTcCc3Aqw66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373077, "uuid": "c24fad1a-d5ed-43e3-823d-caffbbc85842", "value": 968781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373077, "uuid": "bb145151-ca94-4358-9ff9-518cfe3e5941", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373077, "uuid": "6bda2201-9fb8-4965-91da-7d316f1fd7ab", "value": "QuoteX20240533-REV2.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e050b585-551f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373082, "uuid": "5e3f0e31-b59d-4833-9cd0-809b4029d783", "comment": "Malware payload", "value": "bdd16443cecc91b8ba355cfc78e74740", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373082, "uuid": "1f6c0771-464b-4f7c-8b78-813b0734de70", "comment": "Malware payload", "value": "51500e40881f7a9c6c0a556af80e9c93d35dd0f08472dafa3bf8ce899769f0c8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373082, "uuid": "61c6775a-f891-4dd6-a6a2-576dc9a89234", "comment": "Malware payload", "value": "91a6288997fc71c5e6e8e4f177a8e732b66c0322", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373082, "uuid": "58c83e07-be7b-4365-8ad2-d13e3635ec51", "comment": "Malware payload", "value": "ce31039c21a67d33630747cf0761db0bd222c1e6f5381b845ed9e3ce5635573193ef31a2f63aa6d6613f3979f2164f6a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373082, "uuid": "5dc05a69-e3bd-4561-a18f-84bbbc5b5b80", "value": "T17AB53329BFBABEAE072C933F709F0C2917E10FDA418DD1F717B919E9450E6418607A58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373082, "uuid": "33946a5e-720d-4bc0-b268-ee1a46b5084a", "value": "49152:gjHQtDgQsChTvU2W0Fa+lV4svZhhDQ1ukDDBE+NS/:gU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373082, "uuid": "4889bd54-5914-4832-8f7d-214572fed186", "value": 2441640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373082, "uuid": "e1dcd53a-d3cb-4f7d-bd4a-4467a5476ac1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373082, "uuid": "d3eef550-4d57-44c2-a219-34e3182d6e52", "value": "Arrival_Notice_Invoice_for_Container_No_FBLU0089027.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f9254f-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370816, "uuid": "f02e5cd8-86a7-4540-8fba-938622897e38", "comment": "Malware payload (StrelaStealer)", "value": "e5badde0a13dd169483bf4bcb9352535", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370816, "uuid": "ff88b92a-be3a-4287-bc04-a00d36623910", "comment": "Malware payload (StrelaStealer)", "value": "51917c27eca549f3c2489157ac7ebaebf88911593fc2e0cdbca8f9559f746fd1", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370816, "uuid": "f71dc905-dbf3-42f8-a995-cc3eb384693c", "comment": "Malware payload (StrelaStealer)", "value": "45155b26205d2c1b76ba62908805924ee9e16f06", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370816, "uuid": "9b45b779-e7e9-4d10-bed4-d3b350a1fb8a", "comment": "Malware payload (StrelaStealer)", "value": "4cbf898617da2aa9ae5dc8c780845e0e6d3ff8033a1256286192b5ce27d8de38301c4107b682805c501c4f841c6b0d9d", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370816, "uuid": "263a5d56-6f6f-4f11-94b7-029ad6020c86", "value": "T1B982D1D8B7965A45CC0AC2E6CC1754B1D383AD38508416B7A8FC2DBF96C657543BB0D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370816, "uuid": "9173ef8e-52b3-4c22-bfa4-78d2d45230cc", "value": "384:s6/GY8UGj1pc0owfm+gKYJcpRVD3AXrRvS8kIKI+X2q+FV7QCr:s6nY1pLPY+RVMXjtK5uQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370816, "uuid": "b39c8451-ecfa-4f72-bfa7-6490e24eff23", "value": 18598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370816, "uuid": "dfafba22-19b5-44a7-9505-7e47d4fc9063", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370816, "uuid": "9c76eb96-ab6d-40f9-b345-4da88ec7390c", "value": "RE_936.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c18e662-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370820, "uuid": "a5ae5b0a-75b0-478e-a499-f171e67c44d7", "comment": "Malware payload (StrelaStealer)", "value": "a0f6536e35cb4afa6585c5272270ce3d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370820, "uuid": "cc75b166-7b75-413b-b90c-f7e7756a7968", "comment": "Malware payload (StrelaStealer)", "value": "520e5582a245f8e5e80e963138c787eae07969686c7ac9f90a15ffbb08122257", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370820, "uuid": "8708b860-d6de-4123-b74d-e67ed5f40c98", "comment": "Malware payload (StrelaStealer)", "value": "000ebf20b4f53bd82ebf51072556f60b79e38cf4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370820, "uuid": "b5a556d7-a231-4843-a969-b25cb4a31826", "comment": "Malware payload (StrelaStealer)", "value": "e8e25aad8b7012e2e35de89d5797a6bd505328c36eab8b1da6425c7a64d541bb8aa35dd8710275c74a2400fce38cfaf7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370820, "uuid": "53ac6be8-4b35-4e66-9bee-039b4171d69d", "value": "T123F429F8AD9C020B1749871A991E27D6FFED9A178E1008D113E7F57ED0266E4EA037B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370820, "uuid": "6f8c10ab-13d0-4d43-a8b0-8a55406e4db8", "value": "6144:PHWVIvBEY4DAOt6UvGKZ1gaCGiVlBDK+e6y5tyLpoDDK+e6y5tyHpal2ejtRW:eVIZE7AG4BNBDKey5gLpoDDKey5gHo3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370820, "uuid": "cfdc0d20-8e64-4ffa-8e16-a12ccb4db7f1", "value": 776515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370820, "uuid": "9b43501f-7841-45ab-9c89-16ba834823d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370820, "uuid": "5c83f7df-83bf-49a1-9848-44d8efc28cf1", "value": "209294069990332158.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e650c81f-551f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373092, "uuid": "2da99125-483a-407d-af59-10663b7b6596", "comment": "Malware payload", "value": "d8a92d08d75ffaaba7f48b09c54e1e6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373092, "uuid": "afb08568-7b9f-4522-a943-927de450c4cf", "comment": "Malware payload", "value": "5212423bac835b8c3268e4cf2b195043bdcd403e7d98f9182830098585ef2d1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373092, "uuid": "5742db54-d4cb-4f79-9849-268f91dd4779", "comment": "Malware payload", "value": "cb7b089837158e24c3e03e2db13358103de5a2bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373092, "uuid": "0090c498-e742-48dd-be99-cba30b58c241", "comment": "Malware payload", "value": "c73ceeeee0e12f7ca0afeb4be867d272461e7f24d05d8602d94279d24b66530fc49bc37136557b37f0a7c3fa13d418bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373092, "uuid": "55ac93e4-b5cb-4a3b-93c3-ca89b026fe6d", "value": "T1A2D4F185AE009B4BC4216B7A8469F37A07BA89853622DB02DCF0FD7BBD15707FE161D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373092, "uuid": "23cab83b-cf45-4292-8735-b13d6de83a57", "value": "f677acae05efabe7411a40902b2d88fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373092, "uuid": "1adf6507-d903-456b-897e-0209a19f41be", "value": "12288:ovxwRbB0H5KUjUPKCuO+ggobwxFga+YzOxLVw5:ovx6bB0ZqAHgDSFLqxLV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373092, "uuid": "334f0bb7-529f-4841-b52d-d9bfc723154d", "value": 649992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373092, "uuid": "506a1843-2744-4268-9686-87d973e244e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373092, "uuid": "3d798d82-d61c-47e2-bc3c-75e02550de93", "value": "PI_24000032.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cee643-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779373096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373096, "uuid": "11b1d2e4-40b8-45de-834e-721bd706c0b3", "comment": "Malware payload (MassLogger)", "value": "5066e1ca914f9551e154b86ee8be03b2", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373096, "uuid": "8357ef4b-c549-4212-867e-a72503db836a", "comment": "Malware payload (MassLogger)", "value": "522429536754adb5f9b93443552396aaff43aa753352796601d324f1887da31d", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373096, "uuid": "6755c19e-5b43-4163-8256-4908b9df642a", "comment": "Malware payload (MassLogger)", "value": "8c0742ed33997f3234c1f34a2f53df53efc59c39", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373096, "uuid": "13d1fdb0-3dae-4a73-b18c-2ea49e961c34", "comment": "Malware payload (MassLogger)", "value": "65039f43c71d6e2a9ff96488997a97c9d79cc541d111a1d8769c58c59a3fd2c885fb42caef7e22d58560b351efcd589f", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373096, "uuid": "31524f8b-00fc-4ee9-b17a-b9f3e5203dc1", "value": "T10A1533A55EC915819C15FAF37A22CA29BFA54CE9C09DB1F3771BD1B254260CB88E3730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373096, "uuid": "396b4605-12fa-49a9-acc7-fef2d13979c3", "value": "24576:tSR0LD4tJiCdnoER0QJm6EoBJawjgaxaC0MC:tSR0LDcTdHR0D07baC01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373096, "uuid": "1f17dba2-efbf-4958-b0e5-5773a12554e8", "value": 935383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373096, "uuid": "c0141264-293e-4248-ac98-380b004e718c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373096, "uuid": "5d61b56b-7d37-4962-899e-f8f973e07b65", "value": "PDFXEGYTVRXGROUPRFQ#2126183FOB.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4c9008-551a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779370823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370823, "uuid": "5e8858a2-f1c8-4136-ac8a-06dcba5d1034", "comment": "Malware payload", "value": "76457efe83d0ddd2cd589573fc8a98cd", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370823, "uuid": "15bd26a6-86a7-4ff6-b7f1-979072306d5e", "comment": "Malware payload", "value": "524f1c30cd4fd5b120c94556c8d820270f4b05316338df2c80be43e989f8f5de", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370823, "uuid": "3522b222-4790-4591-b2c2-23e8d7cbb477", "comment": "Malware payload", "value": "a75e9e30ab0760633def9b4bfbef46ebad05aed4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370823, "uuid": "68b687b6-0db0-434b-bf61-d000950c93a3", "comment": "Malware payload", "value": "ef5a2c5d9f4d0b685013dcfdf9973a55b77e2aa7455e9d991af9aa1046e1dd8bac94d6d8400c1dca894af1069da780bb", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370823, "uuid": "149c66f1-ab77-4244-924d-40101ce1d53e", "value": "T1542533C37A4F0CE8C90778CACAED8469B263C677DBD346B57143D24BA2B58D2441978E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370823, "uuid": "3205ebf1-352c-4057-9746-37f271214697", "value": "24576:xGZXZrCXSdlEHpVP6/3+59+ajHdxYFcCaT8q:YXZUekLSo3jHrWcCaTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370823, "uuid": "7cd9b419-01de-48ff-9c34-95e94ed7d86b", "value": 1030094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370823, "uuid": "4914ffa8-8705-4bdc-b5eb-717ff7b74641", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370823, "uuid": "4cf6138b-35ff-44f0-9cc3-41348e1aff9f", "value": "Anfrage24438.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb76a55c-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779373100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373100, "uuid": "116c66db-5101-4f29-a8af-7e415aec16b0", "comment": "Malware payload (SnakeKeylogger)", "value": "3a330e771f19211b369b96bf723b1b83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373100, "uuid": "9add681b-93ee-4bf4-a319-f8ec773e54e0", "comment": "Malware payload (SnakeKeylogger)", "value": "529fa4957fea8e29e7f990cb261dbe876040b5c30ffb4b9d58288d146e67dfb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373100, "uuid": "b7abad83-5235-44b4-97d9-08a911913b85", "comment": "Malware payload (SnakeKeylogger)", "value": "d36695641a42eae9dc633c0d1afbb87099432bea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373100, "uuid": "547a3f52-c781-42aa-8df4-25d4d4e0426e", "comment": "Malware payload (SnakeKeylogger)", "value": "2fd56c6f1e1dfb185c7e2f1d665b032ac996b470a0106256a9a15628e7c924d907e4b31547805f70348dc1f3c4b7ebf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373100, "uuid": "d2281221-a908-47f8-97ff-5adbd44493f0", "value": "T105F4F1946AFB6F6ADAFD47F754622C0403B2650A6831F39F1FC524C72D26BC08946B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373100, "uuid": "7c051255-f91b-425c-a713-beeaea7e5a13", "value": "12288:5gAeZL2K0IlOBWhpzJ7r6OEuTep6U8afw5rv/r0Xx2cmyZHXY14jv8M4Ww4oab:2/NkBYhpzIvuNmoL0kcmp14jUAhHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373100, "uuid": "6c1c4b7c-75f6-406e-8d2f-85b8bae37c9c", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373100, "uuid": "7eaeba31-1a98-46c9-957a-7a90021811c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373100, "uuid": "2164b12f-de15-4431-b8f7-7069aed3ce3f", "value": "PO.366786-K0001388089465.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee24b7ce-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373105, "uuid": "fdbeb620-ff0b-448c-8324-58cfd38cf45a", "comment": "Malware payload (StrelaStealer)", "value": "29e1c7a38d6040b4dc6e4d52439bcdfa", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373105, "uuid": "7c62ee4d-c02b-4723-b997-7625e4915975", "comment": "Malware payload (StrelaStealer)", "value": "532769bd3042dd5336938a48e6a4dab1a15163bb4a8e9cc5c91cac37e7e7a8dd", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373105, "uuid": "218879ca-9311-4ce5-85cd-6fa9b12334f3", "comment": "Malware payload (StrelaStealer)", "value": "9604826d3a8587e5d9f414c600de77bafe3d130c", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373105, "uuid": "2e9b93cb-d569-4e63-9b61-797f3f4ffb2a", "comment": "Malware payload (StrelaStealer)", "value": "52b1eb2a2fb463d68888da0fba335bbe02697b38fcb0359d602b2e6a6df37f135f0106653b45a29ef97a602356585eaa", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373105, "uuid": "8e539644-e265-497c-b93d-c48db43a7e96", "value": "T136116864EB8E4221D43B13B61DEB99B38041D1174A316E87E274E61938D2895D50DBCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373105, "uuid": "62a63fd6-3d0b-445b-825a-1f4f56017a48", "value": "24:9D9fWjV2/pbXwtodE5TktXO5lmeQpA5Gzynbfcr2vEO:9Dwp2pqH5TsXmlm7puG7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373105, "uuid": "d30e3d1a-dbbb-4f88-a97a-c424057bdd6b", "value": 1036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373105, "uuid": "29be0211-f9b0-42d9-bc28-29bb59ae4aa5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373105, "uuid": "50eff22b-9924-451c-a28b-a972e56a4800", "value": "13179888.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f152e04f-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373110, "uuid": "679cd36b-cdae-4d0c-9fd3-0796f930341b", "comment": "Malware payload (AgentTesla)", "value": "c956b7f12cb7ae6353fa2986a1387158", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373110, "uuid": "f05ed5ed-6264-410e-8a6f-a2cd924adb43", "comment": "Malware payload (AgentTesla)", "value": "5335da6d96c3dbf74623c5ec6374b8bd7b95966e3a40a4d37347984a7c17d029", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373110, "uuid": "fe62de89-9a94-433f-a9c4-139564fa218b", "comment": "Malware payload (AgentTesla)", "value": "7fe7e83f0a47c072d1e581c4a7154b25c42129e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373110, "uuid": "c2d2a88e-67c1-4fb3-bc1f-7d7fa7836cb9", "comment": "Malware payload (AgentTesla)", "value": "70c1a3204383c25e775614a43a727b531f28dd6b3130dc865da88837602f583802c87777611a27bd85c3cf8c98c871e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373110, "uuid": "e501ebcd-5e0e-4efc-a1de-f009b32a3d72", "value": "T1A4E412517178CE27C6BC4BF5142604A19BB8AB6E7682D7CD5EC638DC19E2BC24708BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373110, "uuid": "e983c06c-f27c-4cd4-8da0-d77162ef3269", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373110, "uuid": "8c5f7b83-d6a5-4672-8d56-4dc267444697", "value": "12288:+mp6d74dwmC/YPwaZBSv9tdaCiBTiwQbpvAd3hroUw7p9882wUOZjn8H7+SINr7D:SxeTiBbJku9GBwTtCPQ/mqod+PNGQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373110, "uuid": "6563d11b-2945-4728-84fd-edc36daa79c3", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373110, "uuid": "43b76f83-9a45-4283-84ea-e1e30322ae53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373110, "uuid": "1a20d727-0ee3-4491-8881-93cc92522b1b", "value": "QUOTE-2K840322-A-CCC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d03256-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373124, "uuid": "d0381b82-ed9e-4531-8652-c696022b3472", "comment": "Malware payload (StrelaStealer)", "value": "cd02ac96ee82f2d5463dbf483e1a726e", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373124, "uuid": "98d17c3c-f53a-4458-bbf8-680c7781a364", "comment": "Malware payload (StrelaStealer)", "value": "53ca9470ed3a1ba644c9d6bdef59a5ceed0f720cc7f87b8ea4e8a77cf00ac548", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373124, "uuid": "98031cd5-60dc-418e-a14c-b78a20b31075", "comment": "Malware payload (StrelaStealer)", "value": "dae9d9d373409b4758ada9394b3d58657ea43502", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373124, "uuid": "bb201b9d-d4b7-4b5c-bbf0-fb72bae3044c", "comment": "Malware payload (StrelaStealer)", "value": "efc601f6126f8f90d0ccf171a281a81fcd4cd4fa24cc4da19bc870ed3d553157f7290bd7aafd1b7a369cfa4da6b0c21f", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373124, "uuid": "081e38fe-5666-41c2-b059-1ecfe7bc838e", "value": "T1AA312B87E311D86EE808CF7B32AFAF054CE023674586C865C9513E152C03010C656E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373124, "uuid": "30caf3e2-23d2-4ee7-917a-be8442590e84", "value": "48:9TwCzEBnSzBeZRZ57l4OJeCGahNzQxL0dwkcF7yx3bM0iLfYIMIsi8f:xzEBSkZRXXJ6a7zW6PaeZLrIMI1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373124, "uuid": "399b8b24-79be-48c6-b7b0-50637b3d72ff", "value": 1858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373124, "uuid": "87a2bbfc-87c6-4bc1-b050-6174b71e1465", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373124, "uuid": "47758284-c536-4af2-a627-2148243d0e72", "value": "1542615.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bb4c18-555f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779400474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400474, "uuid": "133a0d0d-4916-40a1-b33e-7178a355f2c6", "comment": "Malware payload", "value": "6f762b2e18382c6f690ffe7cf80bbcb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400474, "uuid": "75efbf33-5dd2-4f83-99e7-8ebd06cec690", "comment": "Malware payload", "value": "53f78f420d4b8f7526b1008b7c7c1519fba37a485e4c8ea74df441b116be26fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400474, "uuid": "c968af4c-d20b-4b45-96c4-967106d5604d", "comment": "Malware payload", "value": "c9ad3c7cec9d7166c5cdd7d55be8d245ce509f16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400474, "uuid": "d308e27a-2039-4232-b8d1-a60ed3f6adc4", "comment": "Malware payload", "value": "2413f2e2e449aa2c14388f1652e71bc61fa9f65bced00e59fc34a3efa2db4f648dc89af2f86fe3bff325c17d469536cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400474, "uuid": "baa2e55f-140e-439d-b211-84562833a993", "value": "T10A35E10EBB441F9EC45DCF30817EC7178329554B86F26A25BA3886407A5E3DA2F27D5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400474, "uuid": "43c1fcc0-bf20-42ef-90e1-880d50e665fe", "value": "24576:L7jfpEwJak0aBrGpcxa8S5awCcmHP/h5in5QFC9Gd:mU1T1GpcgQcqpGqGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779400474, "uuid": "4a1239a0-c412-4136-b7c9-38c215179ad1", "value": 1076689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779400474, "uuid": "084c5ab6-21b8-4959-aa43-98eab301323b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400474, "uuid": "355fa5f9-7eb5-40a3-a71c-011fd081b53a", "value": "edykljw.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ad025c-5514-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779368173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368173, "uuid": "7e5586f3-5145-48b0-ba6c-a9fb0fe5daa8", "comment": "Malware payload", "value": "c95ce12ffb35906b0184f6316a0815c0", "object_relation": "md5", "Tag": [ { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368173, "uuid": "b5e0985b-6519-4fb9-9ecb-296f884fdd44", "comment": "Malware payload", "value": "53fbf1dc66e0c562a0e596d62568902148074fdbfe7d582c435360ff7fa54b1a", "object_relation": "sha256", "Tag": [ { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368173, "uuid": "4a6814c0-9d35-47c1-8fcd-79f9c2d79da4", "comment": "Malware payload", "value": "cb551a4ba77bfd7a1aa3bb5b7eea4e36e17c212e", "object_relation": "sha1", "Tag": [ { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368173, "uuid": "0e6c1577-122f-49ab-ad2e-4f19850277df", "comment": "Malware payload", "value": "69e99969595d59a13cb2ebf809964e69b5dd4c3de1f57b8d73380b500b93471ba1833c005ad21bb97edf408f09cfc9aa", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368173, "uuid": "4de6a2fc-8957-430e-98e6-e15fc296e2bc", "value": "T13972C4C87FD2F2F5127364732D5BA05EF76A6841F55CA184E235E6A0F960318E1B2878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368173, "uuid": "c5543230-96b2-4753-b68d-a10dff6a148a", "value": "192:uX7fgQmHc8141UhpLMqqKOtX8MLgTRmxfut65l8CpIn5K:K7fgQmHV1488Fs/RmfJD8CpIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779368173, "uuid": "e3d7a2ff-8b3d-4de6-83f2-ceaf4d743602", "value": 16724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779368173, "uuid": "488919c7-6c90-4fd7-9500-35403dbfed87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368173, "uuid": "bcdc5510-b027-400c-9247-46b207f895aa", "value": "53fbf1dc66e0c562a0e596d62568902148074fdbfe7d582c435360ff7fa54b1a.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e8f10b-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370829, "uuid": "01afdc52-4bd2-4190-9437-e6400bfa4f94", "comment": "Malware payload (StrelaStealer)", "value": "77b75a9c5632f19a02e61513a200a29f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370829, "uuid": "8c953079-569d-4f11-85f0-72fde249c083", "comment": "Malware payload (StrelaStealer)", "value": "540ecc9f32a461975c1b6fced6a3e7d3e9d302f7738ab1270293c68896dc7cbc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370829, "uuid": "90cfc3da-890e-419e-a8fc-a882e0885840", "comment": "Malware payload (StrelaStealer)", "value": "c169be8f25f5510a5f401d6016ca075798d2f4c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370829, "uuid": "af204085-0c00-4721-858c-c58f09e3a34f", "comment": "Malware payload (StrelaStealer)", "value": "a4e89cf3091655aac7340f407e26ec15a26e3fefe072115dd19cc092d6511d5d54460d304499f9d09b3442cb63cf10c9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370829, "uuid": "4890038a-06cd-49a6-9d83-50b4e78ab33f", "value": "T1A483D1D025169F9E8E9D3884F3C4622D5208DEE685F2539F3359F114CE1BA4BA7DCA38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370829, "uuid": "c9c22079-a2a3-4a09-81e5-2179ca3d34f0", "value": "1536:5XhETa/k6xFEPS1wKhzntnY1w3gheT+evLghRc11peyX1De61AdY7ydUcdt3LGyQ:8VXty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370829, "uuid": "dbb417f1-bfff-41e5-b19e-bc75519a07c0", "value": 83613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370829, "uuid": "2c36b509-9bf7-4ea6-84db-e3640e416a77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370829, "uuid": "197a0c56-b3a0-4902-8d22-94c0711e79ab", "value": "4836178251348130277.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c587550a-551d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779372178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372178, "uuid": "255d95c3-1151-4a79-af91-dbb91bea0ea1", "comment": "Malware payload", "value": "39e2621f184b5eacbfa7dfc9577cde79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372178, "uuid": "eca553aa-36b6-41f6-b1fd-ddeb86f46883", "comment": "Malware payload", "value": "545910e1e32aa54fa35baecea2cbe4d4b7433531bbc7d30962888ca4485b5159", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372178, "uuid": "54611c37-9144-4bcb-9c06-c8fc2bc37b2d", "comment": "Malware payload", "value": "6fecb8e80563fed31176586cae6707f4248d28dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372178, "uuid": "d709d4a0-9ae7-41e0-bb3c-21538929a8b7", "comment": "Malware payload", "value": "63edd71684f89057d0e1f40897c917afa669cb02b8b27bf794ce948c5fe75cbc21cc4a9f5c1b6bb8888c13c89661c82d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372178, "uuid": "b65f7831-7e41-41ef-88d1-c65659db5b49", "value": "T1BDA423A10C305482DCBB493A66EF255554E6BEB4CF1CF2012922AC797F667C2D64F8F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372178, "uuid": "b0265093-aa9f-43c4-909f-532264f69677", "value": "12288:aejIro9698mOhbGFWoJWdB4QN/42HTp8mFCmGYr:5IrSo8lbGgoJWdBfZlTp8hz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372178, "uuid": "862de08b-4f09-494f-b885-281d84190413", "value": 476260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372178, "uuid": "53e9ce16-22b4-42d0-9578-ecc8ad1ebe6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372178, "uuid": "4b7ee4be-8778-4649-8027-ccce9bab1082", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc39b870-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373128, "uuid": "ebe12a81-6800-4bdd-bdd9-a9f34c8e495e", "comment": "Malware payload (Formbook)", "value": "f697a26a25ced556ddda3402f80858bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373128, "uuid": "01bb2623-72fa-4a00-a0da-3e6f6cb34f19", "comment": "Malware payload (Formbook)", "value": "549569602f3994b3b7058689b193a28d568cff27d4bbdfcfd527c36890579884", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373128, "uuid": "6fa8746b-853d-46b5-9f1b-c0822839cc64", "comment": "Malware payload (Formbook)", "value": "3c46bfef1633eb7105fcb34c493c99a48c400d40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373128, "uuid": "15b93670-f546-44e5-b562-040a9d9e138d", "comment": "Malware payload (Formbook)", "value": "dcc3bc983a52eb0ea5580a1094527a40622233df80fa0c09e8aab87d5d4f622411af686362617a22adac8acb5c89608e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373128, "uuid": "da0c56b4-0775-4278-84d0-76b6fd7da380", "value": "T17B052391379CEB14C97DA3F5052020459BB1173E8D82E12498DB60DEADF6F81CD66B8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373128, "uuid": "59fbd4d4-8eb7-49fa-8acc-3ab5c23280ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373128, "uuid": "f0918915-68ab-4e94-bd58-29a7f8964f99", "value": "12288:t2bY22o+3MQi1qaXu+ETZ+oApBmWSvuvjrydLzIsG8g0Ip7SMhpl:toY2Cch1qaXu5Z9ApBpjwLsAgrp7Npl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373128, "uuid": "ab41046e-2ff9-4a5e-adfe-3bf14387253f", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373128, "uuid": "9970488a-ed57-40e6-97a9-baf80ec1ec8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373128, "uuid": "e532755b-20d1-4c4a-b16f-a488514c0168", "value": "CV_Forner_Eugenia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb430b5-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373133, "uuid": "4c6799be-2367-47b7-bcfe-3d6a228945f6", "comment": "Malware payload (AgentTesla)", "value": "ed23599f6503c2cec147efd63d361293", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373133, "uuid": "5147a53d-dd26-4d70-afa0-f807c6bd7c9d", "comment": "Malware payload (AgentTesla)", "value": "54ad2eac7f23adb2cd0e9c6f287268a66679e3c3e18009d5b59dcb3485a19fc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373133, "uuid": "20e6efbe-524a-41a9-afa5-fb6e053303c3", "comment": "Malware payload (AgentTesla)", "value": "0bdbcf46e93e8122e34c5660464440658c75fa32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373133, "uuid": "539a3508-f952-478a-9503-9c66d1afa45e", "comment": "Malware payload (AgentTesla)", "value": "2f14d2bc3b4845d8f80ccf49af806a1a04c4292e8c380044bb88417bf4f956e322667d93c03a9ccec25ef720baea095e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373133, "uuid": "22c12f8c-1368-4dc8-8cba-f532617b3e6a", "value": "T1B755C00273C19022FFAB95334F9AF6115BBD6A660123E61F13981D79BE701B1163E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373133, "uuid": "698ca44f-0d85-4bcb-b165-420a3b3e8901", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373133, "uuid": "85456e4f-53eb-4d92-a75e-61e5a72e3177", "value": "24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8aGNaeqg7p2Gxy0ovjtdLV:ZTvC/MTQYxsWR7aGN40wG40op9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373133, "uuid": "ef024220-19dc-410c-99b3-29eb1aa90a50", "value": 1305088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373133, "uuid": "f4f296d7-79a1-4d69-8a44-c766ebb842c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373133, "uuid": "1ff4013f-5d8b-417b-8b5c-f8e2db1faf02", "value": "LOI_EN_590_10_PPM_and_Jet_A-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e29f44-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373143, "uuid": "dbced739-6a08-499f-8281-4d0ce62b6023", "comment": "Malware payload (Formbook)", "value": "6677c5bad4551af06b2460c5be1b7658", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373143, "uuid": "ccfd56ac-11e1-4b9c-b8e8-38315a7f5b21", "comment": "Malware payload (Formbook)", "value": "54c7d9aa36037965ccd8ced99fe338dc47958716b84b9e12e0c9c439f030c454", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373143, "uuid": "77b95513-442c-4ceb-8a93-cfa42064e460", "comment": "Malware payload (Formbook)", "value": "b8341a8c2677b9fb8ba4f127e8c684398aa4296b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373143, "uuid": "b2e45408-758e-4699-adeb-cdcff75362a5", "comment": "Malware payload (Formbook)", "value": "d6ff3372384d29c39190f1c431bea3541e49f9899488eda164954a0c7a5684bcf632d2b16ff773eaa5581d7051479689", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373143, "uuid": "6b2998f2-e394-40e4-9ac6-e3428939652a", "value": "T1F745336369BB0EB0F2A2115FABF587008EF7B166188B535B2F2917D4826D17C6BC147C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373143, "uuid": "b31323e4-f2e6-4d10-b9af-b1062a37cedf", "value": "24576:Ljv8FdlLKMwhSmR1mf+rFgxj+uM16MSXxnKxOWZC0bHlWw:iid/QgYMcnKxOW95f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373143, "uuid": "abfc6342-b085-42a7-bf85-920ff3e135d7", "value": 1265433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373143, "uuid": "785de1e6-6ea6-419d-ab27-2bac254ad691", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373143, "uuid": "1dd4e3a9-d031-462b-8d71-28bfd86e1284", "value": "Petronas_request_with_proifle.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072182fd-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779373147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373147, "uuid": "d90b59ef-d3a7-4d35-a26c-d0079572977a", "comment": "Malware payload (NanoCore)", "value": "db9102c5693bcb43361e186784c59f78", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373147, "uuid": "2afcfbd4-4bfa-474f-b342-2ec90c3fedea", "comment": "Malware payload (NanoCore)", "value": "54defe5e1c430eac9ea4e8191e98e3972b976d5dfeac5ef7996d7e73887bee8c", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373147, "uuid": "f04e44ac-f7ea-4e9b-86c4-be6bc1564cb8", "comment": "Malware payload (NanoCore)", "value": "e25c77401ffe32cf24454e5f65ec7f9f61ccc2e9", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373147, "uuid": "e90d85de-24c6-4e52-9489-6264f515d01b", "comment": "Malware payload (NanoCore)", "value": "58e237f39fdad8f488fc8066983de667373c5f73636b431ce03fc75f988e26075250f7733d2b1c4a341a68b85e8e1572", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373147, "uuid": "480d8fb9-fb31-4091-b989-7f0783557fa9", "value": "T11ED423276967E71F66BC2F4C81AD121AEA693D5601F8636B5C72F23E9372603347F140", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373147, "uuid": "95dbeeff-1f15-47ea-b405-977409b1b58d", "value": "12288:he4bD6Srtq0x+Me+vl4kr4+mrIIXLZZpMvBXpoeEjBH2uNgS:hN6SQk+6KF+up1AvBXpjEjBHYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373147, "uuid": "651f71b3-1e94-494f-80fd-31ba0a432036", "value": 606560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373147, "uuid": "e8bdd44c-fa8d-4180-87b1-47e6ed8fb656", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373147, "uuid": "5586d1a7-c1b9-4cca-8a99-1dac107f2aaa", "value": "DHLXAWBXTRACKINGXDETAILS.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc82e0c4-54d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779339521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779339521, "uuid": "c73909de-72a6-4c9e-85f9-22d53270039a", "comment": "Malware payload", "value": "7cbd0111308c24e1d860028f423ab565", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779339521, "uuid": "bbb196de-9a57-4dd6-a47d-e2d714318dc1", "comment": "Malware payload", "value": "550b867520eb3822f3a4fba52db50c0ccc56e8cec9141cec19287d789b46d548", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779339521, "uuid": "0824b5af-a197-414f-814b-8ad9c236c1eb", "comment": "Malware payload", "value": "f1683f5a87f36b2d4059c0d91eba2984463d212a", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779339521, "uuid": "8eebae68-4bef-4e23-892a-b9f2baf510b9", "comment": "Malware payload", "value": "78c4f3c1271bb3894c3268289bebc1ba61fdd9616509d4aa301cbf19f61fb2bdc17f6cecfb774e16b856651d87f43b17", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779339521, "uuid": "667f581c-d713-440e-b0ff-90217984268c", "value": "T12884AE2129C1E935CB8445F1DDFAC1BA06EC2D4009813A575358BEBB3D79A7CAE8B1DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779339521, "uuid": "2a39812b-8d07-461a-ba14-f4c339e774b0", "value": "7c2c71dfce9a27650634dc8b1ca03bf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779339521, "uuid": "5aa8dbb4-d5c8-4c04-ad32-94b42a450bda", "value": "6144:iQLFhIJfYkmJL4+aSE8Ofm0egiXVTDyEs8IizknaJ+05Kv+yv3UeNm7c9ukdSo:fFet+jOf/pCWESiYnaUgc9uGSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779339521, "uuid": "7954cff6-cb13-44de-8c86-6df19f436a0e", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779339521, "uuid": "f5070e60-d8ee-4154-9ba2-7243fd2478bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779339521, "uuid": "79fe212a-84ce-4604-b646-f2cd71f315f3", "value": "Orden de compra_N2025115.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096ead5b-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373151, "uuid": "5658cafc-ffba-4866-98d3-b705f692a313", "comment": "Malware payload", "value": "bdc9fa6cd04745202731a6129f8cb7e5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373151, "uuid": "85cae34e-ceff-403b-9922-8c5ddcf44456", "comment": "Malware payload", "value": "55340c7e109d0a70067500f0c4459846bafd9cc5fc26f6f76ef7a66af2a15305", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373151, "uuid": "94a4084a-bab9-4947-adbf-d605f92dff85", "comment": "Malware payload", "value": "0af2fb2b642d7d565ca5564df1604c7e3181f65d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373151, "uuid": "77216107-75b9-4bfa-a914-c3be62e99d3c", "comment": "Malware payload", "value": "45a5a8bff7c10627b8c9e0d2c11be391b0339e7002913f561ac0055b66390ffb085aef0ca2ea5ab06b2048b955ee294f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373151, "uuid": "cdef8f40-32a8-4c5b-a0f1-34a584d45fac", "value": "T1531533B82A7F0F10D6589A821FF25B511EE0DED4A4A9D9DD0CC1783367EDB626D0A730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373151, "uuid": "e3402729-15ec-42cf-b858-47c5cde8c60d", "value": "24576:Sy6pdHO/RmpCQINjfp87i2dtP3X8gnCtyZhiOK+GSc:S3pd8Rfj67imtP8QCtyZsWGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373151, "uuid": "b9e798f1-fbc2-4a61-8ff6-a2011d366d31", "value": 932108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373151, "uuid": "d729cd11-17a6-4656-afeb-839d69e40866", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373151, "uuid": "067f1bed-02c2-468d-8473-6b7a70f951d1", "value": "output_UjeXsAoNbYWw6nl.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ceb4e0-5515-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779368695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368695, "uuid": "cbe7052c-1ac2-45c2-aa6a-74f0aef6f326", "comment": "Malware payload (Mirai)", "value": "da66b257dffd99be37fd84941520f048", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368695, "uuid": "4d711f86-cb10-49b5-a49c-e3a4f8acbd3b", "comment": "Malware payload (Mirai)", "value": "554cf4ce479536e457fd1a563eeb39200d75c90bf70f97a03945dd759a173693", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368695, "uuid": "80858e1d-28c1-460d-bacf-2d461f176d7f", "comment": "Malware payload (Mirai)", "value": "7227a1876ce8339c6005596593152e87abb92a59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368695, "uuid": "0dfd9602-0430-4699-87d7-b1b316bb9265", "comment": "Malware payload (Mirai)", "value": "f3af2735a4aa855c02baab01f5c5ef3b4d5f71097169e213747d75f65fbe3bbe25d7767f494d2ac81e45ce80e04d05d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368695, "uuid": "1f12818d-70d4-4db9-a63b-8180c9661f40", "value": "T1E8E33BCBF800DEBDF80AE73748530909B130B79144924B37725B79ABED3A1D91967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368695, "uuid": "f326fa31-3f9d-4b7e-976e-529486c501ff", "value": "3072:aVJyoz3smakOFSkkBJCLcZ5joyEVOjbiwLq0+Bhygp+I:y98kkkBULYjoQLCygMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779368695, "uuid": "7861cb86-cc2a-434d-8a32-1b148d99e276", "value": 155372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779368695, "uuid": "d7aad810-deff-46e5-abf9-a8064ea4d0e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368695, "uuid": "d6f6faea-1406-4699-9501-f14535f3d443", "value": "micro.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bcb0a8f-5514-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779368242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368242, "uuid": "2801ef07-fd66-4988-b980-581286829689", "comment": "Malware payload (AgentTesla)", "value": "81ab69f8b16bd7796ef7ae0ec33ce4a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368242, "uuid": "2ce24e8d-2f5a-418f-8d7e-6e5551bf62fc", "comment": "Malware payload (AgentTesla)", "value": "555fdbe80f61af5e6f5a3183635d85a077d002d247160eb2c59c68557d54d5d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368242, "uuid": "d547c5c5-9722-40b5-8f7f-06a99f1c7650", "comment": "Malware payload (AgentTesla)", "value": "a06848fc00cada41c4881dec1855f678663d8f71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368242, "uuid": "fd806bc5-8e20-41ce-8511-f3fe90578b71", "comment": "Malware payload (AgentTesla)", "value": "299e8ecda4e6b654d43ebfb0325610c4599879f5c4f4af795ac2fba10930ec956d4e122b063758366b4a88e08f2c88d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368242, "uuid": "c34fd1c0-aa33-4580-938a-09e4e23a6bbd", "value": "T12F2523549BEC8EF6853D9228B06E721859840F22C54FB193BFE5224A397EF826D13D16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368242, "uuid": "c76c4209-09cc-4309-9b17-e2bc4cb95770", "value": "24576:CMezCorzJVqMk2mmCRQ5HcTLlwhv4iW+oeci/uE:CxCormMkCZIJErIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779368242, "uuid": "39e6a351-00db-4124-82f9-571019b2c92e", "value": 967177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779368242, "uuid": "6d6d5f16-bc70-4dc4-9679-07ff089700b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368242, "uuid": "4b11f94f-abca-41eb-8a3c-1f587b7e49c9", "value": "555fdbe80f61af5e6f5a3183635d85a077d002d247160eb2c59c68557d54d5d3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f102819c-551c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779371821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371821, "uuid": "db3d6fac-8985-4bfa-9e4f-aa6fc490bf01", "comment": "Malware payload (Formbook)", "value": "08ef947b38416c3123c1771288b18721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371821, "uuid": "df4f43cf-cfb6-4efb-8787-889a952bae60", "comment": "Malware payload (Formbook)", "value": "561c3ff6b268566497a4e74bd61eed2058682100d2dfc9bb0e1edf78e743d3f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371821, "uuid": "018459b3-a1d6-4c0d-8a2c-501366b7aada", "comment": "Malware payload (Formbook)", "value": "02ab1334bf24f1a46e8a132dd836ad67e0d93395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371821, "uuid": "b2a02e1a-8606-482a-98bb-da4c690ba94e", "comment": "Malware payload (Formbook)", "value": "9f9c1e775249494306d0cf35b787d91037e5844c6947a3232f14d1f2277f7356c94f6565abc676b94516d33175fa7718", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371821, "uuid": "d96e208f-2a97-4717-a2fa-21b97bf8b26f", "value": "T1FC45CF0273C1D062FF9BA2334F5AF6515BBC69260123E62F1398197ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371821, "uuid": "591bfae8-d998-437b-9de1-4cb6afc16b20", "value": "5f88f56fde35826e3c0cdc14bfcf3761", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371821, "uuid": "e0a67341-a4cc-46a6-b6e0-8f8df7825fc3", "value": "24576:WqDEvCTbMWu7rQYlBQcBiT6rpFd+zR+DWbDkLsJ48fN8Zhvr5Lq:WTvC/MTQYxsWPkzR+q9JXl6hdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371821, "uuid": "60325863-23ac-4695-ae72-30fed7588f50", "value": 1267712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371821, "uuid": "894de311-f63d-43dd-b919-ac3e5a302bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371821, "uuid": "cc5ec0b6-cf4f-4c66-aed5-e9053f115f33", "value": "DHLXINVX0914534XPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d662c98-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779373157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373157, "uuid": "c7e311a1-4a7f-455a-a37b-5c3c79f7bb0e", "comment": "Malware payload (SnakeKeylogger)", "value": "cc8906e20a3a877ac0ad8f838f199850", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373157, "uuid": "61cae0cd-57f3-4af1-ad80-1cae74a9db24", "comment": "Malware payload (SnakeKeylogger)", "value": "5634a3bcf78c155c91796abbc47eb87eb0f45a3edd2d7567d3ead7f1af6d0aa2", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373157, "uuid": "5477be0c-349f-4342-b933-d099af7b2439", "comment": "Malware payload (SnakeKeylogger)", "value": "03f64088046f5eccf257702e99f485e6990638f2", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373157, "uuid": "722622c9-b5e1-4172-bfdf-b4c95bf3b1f1", "comment": "Malware payload (SnakeKeylogger)", "value": "969ad64f24db90a47cd15656b4a0cbf3847faf2497147a9cceada8f8f989bd64fe819db9ceccf72449605f210e163d2b", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373157, "uuid": "50f72e7b-feba-4ebd-95f6-3c04c1ce9076", "value": "T1317423AD4F07118975BEBA36209B21F01565C19FDEBE9F1F06DE20683C439E6508F9C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373157, "uuid": "b68191d0-7c6c-4d53-b6f0-a512e2ad3a8c", "value": "6144:XAb5vCrcROtbkH+VdfbU/GZ8r/NFc0C1mCqYrvftUAK88TsQzUH7+V9mWFKozVa2:Xl4ROt4en7sFa1mCqYWAE3AH6VsW4Vs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373157, "uuid": "69a27ca0-33ac-4549-bd0c-2fb77dc8a4e6", "value": 370381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373157, "uuid": "0a38949c-fe8d-4d8f-b446-2b040a588ff3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373157, "uuid": "ae7c04b2-64ee-455d-85ed-e35d0e5c341c", "value": "Samples.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f887c72-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373161, "uuid": "ec7455e0-eb7b-4cb8-bda9-9c6c8c6493ec", "comment": "Malware payload", "value": "e784ac02697f2c127202f9c87bf16617", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373161, "uuid": "4817497f-2eba-4179-a221-c3092859b980", "comment": "Malware payload", "value": "563db9705ede844225ac07c7042999c54c04fa72877984a250f1db67b65673a3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373161, "uuid": "a4d00bb1-dce4-4186-acd0-849a953e9e04", "comment": "Malware payload", "value": "53a99b95f9e854a7a615f718e952ae73dfa36666", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373161, "uuid": "5a8596c6-0060-4e1e-bcde-2135e6b049bc", "comment": "Malware payload", "value": "01197d7d5efb623e6474f3c1063bf3c1887da0e2e97db85d8d4e43e16df013f47cb3c945c4519b38c86ad055ef48b427", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373161, "uuid": "d1964940-3ab2-4be4-9507-31f282faa81b", "value": "T1D441D69AEE0C358776E984C8757342965BE0CD333360E1DC54C2488AF627C9EBB5342B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373161, "uuid": "b3112449-5ff3-4eeb-9b8f-ca916f0b68c7", "value": "48:9bCA3A+x380ZQwsigbF2nq8bWbfq6VVVPccs7HkqDVVVPccs7/uqX:ZCiA+bZQwsigbF2nq8bWbfq6VVVPccsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373161, "uuid": "44c28c54-bb22-4679-93ee-9105169d7901", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373161, "uuid": "48aea6e3-2637-4261-9878-03b7fbaf8c1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373161, "uuid": "c21bf162-104e-4e08-bd9e-610a8f6217c7", "value": "22384156131928522723.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db415e13-54e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779349021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349021, "uuid": "a66227f3-d27f-43ee-b015-059f7afb41b4", "comment": "Malware payload (Mirai)", "value": "88cd626d9c89b4e0e78f6dbd1120efb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349021, "uuid": "8d8bd6f5-6acf-4c70-82f6-a73f072c51ea", "comment": "Malware payload (Mirai)", "value": "56cbd90b21d226320c86f2bed01c18448553ae2c8c54ae95f3ab58df5f780a8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349021, "uuid": "5ade711b-e1b4-45cb-b167-4f60b7ac8b4d", "comment": "Malware payload (Mirai)", "value": "591bed68a6ecd57f1b09c3cb596a856e9507eb3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349021, "uuid": "0fad3cdd-df18-4194-b7b1-0bad2d6f03c3", "comment": "Malware payload (Mirai)", "value": "9ec37a796734e7870f5885d61a6ad16f43d459634cb1432de899c53ca6c1bc8f835dcfe384de7f0896443432d986edd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349021, "uuid": "5e10db17-0f33-4b54-ac4e-133b8d139c09", "value": "T18EF33B06EF818A17C4C20779BA9F43553323EB6893DB73039A287B742F837D91E66516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349021, "uuid": "a09fa843-204b-461d-bc47-fb4f903d8715", "value": "3072:LySySRQoXTS+JYAaHp15WJxHM0qODv3qHV4cCZJq2Ni:FyShDS+J1aJybM03v3qucCnq2Ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779349021, "uuid": "2139f53c-0885-49a3-9fa0-1d518a0cbd33", "value": 163972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779349021, "uuid": "7cdbf4de-f085-463f-a0a9-d53f8ba3b38e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349021, "uuid": "e7544d06-9cd8-4b07-aabb-8171641b6129", "value": "bin.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c154f83b-551f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373030, "uuid": "1eb118d7-9d98-43bd-be55-b6b20e058aa2", "comment": "Malware payload", "value": "04856035e2493437d94af714bcea3f41", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373030, "uuid": "678f4d89-f4ba-43d0-a283-2452e388ace7", "comment": "Malware payload", "value": "56ea37ef9e4ae2bb4d0e11b84ba3aea650a55018cd3430d6c75f0a5ef6815d81", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373030, "uuid": "a914ffd3-4c04-4886-8f13-6253b65e124d", "comment": "Malware payload", "value": "0230a94e315f661d901517b3c3c6fc486f9b1996", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373030, "uuid": "5708bb19-8cbe-431f-894f-f9df310ef666", "comment": "Malware payload", "value": "2b5fd08723bbe3e3edf6da4470e1ee923b63fa5d8aa09f21f957444069489fc36fd33afaa395a5b2ffb966f35a10eead", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373030, "uuid": "41b1a83e-f2fe-4f13-9506-3dd9e8fd469d", "value": "T10F63536C32ACF2D7392B17036E3C267597437D903848271B96965BDBFB25A34E02A4F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373030, "uuid": "4c4c1dcb-0445-4407-8b13-9c01e3ea192f", "value": "384:lerKnqwRJ0guVRB00FUNajQXD1vt7tYX1nfNtceqffVBuySJa355jRo0yotMvy9x:oYqwrhZ1VSNYkgXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373030, "uuid": "1de82f4f-6310-4f9f-a9d8-8315d724a9ae", "value": 68389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373030, "uuid": "4bd8182d-16e3-4f19-a0f1-bf577a3d35d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373030, "uuid": "79f9482f-0861-4344-a574-8c68c117db01", "value": "Scan000342.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40610b3-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370833, "uuid": "5ea7ccb1-de61-4491-ab23-037b1c77c240", "comment": "Malware payload (Formbook)", "value": "4391981819d34db81ebe729b8ebf4d85", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370833, "uuid": "4063840e-cdb8-4a02-be0a-3441a3ff04f7", "comment": "Malware payload (Formbook)", "value": "56eadbb28ac9e8faef7ffbf957acd4275319aaac72b46376ed3eda9448cabc2f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370833, "uuid": "67287262-453b-4dbe-a0fa-c70c4fef658e", "comment": "Malware payload (Formbook)", "value": "8c0aadd07708026bbfafea0b9b6117e246a8bad9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370833, "uuid": "c0a2b509-d90e-4dde-8257-9a1a8423cf7a", "comment": "Malware payload (Formbook)", "value": "590100dac2a3d7b71400167a4f6a6ce687e35b3f89bb6e26c6e2031beff23e3d9618a5841ee9994516e26c272c284b53", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370833, "uuid": "060bd4a7-56ad-428f-b111-83631ab39edc", "value": "T18F253316D20BA574D09883BCC7C5593E619642E1D0357720DFB870DBB9ECC4921BEEBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370833, "uuid": "96b1fc53-3ded-4de8-90e5-a089cd463360", "value": "24576:Mi+Y7ZDignLFyvLdBXD3t8LG6t4LQu2Gvdw4b0q9:Mi9XLYrOL54kuBvdwI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370833, "uuid": "77c5e730-29d1-49de-baf0-dcde761b7fa0", "value": 1028273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370833, "uuid": "0f6e829c-6439-46f8-bbd9-9d084ead1b4e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370833, "uuid": "4797c434-741b-4989-8114-ba8a25a460a5", "value": "LPO_2024-00123765-00967645486.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b92c0e-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373164, "uuid": "4ea1f513-d494-4d11-b323-12668ee716e9", "comment": "Malware payload (Formbook)", "value": "71815bfb06b3cbb313d17acc016f6675", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373164, "uuid": "e5353428-9794-411a-a2f2-f0d6fa6441e9", "comment": "Malware payload (Formbook)", "value": "56f7134083814ec30306cdc37ae95f11faa6cd7c19ee5100a5dcfa0e5e325826", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373164, "uuid": "b81af95f-56e5-4d47-b43b-a90b574c34d1", "comment": "Malware payload (Formbook)", "value": "0a78c2fe91f9d88ce283011fd52f045917ebaeb9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373164, "uuid": "9a39eee2-3252-49e5-afa5-be85f5625b4c", "comment": "Malware payload (Formbook)", "value": "0c5c113867451c1d4745f7ebb7d495f6e66de86145ae911d1fa3047237bbf562e1bb973606e87d30f0e961e937073c96", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373164, "uuid": "14e1524d-ea46-4259-ae2b-b1e3af9b622c", "value": "T12C45F11E0FD45058D9FD8A38A6B4416587B1BB0B5512F36F378841F8AFB331A9D02BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373164, "uuid": "a547b4f8-958e-4c0a-8036-93a9f052a0ce", "value": "12288:IRd1YNstVqEpbrDxQOW3IKU4P8WX0IIFJv7vnHXHWt:IqqGExrDiDYr4P8EKdbn3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373164, "uuid": "cd5097b7-c8b0-4eb5-a8db-cb2a5fcb5c8b", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373164, "uuid": "6d4be8dd-28ac-4275-856a-e2c720e1405b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373164, "uuid": "c5e6df59-97ef-4dfa-b869-faf0bdcdea71", "value": "GPO24-25004800.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a630cc75-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370837, "uuid": "9d6bfa3e-4d5a-4201-83d1-4e465a75d404", "comment": "Malware payload (StrelaStealer)", "value": "50f47afcb070e04bb4065dfdf29fa0a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370837, "uuid": "6f53473f-4000-46c9-ab23-1f101371b302", "comment": "Malware payload (StrelaStealer)", "value": "56fd16b04f1ebf15273b215b7723a5702ec2fd176b82883980f26761274a86c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370837, "uuid": "3a3adc49-d75f-412e-8c2f-5390e4827463", "comment": "Malware payload (StrelaStealer)", "value": "ed5e6d356ce9a67b942a88a7341375a4c607fb75", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370837, "uuid": "bb1ce62b-fbef-44dd-8f45-781bf8dc3a6b", "comment": "Malware payload (StrelaStealer)", "value": "0cb8909120063664aa30ae2bec6cfa6042d38fafd205107f2980dd46257f83dbcbfe33190db7423517dc6b30dd930ab2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370837, "uuid": "20d8f962-dd69-44b7-80a5-8cbc40ae7b3a", "value": "T140758D44F62A1AED1C20CF46CC2B24DD5B6725523CE175B5A5F83A459F38EA8B32381F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370837, "uuid": "72f82ca5-5f15-4957-b429-d1dcf911df72", "value": "12288:1kXvsUVxbwq1H7uzNpf78SrqWp6Fx19B9j9dCinIaIFxcE9TeD29wnOK8Go:1kXpVl1HqzNpYSrqWp6FxLfJZi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370837, "uuid": "741b5f2b-632b-4794-a67c-0f0721b657c5", "value": 1683849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370837, "uuid": "4cb1e737-8ad5-4f89-a46c-58724ed5150a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370837, "uuid": "f09b7c48-7246-4d89-8171-5d2b7f862a66", "value": "457414403259631050.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c6a1a8-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373168, "uuid": "0a9821de-91f2-4ceb-9386-34ea282c0ceb", "comment": "Malware payload (StrelaStealer)", "value": "64de192e390af913729d99ffe96f3c86", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373168, "uuid": "17a5bced-ad85-427f-8160-8dfd5013873d", "comment": "Malware payload (StrelaStealer)", "value": "5721b3b441bf7637107a5052fe0c0fb870aa731f8e651f2d13833736b10850d6", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373168, "uuid": "989f774f-d032-4e53-a8c5-e74f2880cb56", "comment": "Malware payload (StrelaStealer)", "value": "2359355edd82cf881c3e088bc66819d3fd28ce40", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373168, "uuid": "d086bfe2-aec3-4802-8ca2-6a0ad606ee8c", "comment": "Malware payload (StrelaStealer)", "value": "904df2bd65e063afd6d01397c11b9c83c96d8b167ae0998144d2f1f7d95320aa62a8c8692f4d41f242cbed9ab6d480bc", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373168, "uuid": "2c0a6e8c-71a7-4fcf-a312-edc6eb39f763", "value": "T110A14C013D47B466EA72D43C3EEB2D84CB3D2A4EA04671293A8065566DD7B621E0E635", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373168, "uuid": "e57b25c2-ad2b-4d50-8c09-0acc320d9d79", "value": "96:Ck2+/fdQqFznd3RRrSTwXOMmBOCMVOA++5xKa8uzOxtX9PQ7pQ:I+/fykp2G306xKa6jX9Yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373168, "uuid": "1b5088d6-5a44-41d3-8a67-51d312c83e8e", "value": 5035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373168, "uuid": "d3b07234-3439-4935-8a58-a644949dc43b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373168, "uuid": "8d0b7cdc-66d2-4c80-9e82-980822d2add6", "value": "BahnCard_Rechnung.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ead032-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373172, "uuid": "e8c11dfe-b6b4-4e2a-a86c-7c6645b5c29a", "comment": "Malware payload (Formbook)", "value": "c673a5d387577066e06d71303be132db", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373172, "uuid": "246dedd3-6de7-401b-ae37-a35fe8397be9", "comment": "Malware payload (Formbook)", "value": "577bbd53f3783b1da715e6c8e88ed3ea17ed7532ed3b7c1e57cb3856edfb6386", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373172, "uuid": "10d01e0b-1a0f-4253-a898-526c2a405897", "comment": "Malware payload (Formbook)", "value": "24c6da2bcacb347b36c03dc7230dde5a2d90f1b9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373172, "uuid": "f625942f-6e7d-421f-9fc6-d4295becb641", "comment": "Malware payload (Formbook)", "value": "80914b6a8078af454b974a7900f5dbb8908f499ecc417975dc02479c011c4f96a7b0fa956fb210c875de1c5369658aa8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373172, "uuid": "78517fff-e080-4e9c-8869-a725fa85a833", "value": "T16E352360BB7A615DCAF64A7E066F9161018F42680C29FD06DCF4B52567FBC39AB0C48E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373172, "uuid": "2b88bff5-1f6d-4366-b117-4f0777242d69", "value": "24576:NSwnfU6nDDHfOu4QV0yk3n9IglwfXO+a6awF4GEg:NLtnDDHp4QV0R39wfXi6ahGEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373172, "uuid": "26127ae6-74f7-4e2a-8e0f-2ea4f9ce6379", "value": 1115517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373172, "uuid": "e8c930b5-b57d-4855-9dec-a6f52aaeae54", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373172, "uuid": "85121730-5c8d-4fb0-941f-903820b1a696", "value": "New_order_098765678.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196fc7a4-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373177, "uuid": "347c9781-e9aa-42b2-8e96-4f1ed8cff172", "comment": "Malware payload", "value": "a105ae9ce8d94f98e082429994b09518", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373177, "uuid": "9aa541b1-4190-4920-8985-805459aa45c6", "comment": "Malware payload", "value": "57d62b6cbf460b68359a36dcd5cf40078f5378523b32a6952971057f94e8666c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373177, "uuid": "ad65da04-0e88-4b19-ad7b-e3bdb824fc78", "comment": "Malware payload", "value": "53ab59036f50e6b357196be14b659c443f9a1025", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373177, "uuid": "1d7f6d45-478e-411f-9fe4-a4c0965bde60", "comment": "Malware payload", "value": "b76ca68cd9d6257a7874097121faa06e9d4381317a0ca47ff8b012e4b916651c70b8e2ceb7de53aaedfb410672a7021b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373177, "uuid": "0922b1ae-561f-4651-a262-80119b4347fa", "value": "T117C2F2BC7BD25224C5C74692885E26022F17FBC3C96040CEF023EF6E7C99BB5A626315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373177, "uuid": "15203447-d68d-41c5-94b6-0c2e6a1bd95c", "value": "768:mOEnD/BeiCiFjOOVWWtU1dK00cOlwU3mK7B5sj:XErBeJlO1SDK3fCU3ms5sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373177, "uuid": "33c5ae77-135b-4585-8fdd-2b0cc98869b0", "value": 26896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373177, "uuid": "74f08d22-1dc6-46da-87bd-9800a2f0f242", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373177, "uuid": "5c04bb85-f7df-4f0a-b081-07bfd65537f2", "value": "Receipt_20220913155706.pdf.lzh.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1b1225-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373184, "uuid": "3cb9a198-b87d-4bd4-8728-1a8604064097", "comment": "Malware payload", "value": "d2cbd6ff8d1c0fac7ed5ac227a930f94", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373184, "uuid": "01e85391-0df6-4b4c-8a5e-c0b1ac6c2ecd", "comment": "Malware payload", "value": "57f7d297c7b08666193b9a8d318c91cfea3d143190a0030458827a4b6373a043", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373184, "uuid": "7f9f3a77-385d-4fe7-a667-19d1779df27e", "comment": "Malware payload", "value": "5bf4753a082c1c4b3b4e9358f7bd8f10681160e8", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373184, "uuid": "0202b2a3-c6f2-4941-8433-1ad67860e06c", "comment": "Malware payload", "value": "69aedf36eeada909595093fca59af729f2212e911875988334857549ce81a318e44bdc8585b36d105db8ec17394be51e", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373184, "uuid": "54493326-a4e9-47d6-88fe-045a0ff3f6c0", "value": "T165450F405BA10A32F260A7354FF96321A7B4BC057372875E31AC53284F7AB808E75F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373184, "uuid": "d4dce476-69c1-4193-af98-19b00f627f2c", "value": "48:5A9TGVJhh9VueXUvMdQQVMOEW/CO8QEGhmca8OuBGeIwWMHo8ZRvrXLPh:5A9TObhHVU5QVNFF8QHh3PsMHpZVrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373184, "uuid": "85d73a9c-e999-454d-876c-2c0a9516f5ef", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373184, "uuid": "12553e11-2438-46f7-ba9b-09c43b99e7f9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373184, "uuid": "2eb7f4a3-fb2d-4a7f-be74-33f65881889b", "value": "SBA_HAP_Eligibility_Assessmen.img.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78c7d58-54e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779347700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347700, "uuid": "e0f1b776-313f-4f6e-9aa1-94300e7e1cc7", "comment": "Malware payload", "value": "869c66024c2d75bcd7c0149f26fd0bae", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347700, "uuid": "ce4d43be-8d13-4577-9b81-ca6e804f17ce", "comment": "Malware payload", "value": "5823911ba344a97f04782d7340f30709db87da719bf8eed03d68f69e31354421", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347700, "uuid": "dd04d6db-646d-4ddf-8a4a-c1255dc336a1", "comment": "Malware payload", "value": "dd56dc00203ebddabb577054671588165b41c739", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779347700, "uuid": "3c05568e-28d6-44d9-8d11-46b92d67ea00", "comment": "Malware payload", "value": "9fbee817f20af49ee1f36614b5f5ed7edf7c2a63776efe26a294c75e67add57ee2d8cef6ece9f9aaa4b3ddeecca931d2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347700, "uuid": "530502a2-5676-45db-af53-8f27cecad206", "value": "T175136D6526953C25AE9988375C7F2F0CBDA983E2304491DDBF8A3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347700, "uuid": "3442b2c2-88d5-4e80-ab5f-6501223a902f", "value": "768:gr9NyXsZztCY9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:OHusZEco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779347700, "uuid": "6fb35c2f-5c52-48f5-b30c-431047d688a0", "value": 45533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779347700, "uuid": "4eaa4251-63f4-4cda-9338-8df27a539e49", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779347700, "uuid": "de0a2eef-fcdd-4509-904c-4d3eb1770a9c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f25d228-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373187, "uuid": "2ef7457d-176d-4270-94ad-f12611890229", "comment": "Malware payload", "value": "01c747cc64d14d280581ccce6c088886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373187, "uuid": "fe7e6ef2-b6dd-4c7c-aac5-55a8a9e74da4", "comment": "Malware payload", "value": "5833e7971bc43cfc52783e963373bcbec8a219ff406afb0a27f52861380b7b97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373187, "uuid": "55b4c84f-5cc4-415e-89a4-81be6a0e78ad", "comment": "Malware payload", "value": "e61c576fc3a35fc5297b917a145696b638b83503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373187, "uuid": "635615a9-e366-4706-abff-275ea4470292", "comment": "Malware payload", "value": "05f80a7ce34c4019cb6107380ffdb7cfcc6a69884827ab4e6af78f71bb111c693cf29ef8eb567dc457af62f6b8a22ed0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373187, "uuid": "24195281-5775-49ee-825e-1a8d2f93b207", "value": "T10D95E002B3D1C035FFABA2739B6AF24196BD79254123852F13981DB9BD701B2172E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373187, "uuid": "e5cccb55-fa1f-4300-a858-70a984fc38f3", "value": "649f6ed9a4d576c154bbc0357156a4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373187, "uuid": "a6bfc9f4-a5bb-4608-8026-038a8db5baea", "value": "49152:+h+ZkldoPK8YaUqmOZtqiVybpd6UGi+X0KHc+:X2cPK8TmOZoyyb76UGi+X6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373187, "uuid": "924e8ecc-ea6a-43dd-9862-235ded8fa0a9", "value": 1977856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373187, "uuid": "a8c9b04b-afcd-4c66-8c44-01b310eef029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373187, "uuid": "70a68b73-60c0-4a10-95bd-17d87655834c", "value": "Project_Commercial_Terms_And_Conditions_-_For_Manual_Sampling_System-Rev_SSGT_General_Ref_No-YASREF-318-CJ_G1-61_Phase_1D-BCD_17th-September-2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a836b5e9-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370840, "uuid": "c4ebfa88-da41-468b-9c1e-ae81b55a712d", "comment": "Malware payload (StrelaStealer)", "value": "cb81bd9d1a59d85401e7a44ce69776b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370840, "uuid": "6e0dbc8a-7780-436d-a287-8a80d91bae40", "comment": "Malware payload (StrelaStealer)", "value": "585ecfa5193604e596604a2e629f9f4891d2fe42f70a65951009e4e6ce41466b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370840, "uuid": "634e1a4d-8213-410d-8584-0fd9e7ad329b", "comment": "Malware payload (StrelaStealer)", "value": "c8c2fb3f1f537c7d1e42ca2569141453b0bd02d7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370840, "uuid": "3d0b8381-7951-452f-a7dc-9c79e7c262ac", "comment": "Malware payload (StrelaStealer)", "value": "d39e6476ae298ec47e581aa6e20dca7c508e348246968d79fa3764da6eebb846c3c2e0a975640cd2f7fdb3feadfb6557", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370840, "uuid": "a3036db1-4bcf-4699-ab55-f9b32d06cf0b", "value": "T13CC31B50F2EFA38235677F86203041C3C56FCA63BFB84045AA4957497F797AE9264CB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370840, "uuid": "428b841f-2093-406e-aeb3-7bb91ddae540", "value": "96:lwcsmecxpm6nVx3jhgQcnWEjOcsqmsZrv4sQzhgQcnWmCg6spL3jceoWk5scn6sJ:l+Twmymhtq63uxkTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370840, "uuid": "7b3b63b4-6eae-4563-b6cd-03a2c30dff77", "value": 120847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370840, "uuid": "db879802-a53b-4298-b920-06640ba981ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370840, "uuid": "e187ddbf-faee-4699-8cf5-4fbac8ce0dfc", "value": "23398211013240524016.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2137c7f6-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779373190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373190, "uuid": "73b1a111-11f3-4038-9ab9-20cf0e0b9098", "comment": "Malware payload (GuLoader)", "value": "f7c9ccbfa0b665d535cd1d62bfa6a7ff", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373190, "uuid": "396bbffa-ab21-4900-a7ce-a06df10e79ea", "comment": "Malware payload (GuLoader)", "value": "5873349e97fc5767862073e6ccd2cabaf94c7cee59091aa6dad7b5c7ae3aebbb", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373190, "uuid": "af189599-0c37-4cfe-97eb-67cdaeec26ae", "comment": "Malware payload (GuLoader)", "value": "b56b2eb4813a70a7c1169a52fc0d9210dd6533f2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373190, "uuid": "a728c3bc-e901-4841-a37d-66af5e66d26f", "comment": "Malware payload (GuLoader)", "value": "80104b12e2d6fb53cfd352043325c832890da35807fd482aca6a8d13cde8c9224b92866d7bbd8c2ea9832b653ecda864", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373190, "uuid": "f0201b87-154a-4f68-9575-d3d99a3c4046", "value": "T1E475336E2FF55ED6815704F87C8A2166FEF43D0058E263627660A786852F31C9363E2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373190, "uuid": "152089dc-0f61-47ed-a04c-08d1e3def0d1", "value": "24576:l94i+fR78q1j/jMOSMTtAKmECz+p3mW97vkMgOoafhLn8rLn4VEb5KdYOSZiL:X4iSRA8/AzUtHXp33CObLn0QEoYOSZiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373190, "uuid": "6e702ba3-67e9-46d4-9831-0cc09b5233cf", "value": 1551184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373190, "uuid": "82908bcd-36bf-4042-8393-dbd5e311baf2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373190, "uuid": "d34923b2-f70f-427a-a58e-d976908e1d44", "value": "\u0423\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435_\u2116_24357.7z.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233f35bc-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373194, "uuid": "06ab5fa1-e491-4f00-9553-a4b4478ca0e6", "comment": "Malware payload (StrelaStealer)", "value": "00414fd0e68ebd54c8a73f8ae3791a71", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373194, "uuid": "80b4905e-03e0-4868-b602-9667cf7d9257", "comment": "Malware payload (StrelaStealer)", "value": "58d9398a11a37ce6c814e75128c6989ea7b4284b9657cd8e8aabf3f29b88848e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373194, "uuid": "50e5ce37-29f5-472a-91b8-128c9e7ae01c", "comment": "Malware payload (StrelaStealer)", "value": "5a6cfaead71d25635c0c7d2ef83d6065cb96b5f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373194, "uuid": "60ac505b-dac6-45c0-a3e6-7e6bab5f003a", "comment": "Malware payload (StrelaStealer)", "value": "c47678c5bad2b9cf8a7d133312ea1e0f1fb5ee08b09d7d64f7f0592e47b4ae07ed667f7b7be42bc9cf86ff79e01091e8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373194, "uuid": "69bf719a-74d2-45ce-8809-79925f702581", "value": "T14462556FDCA327F00F98144BF200025FA5766AA917D7BC46B3D53AD84E8D5AA30C816F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373194, "uuid": "1c9f4217-e115-4dce-a7bf-a6993056d5dd", "value": "192:UMZwH14jzm7MC6R2VZGFd+ePXrTGFd+eR+f:UuwHmC6R+Zyd+ePbTyd+e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373194, "uuid": "0b195829-f54f-4a9b-a106-e7eca87f8c3f", "value": 15125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373194, "uuid": "5e016cfd-c4c2-4022-895a-cf8242a6e1e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373194, "uuid": "c5bc71f2-4fd3-4a73-838a-ff27512efb0f", "value": "22219191532838129970.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2fa021-551a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779370843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370843, "uuid": "db6ff198-15c1-47e5-b5f1-2eb43f2e5d26", "comment": "Malware payload", "value": "5daad97a36d0f790680c5b022aa10e59", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370843, "uuid": "bbd38ed9-220d-490c-bce4-bcf0b612773d", "comment": "Malware payload", "value": "58ef063748c301041a99641a9060105ecdf6d526070f29b38a862a4c4c38deaa", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370843, "uuid": "f6fb3132-0c36-461d-85df-445c134f74bb", "comment": "Malware payload", "value": "4937a5e237644c74e56c58aedb745b5e65f0d451", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370843, "uuid": "31ceb591-6002-4526-ad6c-e0b737650e62", "comment": "Malware payload", "value": "f1a90d5e87e1d8167ecefb1a3c3090bbab1cda6258d901941c3e61be4bfa905c99f312c144aaf5204e7dd34f48d93e95", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370843, "uuid": "35bcc614-a0fb-4d98-abf4-011a0afd83c4", "value": "T1A8C423EE811F704204EC2B72306D1F0A59DF74069B957AD3DEA9CCFC025E651AC9EA72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370843, "uuid": "5f604def-ef0f-4026-81d5-493b71be665e", "value": "12288:WVfEGKcse15rumIeYdB2eumX84Ba29/fhyPKhGSvhEkwwvs:WVfEGXse3ru5e3euHa9HUPYFhLJvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370843, "uuid": "316e2dad-1a1e-4e31-9d58-13d499eb099b", "value": 589789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370843, "uuid": "0ce5af9a-7716-4891-a8ea-41e0612ec150", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370843, "uuid": "7ce473a5-353f-4332-b9da-65b16c58fc65", "value": "Quote_8722.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2549d718-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373197, "uuid": "abe0f9ea-e500-4c79-858b-52f6f662a0eb", "comment": "Malware payload (Formbook)", "value": "b1324f2ec9ca4b273d37aa38710101af", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373197, "uuid": "3a05cdda-24b3-45fb-a881-5f8bda46d5c4", "comment": "Malware payload (Formbook)", "value": "5908a84be94b919e2fab551e3fa1348b5003781fdb9e0d7a3a20242dac6f6e80", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373197, "uuid": "7575b164-9576-4f12-9f7f-da048208ec72", "comment": "Malware payload (Formbook)", "value": "6fe1368a07b9a657a824133f7be550b6335927c0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373197, "uuid": "1daa4c2d-95a5-4222-88c9-d623fd617cc3", "comment": "Malware payload (Formbook)", "value": "be7b4544fdb9e7f657b11870e2b059695270b535375acedec07bb362c3772c4786443c8f25691a4eb919c71e79c1a43e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373197, "uuid": "7f91bba8-bda6-4c55-8cea-2dd8790fc782", "value": "T187F433578B1C3EA629C6FC154734AFA1AC533F67C282C28F291412E515BF46E3A6DCE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373197, "uuid": "e80b4307-8e10-4951-8ffe-b9dcb82fe9d0", "value": "12288:RYf2kfM6tEMq27hLX110CzTFOxzUoWQ5VoEgDhWDUl4klkF/xp3DB4V3GG8A+jeD:2flfNtE/OX110CzBOxwof7oEaWDRkl6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373197, "uuid": "dc8922dc-b28a-4ff4-b908-10c0578b0f5f", "value": 771682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373197, "uuid": "3961507c-6966-409c-8d9e-6b6cde41ef57", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373197, "uuid": "dca315ae-aaf7-4228-96b8-59cbfa621bc3", "value": "shippingXdoc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27379dea-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373201, "uuid": "8fd3af5f-e6d7-4ddd-a70f-4c47d1c98e0f", "comment": "Malware payload (StrelaStealer)", "value": "67689e25f7a0bf95435bb4c05865fa02", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373201, "uuid": "c5175b90-d197-4c3f-bd03-d7d272af3461", "comment": "Malware payload (StrelaStealer)", "value": "5931df0b554aa870260cd8f89265b24584a6a5e578b006200d1a67ccadecd1ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373201, "uuid": "72b94259-6e8e-4999-9883-8b98f39bae20", "comment": "Malware payload (StrelaStealer)", "value": "0be1942d47aeb40941824101a44ebc6cc8ad1dc8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373201, "uuid": "18449732-aec8-4b27-a526-a4120cf1641c", "comment": "Malware payload (StrelaStealer)", "value": "52cc5a35406a21c12d04738f38cae9ab400dcde1d02a81513671aa3a9e5070cf32392917b7247c3195e3f53941fbdf5f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373201, "uuid": "5dbee5b8-dca4-437d-a407-4835639e053a", "value": "T102922663B92A7B9076837704DE7A2345D78BDE3A2570D8A8851603CCF798C22F23579D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373201, "uuid": "52017d2b-2064-4c8d-b62d-1daa5a4c3828", "value": "96:H9ZZpVSvd6Hd75SdPVVTASaDVfd5d3LQpdSrhpdD:HPZ7d75UTDaRFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373201, "uuid": "1b3be0ab-b794-4a53-9996-ff77556005a8", "value": 20796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373201, "uuid": "abc4346e-1fe7-4358-85e0-34ee87ea9c8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373201, "uuid": "3c9675b4-622b-44f9-a74b-14123f996d29", "value": "30175288891342530981.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac23308e-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370847, "uuid": "e5dcd171-8ee1-4af2-9fc7-f758f6d024c1", "comment": "Malware payload (StrelaStealer)", "value": "3eb89f0ee235ee00f5e85083b25f592e", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370847, "uuid": "2215f537-bbaf-4192-82c0-48b5c81dd853", "comment": "Malware payload (StrelaStealer)", "value": "59836195b724bb58f74e96f0bfea334379625d919c2f9da204c6ac30b55514b4", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370847, "uuid": "a53cf2cf-fe87-405d-bd31-461044a01946", "comment": "Malware payload (StrelaStealer)", "value": "413bc29522ffc0cb3e515f8c0c0135d37455571f", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370847, "uuid": "f780a6df-cb9b-41dd-8917-4ff892ea0277", "comment": "Malware payload (StrelaStealer)", "value": "83e4dfc30e68f7cf977be89817303785e7dd7515ca565b2db796122800a38e3448d5ce659ebf3ce6089658105a36499c", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370847, "uuid": "cb114f05-5345-4fbe-93a9-b8a9ff946baf", "value": "T1E7716DFDE0B79F6BEADEDE7903985BF20F5195D81B02938982428F052716DB00E08406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370847, "uuid": "afbef3f8-305b-4948-a565-1160570fb8d9", "value": "96:FIqUXBtz7itMmCCNJmsvPdj11ptB0rJCSiAS/df3:mdwCUJmohVB0dCVAS/df3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370847, "uuid": "a14256cd-e8db-48fa-8bc1-0353754772f0", "value": 3640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370847, "uuid": "661785f0-137e-484d-9712-eaf986753735", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370847, "uuid": "63c32a94-d1c2-4ae9-8aeb-4bdf83c7c4c1", "value": "RechnungX43554.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3363c0-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779370850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370850, "uuid": "2cf55c9d-33bb-4223-962c-1f40a67f105c", "comment": "Malware payload (GuLoader)", "value": "e49bc06935fd11b48c3fc70ed4f4348b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370850, "uuid": "1f9cbb17-7e01-453c-abbf-fca2571f9fd9", "comment": "Malware payload (GuLoader)", "value": "59b24c1e23935d279d6a6100baadcdd4a90e26b8b32d0e01f0167adb57872625", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370850, "uuid": "14ea2260-6a20-4578-8824-a73515fee655", "comment": "Malware payload (GuLoader)", "value": "cfa2df8b3625014a7871f12f040aeb966bd1ab68", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370850, "uuid": "8e1a2a52-089a-408a-9f63-ab9a4ba3434e", "comment": "Malware payload (GuLoader)", "value": "9979659acef1d52df87a24501d93721be244cead417d9506a99b40e4b135ae2e6ba9208642663efbfe99c1c65bc85153", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370850, "uuid": "ce288c10-bb78-497c-93bc-323c2bb70ac9", "value": "T1352533FFE665CC019C4D208A8F5B7A98AC1D6E1EB063E473894FE465D99348C63325F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370850, "uuid": "99e2b2aa-c841-406f-a480-b47abdf6d0a5", "value": "24576:qu7vBfJpyHGjR+7m0Vo/Gb+QXk4ktS+rT:DvHpZ6dsGy4ktS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370850, "uuid": "475a5968-d532-44be-9f35-cf02b247ed78", "value": 1044966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370850, "uuid": "928d4772-5744-46d8-8374-395cab57f5ca", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370850, "uuid": "1eceeaab-dd4f-4856-868d-d98ce45add1b", "value": "Justificante_pago-22656434687.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f496add5-54ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779351641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351641, "uuid": "f5527929-2874-4603-8571-46b898b78d83", "comment": "Malware payload", "value": "b2a728df6c864f499991658fb4c023d4", "object_relation": "md5", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351641, "uuid": "e543627a-6fb9-40d4-90f8-442e3d7be575", "comment": "Malware payload", "value": "59b7e717313ea9e0c47c153f1c29a0872bac4fad445b9287570d0c871177ea6a", "object_relation": "sha256", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351641, "uuid": "062de5b5-fbac-4473-a5c2-89fde30c0d70", "comment": "Malware payload", "value": "9f13fe31e69102e8adb2be988307d02af816ae5a", "object_relation": "sha1", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351641, "uuid": "0d504eaf-fa88-4878-bf18-8ff2be8693a4", "comment": "Malware payload", "value": "6c86925437fdaf67f020cabd159e25172edd9342fbcd150c6dc3bc5995376e895fc8dee742ddb985f1218775363a1169", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351641, "uuid": "c930a195-1eed-468a-86ba-fe896d6c257e", "value": "T15371BE02C3E84666E87B4B39A9F7036733B4FC549F63976E2E64025D3CA47245A71B70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351641, "uuid": "a4e5d3c6-5447-4a8a-9d66-20a1208976e0", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351641, "uuid": "9b6a78a6-2817-442e-aba4-fa3d8eb1daa3", "value": "48:6xbB+bfSx8jIjcAkH+kihkvAUmFu7h0ewx1ulqa3eq:gB+bfSKM2H/i+vAQTsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779351641, "uuid": "27134d9c-9563-42d8-b2e5-189d7fcb2f87", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779351641, "uuid": "107ef600-a600-4f01-848d-1a52c03925bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351641, "uuid": "ae2fabb9-c2c5-495d-ac58-a5f4d14727b3", "value": "ysvkoznb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b291db2-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373207, "uuid": "535a5e3d-482a-4f94-8ec5-5f7b987dde3d", "comment": "Malware payload (Formbook)", "value": "8a2399ad6787d0dd9638bf7cd7dd2396", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373207, "uuid": "5ca86664-c505-4945-b222-338f30fe3e9d", "comment": "Malware payload (Formbook)", "value": "59d696ddc3a6796a251567bfb1d3119540b16fa7b726d99f5e9036534010811e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373207, "uuid": "576fe0b1-aed7-4c08-94ea-df7c43439dfb", "comment": "Malware payload (Formbook)", "value": "7ff4003ff804b0ceb139bb11d8376dfd60d5be73", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373207, "uuid": "ef4defd8-1354-4cd2-adcc-f5193e35f9ba", "comment": "Malware payload (Formbook)", "value": "39feceafee1329252188962901b78ba985f1b68a0cad7d133afe56f7c15ec7290595608d3a22bd212cd3baac77c1e297", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373207, "uuid": "aebc01d7-cace-4a6e-b145-b591b0fa2088", "value": "T19F1533D166060279E96CDDF828F061DD4D40F3CB2E417EE45D2EE26ADF4F398E8494A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373207, "uuid": "42fe4164-c9f5-46b0-a54f-317752206d82", "value": "24576:r62Lm5zahFdBlZYu5ffG/HlHbTchQNkFc7qgN1AjKGL1jfwnUBc:uLSFdnZN5ffG/FGncrA+m17wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373207, "uuid": "8cd8a4ef-9b2f-4b05-8101-eb87b068f115", "value": 900023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373207, "uuid": "448a6eaa-26b7-4cc6-9203-93d165802e92", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373207, "uuid": "238765f2-5c63-44bd-9497-9cbc2305e3ce", "value": "Doc_PO6900000827.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52697f0f-54f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779356093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779356093, "uuid": "064ee914-5334-4ad3-ba86-0d8d85a333a4", "comment": "Malware payload", "value": "2f205726d2e5f3af342c741eab0a45d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779356093, "uuid": "20a1787b-4371-4384-88ff-77465f61eb0c", "comment": "Malware payload", "value": "5a0b6ad41ef410c4182d0a0bdafd108f17bb397b4ab126c59b209e86664a85a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779356093, "uuid": "e0f60450-fc49-437a-9b0d-854b23ad34b4", "comment": "Malware payload", "value": "80d6217cbce9d44b8cfbd785bdf8c605f029d8a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779356093, "uuid": "9180bb84-bfcc-42db-ac4a-155e544a3bd2", "comment": "Malware payload", "value": "ef618a013d6efb07838b9138db37fc11ba8f177fecf09f82d90a1a1ea4a25938fb7a16c5187abc0eb00d372bf5c74d45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779356093, "uuid": "e3eb7829-6346-4b47-8265-90f124655418", "value": "T1A9864A03FCA615E8C1AED1358AA39662BB727C494B3123D31F90F6243F76BD069B9750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779356093, "uuid": "0b6f9281-122a-4f9f-8ef8-28d0b5cc8568", "value": "49152:No6whWuGSOmAzhTi8Z/l5Vm6STOLSirdgwsBezu1qn2B57J1boP4SDV5fcl7Xxwa:NojW5QYzu5IfMxwwLQgE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779356093, "uuid": "7c068b7e-a626-43b3-9075-90656c09feca", "value": 8495266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779356093, "uuid": "ae0f640f-f2b7-4534-8e4b-283c95edd3c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779356093, "uuid": "0025cd90-99df-4ab1-8b70-a77eba940f14", "value": "ll-x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d327e67-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373211, "uuid": "5be178a4-10d7-46a9-b292-9387600365d8", "comment": "Malware payload", "value": "948a2df3753588a93a26a1357cefb7bd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373211, "uuid": "a5833f1a-805c-4d75-b167-ca04e7340ea2", "comment": "Malware payload", "value": "5a0e93c62d4e909c4c2966f52d51ca5b58c16e4a2a97ad3fffda8507e5215a96", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373211, "uuid": "ac79ad6a-8607-4271-bc89-f2424e8d35ec", "comment": "Malware payload", "value": "0d6a84466d1be35bf98f817a6e3d7e8635b7e168", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373211, "uuid": "aba8b0c8-9283-40bc-b9ad-d6065b25b6a1", "comment": "Malware payload", "value": "ba827296976b642700c18999c643284a22ebc024be5ee5fbcf05ccb6c4c0ecf45977cd6b20ddc63994bca39884b3417d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373211, "uuid": "a22e43f8-be84-402e-8414-f463f709fb91", "value": "T11AA18D18F724A213C5982EFD73514C0AF906A130282C46AB349E7DF30997EB164472EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373211, "uuid": "a3c986b3-9d6c-469e-ab6e-b6dba7d85718", "value": "96:ZotpMElHHeKWchx4Z2CTbrvgr6hp8maM40Uh9OWZByhdm0WE:ZoSKbawS4rJHNXPMhdmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373211, "uuid": "68655cdf-cd99-4ed8-a3dd-df5d0f648f78", "value": 5081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373211, "uuid": "21eb28a0-d79e-42f5-99cf-9786d12c6dcc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373211, "uuid": "e37f843a-89dd-4c79-b97b-295a13dde616", "value": "Rechnung_40007129.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d5c925-552d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779379080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779379080, "uuid": "4ac6ca28-bb69-4fff-b42c-f5f70f20af53", "comment": "Malware payload (Mirai)", "value": "f106270a8743b3c2ddbc9fd12954f376", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779379080, "uuid": "e01eb3e1-34cb-4eae-b79b-cc697c00df23", "comment": "Malware payload (Mirai)", "value": "5ab68d871b50b030988c7cc1b98d9e3d99e34de59254e77df369ae4d46c0cad4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779379080, "uuid": "2621e450-90d0-445e-8ea4-26b64ac58f87", "comment": "Malware payload (Mirai)", "value": "db9355bbc44b1a01ffb3cc65b097ce3ca81c1442", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779379080, "uuid": "f483f811-5bcc-42b4-ac3f-08f100001004", "comment": "Malware payload (Mirai)", "value": "f51aa9d5aa0778187bb888bd1997e46703b55ee44929c2f59cb5b77c693c972ad43ddfeafe0033bb56003bd522fa1176", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779379080, "uuid": "7fff9c4a-614e-4b88-8453-b19477edd801", "value": "T13643F0A303BFDCAAD449043869B1F754B84AF3089A4A53DF11DB466E0DFBB850653E74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779379080, "uuid": "77db01d6-83e3-4fb9-b61d-e6054b2200ed", "value": "768:bOvh2vMy8Kfz2SIwNiooo0uaSb7Ldd09cNOltg9tKrutLa39cXw2Kx01J:bwuMNmyS5oiaSucNkK96ELa39AAUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779379080, "uuid": "2db4d27d-2a05-4cdc-aa27-7537704077ba", "value": 58536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779379080, "uuid": "e0967c67-ebdb-4fed-bbaa-6a390474b794", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779379080, "uuid": "c254f899-8674-4b9e-9ae8-b11e8f83f263", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3399a06b-54ed-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779351317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351317, "uuid": "03a75e10-472a-4935-8f2e-6e419df064c2", "comment": "Malware payload (WannaCry)", "value": "d7b24155319973897d8dda56603c8955", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351317, "uuid": "568106db-0aa5-4f2c-9aa3-af168366807b", "comment": "Malware payload (WannaCry)", "value": "5ae10ae7929a03c540b09d509889a866f002f2b989911e9fd5a2f1147c01bf5f", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351317, "uuid": "9a145d69-ef2c-4d1c-bae2-f465fe558bfc", "comment": "Malware payload (WannaCry)", "value": "f2eaf6ed9c5586955a18fbb7957c8b4bc3b80079", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351317, "uuid": "be15cc73-4d1c-44cc-9d3e-cfc6b74c2a0e", "comment": "Malware payload (WannaCry)", "value": "4ddf85bfa4412f26c157fa19e3985ece08c2be54d5533e82b01cbb17c19f619cab72921cfa026f1599d9021fd6ee5f43", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351317, "uuid": "6b94d3e4-157a-4c5f-ab05-c2f6e30f871e", "value": "T1E636D00296D96B58E6F35AB6237B8710473E7E89955BA12E1328511F0C73F0CCEE1F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351317, "uuid": "c6e7e812-2b6d-48ef-8441-06d1775a545e", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351317, "uuid": "c2582760-e1a2-4f97-bf31-680a5e3f9403", "value": "98304:DX8qPoBhz1aRxcSUDk36SAEdhvxWa9P593RJG:DX8qPe1Cxcxk3ZAEUadzRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779351317, "uuid": "7aa27af6-c2cc-4cc3-bf84-95bff5643cf0", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779351317, "uuid": "85bf33eb-90a5-46b9-a2e8-8688903dc19c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351317, "uuid": "925a3ad6-f09d-4e3e-8fc4-a46738357c98", "value": "5ae10ae7929a03c540b09d509889a866f002f2b989911e9fd5a2f1147c01bf5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1bd0329-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370856, "uuid": "4b234936-7c38-4deb-9374-61398531c348", "comment": "Malware payload (StrelaStealer)", "value": "cf38612e3c4f01b12056271e3bb4cc29", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370856, "uuid": "287a34a9-641b-42aa-955f-a0d19bb41191", "comment": "Malware payload (StrelaStealer)", "value": "5ae1c3ad6d22a68d7972c3862cd53e2efea229c6480cd76dea368a16e6f3ea9c", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370856, "uuid": "c70f6376-5c3c-422c-a607-7825a08cef91", "comment": "Malware payload (StrelaStealer)", "value": "77c9b218a0cdf9572c16976af4695b3b978c5176", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370856, "uuid": "ba712c49-b353-4234-b04b-adf6bb766878", "comment": "Malware payload (StrelaStealer)", "value": "c7c3508a7589e409efd67f5d488aa86cff5092c75da4944b59da0823a7d855fc8e3b2ca688367006dfa6896ce8daa743", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370856, "uuid": "a466b016-78cc-4b1c-b932-fa0aab33fc80", "value": "T1F1715D04D0C87609D18C66331F46B28FF61974FA46E2F6379A5DE4B808069774FD683D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370856, "uuid": "59eddf26-e4e4-4954-be06-bc3313956021", "value": "96:y9R16lAsXIjdHU95XS9PB/IIdBw2+prv9:ykRI5Hq5iFBZdB1+prF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370856, "uuid": "d077c966-6d36-4b11-8372-317505058f98", "value": 3512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370856, "uuid": "996fdd92-cbed-4d57-80ca-1dd7e21a3667", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370856, "uuid": "d49d85b0-7114-4920-9566-431c73c64de7", "value": "RG13162.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2727af9-54d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779339504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779339504, "uuid": "51d1e33c-137b-4d4f-8390-4dbb7aa7c945", "comment": "Malware payload", "value": "70b906ea7940877cc1b425bdef079951", "object_relation": "md5", "Tag": [ { "name": "157-230-222-44", "colour": "#79C493", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779339504, "uuid": "f99a0cb0-17a5-4539-9ec3-a8194ef10882", "comment": "Malware payload", "value": "5aee931b8cb6dc4f4037f2fc779bbac62e7eec6f6beffa1cbc3f22a5a75b81be", "object_relation": "sha256", "Tag": [ { "name": "157-230-222-44", "colour": "#79C493", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779339504, "uuid": "c061bca9-2fac-4c27-b519-cc3766fb6eed", "comment": "Malware payload", "value": "51221cdc60126c86ee6f1c270221d2e9b1d4c4af", "object_relation": "sha1", "Tag": [ { "name": "157-230-222-44", "colour": "#79C493", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779339504, "uuid": "b72f5225-0e87-477b-b494-85977eaaa901", "comment": "Malware payload", "value": "5c1f52ed07c6da79c75fe321240063767a67279dedf9f16b8355d27f8a6d6bdc997bb47f302266e8361cc95e841c22c9", "object_relation": "sha3-384", "Tag": [ { "name": "157-230-222-44", "colour": "#79C493", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779339504, "uuid": "e6331570-c881-45f2-9a32-bc1d20080c12", "value": "T1FE946B386A089469C5F3633FCE939148FE7B5037425E494079AD82903FB9B5ECB71EA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779339504, "uuid": "92502a7e-05c3-4b08-80a2-80a0126c1ad1", "value": "3072:Lit2Emf88xjNn5E048SvwBwrHQIBiWHE/anxb0XRD6ahW7chXTEB5HnsZI2gcif6:62EmE8xOT9EkzAo/chTEB9yQppM6Zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779339504, "uuid": "cb670b75-c4d5-4f11-932b-11f7899d3d6c", "value": 434119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779339504, "uuid": "9aac3c0a-08c5-4eb0-841e-dd5caf5dc331", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779339504, "uuid": "80e5f3eb-7e69-40da-aa30-e9b6a247bcde", "value": "paylaod_decrypt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d245f6-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370859, "uuid": "287e59dd-a7c2-400c-979c-b2d20e49fed0", "comment": "Malware payload (Formbook)", "value": "a508c077b1fbe471ba44d1a5c2cd76fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370859, "uuid": "d23ce5f4-3d82-4ce4-bc0e-acc2b5a2dc16", "comment": "Malware payload (Formbook)", "value": "5b2dde172234685f237b17d431a54b10bfc09d88a0f1f5cd6d2fb8128bf0958c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370859, "uuid": "1717d102-11cd-415c-888e-b6ea119a8dcf", "comment": "Malware payload (Formbook)", "value": "6a466a262698589bb224123ab6ae095d1297de50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370859, "uuid": "8fb753e1-25f5-48c2-89a4-ade5598f518f", "comment": "Malware payload (Formbook)", "value": "98db8c2629343ee31c28566241cfc23824116f9673152e26dd0c725cbfe23a5fd87aedfe15978335764adddb6df9d1e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370859, "uuid": "489faf82-5601-4dc9-b812-2ce28158e36c", "value": "T1B675D00273D1C062FFAB91334F6AF6115ABC79260123A62F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370859, "uuid": "556f1e66-41cb-4d5b-920e-57927eea5060", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370859, "uuid": "b373d5c5-5d75-4523-b8f3-8680a46ab45f", "value": "24576:k5EmXFtKaL4/oFe5T9yyXYfP1ijXdaHk98kosnoLD5QE8y2bYdJwPgjAKwFmx:kPVt/LZeJbInQRaHDRywJHwojAKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370859, "uuid": "5f77ef92-ced4-4011-af10-03d8aa847bf3", "value": 1603072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370859, "uuid": "55b02129-ae31-47ea-a6f8-b81ae874e621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370859, "uuid": "c8628a0d-b6ac-4235-8cba-037d05011304", "value": "RFQ#_1100039557_-110112024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665761a4-5566-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779403371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779403371, "uuid": "73d5301a-f50f-41fa-8bed-41ca0921068e", "comment": "Malware payload", "value": "8037cec9e03ba3fe4305cac2b965184a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779403371, "uuid": "eb31694a-b08d-40f6-a90f-aef0a8400562", "comment": "Malware payload", "value": "5b3cdd6e4c60ab8389c8166277e16a0a6189a9df0813cb25ac2248e6aa07f922", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779403371, "uuid": "c7dd0538-ca87-4b20-a63d-199f088fde24", "comment": "Malware payload", "value": "3efbad2535f487bd1c12d3b3ea485b30e9194460", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779403371, "uuid": "c52f085b-7736-4062-b1ee-a41953293802", "comment": "Malware payload", "value": "6ea2151ad12b4f25c222a33549cb49708371cbaaca9606f81ed838e031a19d04ac9ac40d529dd35a63bca0ab4eaa3853", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779403371, "uuid": "9ba6d8d7-17a3-40e6-8ecf-8033859876ab", "value": "T122A2B8E49AC01E25695F16BD7CC13930363CCBFA112209EAE1A47215E45EAB57F6EF08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779403371, "uuid": "6f454e45-18d2-4b33-81fa-672a00407a45", "value": "384:Ytdpy5KsLDxz8Ae49FceGWEFmr8Fc4iokINvlhZzH9Ah6:YtWXDl8kBEEr8Fczok89RW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779403371, "uuid": "8222508c-dd14-4f1e-a414-ec7f22d2f887", "value": 22940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779403371, "uuid": "3cd2f5ab-9b35-42c2-8312-75da1fb064ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779403371, "uuid": "0d077a3b-36fa-46dc-90d9-34580e24058b", "value": "Documents.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f5ffac-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370863, "uuid": "edb774a8-531d-4ff5-ac04-569cda95f78d", "comment": "Malware payload (StrelaStealer)", "value": "b9912355ec1b8023a5d236f2193ea9ba", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370863, "uuid": "9cbd62ed-cd16-4de4-a308-1e4e5c13652c", "comment": "Malware payload (StrelaStealer)", "value": "5b76e228200e81ae8f19f68ca565b56cb20a846e90f006ac4010e30382646c70", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370863, "uuid": "a8cea09b-98ad-49d6-a7e7-4e73115e1ee8", "comment": "Malware payload (StrelaStealer)", "value": "8860e42b1069ae6377aa0cd2d1f2994003a1f080", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370863, "uuid": "1385b89d-fafa-481e-80a4-504f497567d0", "comment": "Malware payload (StrelaStealer)", "value": "50bd3ef1d0b299310be2843a1270b7b9ec1288c09d1557be7e271fd1659e78ed518272817b07eea82830e96c38b6eec7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370863, "uuid": "1880e6b1-211e-4c5c-a41d-96e1a7b79ecf", "value": "T1EDC53A2FEE6BA51CA8030D0713E98DE92F812F231777AF977A77E216091C5C69111A1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370863, "uuid": "fb5fc439-820b-465c-8591-ec1df27a6dc2", "value": "24576:bRlcjZVJcp6QckW3XcdEcx19c5XcdEcVce:uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370863, "uuid": "c98680c7-fc6b-4385-bbf6-d507efbdcb89", "value": 2511526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370863, "uuid": "75240fe4-104b-4c6c-a2f2-7ba342fde94c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370863, "uuid": "0e5df339-3a4c-4f91-81d9-a03d3c093c43", "value": "27718293191162919952.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80222ac-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370866, "uuid": "6cc4b4ba-d5e8-4f0c-90fc-119ea8956497", "comment": "Malware payload (Formbook)", "value": "46f1a3152b90a180259c20a07352bb64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370866, "uuid": "a99566be-a9ef-4eee-9df1-a808f32f1884", "comment": "Malware payload (Formbook)", "value": "5bbe3fed5acc48b26c5604778da5502ccd945541166651de30f190e1b668211c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370866, "uuid": "06e04969-8d83-4626-8e5c-9bc512692780", "comment": "Malware payload (Formbook)", "value": "9c17e5d27f2928fe36539b8e878e519502e1fa02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370866, "uuid": "b0b63a1b-6024-4cc8-8540-1a2a30497c85", "comment": "Malware payload (Formbook)", "value": "47226da497081658b48fd7060d1f4bc0f7256877b8906833510d8078dd04e7e32b8e57e175d28b455db2c604dfb4fd4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370866, "uuid": "0eea1514-59b8-4867-b893-026f08ecccea", "value": "T13FF40158AA2ADA07C8A593750E70F27017AC3EEEB900D3064FD97DFBB975F015E08652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370866, "uuid": "4cc409f3-4cb1-410d-8959-bc94c7bdb945", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370866, "uuid": "f42ad04d-b18a-4ecf-baac-f20da138363c", "value": "12288:XgJmIjAeCCVshaD8Iyl7EDNgd9QOdHeiBTImBUEUqkQnoQjUWkheinGO5usx+Xt:QJmoAaIPvl7oNyRUJzI1IWgei3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370866, "uuid": "7c4b76b8-d916-4a0c-86b9-fa64765493f7", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370866, "uuid": "2eb7f802-c03f-4842-8871-666147495aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370866, "uuid": "89c65e8d-e0ab-4e4f-8dec-430376aa4c10", "value": "RFQ_4580124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e8d60b-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373217, "uuid": "01707c40-121a-4ae9-bf09-ee33b53ca1f6", "comment": "Malware payload (Formbook)", "value": "ae231bde562332c9d66044c450e92a14", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373217, "uuid": "2db7a7db-7ed7-4ad7-98c2-e8d4286a34a6", "comment": "Malware payload (Formbook)", "value": "5bceece689069ee417d87d9404901f42573ad70b32f7f0688041cd979217e19b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373217, "uuid": "95667417-0ff8-4f1a-a20b-f60729af1a69", "comment": "Malware payload (Formbook)", "value": "2e918f017c5b780e343ab326211e8e19c4e610bb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373217, "uuid": "b18839ba-425b-4ee5-a9a7-442a611b3b6f", "comment": "Malware payload (Formbook)", "value": "b08c2a9240598fd02c5afdce849f9b91f2380f46aeb1afc47e56ce49077f79c4865b3577c0bb5aa8e38d85fb9b084521", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373217, "uuid": "089b3823-ff29-43d6-a616-45d79a9eeb06", "value": "T1C4353318387C5F9AC3581BF691A7866033A8FDDB2C1EFE532C715012A2751A6DA2DFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373217, "uuid": "2283909a-a613-42f6-9823-5115eec61717", "value": "24576:xSwnfU6nDDHls9sa1Tbjj3lpeCasjwSH6xMH9EetsnW3TAh/ibEl:xLtnDDHlmsaVl4miMH9EemOAAbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373217, "uuid": "04a7232a-63dd-41dc-a40e-273b07c5b158", "value": 1115421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373217, "uuid": "9238e4fb-f8fd-49e4-95a3-4b7206134a52", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373217, "uuid": "5d8391ea-66f3-439e-841c-795ec7c73a22", "value": "quotation.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b0baa6-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779373223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373223, "uuid": "efdf3a42-1266-417b-97c1-32045b39ba87", "comment": "Malware payload (RemcosRAT)", "value": "c389b87b78df960f50d0848ccff471a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373223, "uuid": "51f61548-d389-4901-bbf8-5a34e8137343", "comment": "Malware payload (RemcosRAT)", "value": "5bf25358184f7ddd5da889cee29f7adb0f8db9aa9c130b8c83a93f616919fb9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373223, "uuid": "e06c08bd-0507-47ba-9a9c-72805cec8b2d", "comment": "Malware payload (RemcosRAT)", "value": "c0a4c51af56dd5a3c5472ee86d3388a56e1cb901", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373223, "uuid": "efdeb6ef-355b-400c-a551-5f66b19642f4", "comment": "Malware payload (RemcosRAT)", "value": "0cd4c4dd500db498d10514bcd10847b89874b211b253cc103026dc77fe7d6990ca236d357981cf8dce8a78e1519ec453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373223, "uuid": "567ec386-96df-4f67-9566-7fb4124506d0", "value": "T19B15126406E8DD29C77603355032E33AEA759EAB9239C222FBDD3E93BF163011657352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373223, "uuid": "0041a42a-488d-464f-87cf-358afec4f9ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373223, "uuid": "8a404f07-b967-4f5f-a1c0-bb388be808f7", "value": "24576:fMlPuJwI0Xvuwl2wfnV4nG6vv1BIfrlu6cZVp:fM1CwpWwQwfyG6vv1BB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373223, "uuid": "e0dd82eb-0078-4c30-b854-a9c4968cdfb4", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373223, "uuid": "251db199-2c08-4875-91b2-c151ea731d2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373223, "uuid": "ecfcbabd-db77-4271-b338-1c24596eceb0", "value": "verbeekwijnimport_wine_list_inquiry.pif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ab20ca-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373226, "uuid": "d9f021ba-4b3e-4d19-b0ae-4bb47730c5d2", "comment": "Malware payload (StrelaStealer)", "value": "f661a4206267f611aec2395eb4ee9883", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373226, "uuid": "f1512b2d-3005-416e-bedf-d7e422ef031f", "comment": "Malware payload (StrelaStealer)", "value": "5bf75e6f1096ca46a476083c6dcdc4eeabedc3e8477aaca53cc51756b97be753", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373226, "uuid": "2f51d113-bffa-4b4e-b6ac-1e884bf7519a", "comment": "Malware payload (StrelaStealer)", "value": "17a70a45d29ea403f9891e7bb12bf0caca8d703c", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373226, "uuid": "baf109fe-7e7b-42a2-940a-159353947b9f", "comment": "Malware payload (StrelaStealer)", "value": "206a9f8968c7846eb4a91860e198329f7b89ff09b982d3763c53b9a0b31c2c9b1b6830f951445d47f5c06e20b9a30d55", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373226, "uuid": "0a46fcbe-6e99-4b0c-9392-7e2d13294354", "value": "T1EB1175EDDA37A510DF7C8931E160E9D26B0B96F2A171019B8BEA5070B12A7490F4E276", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373226, "uuid": "b9ac6816-5019-43ba-979b-9a158e286e01", "value": "24:91fN7Dwmp+i1ECjJUtuu9DWz+/hlT7t07k32k4VyrxNd3AioYoXW9HEc:9pWmwiYdWz+/nT7tnl48qioYoGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373226, "uuid": "7db1ba53-b2e3-48ca-9f2b-f9427234efbe", "value": 1076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373226, "uuid": "53418466-6125-46e8-b5b2-2fdd1f46669d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373226, "uuid": "c09fa919-686f-4363-83ee-c35b029c1300", "value": "22421695628206.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f4bc80-5512-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779367536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367536, "uuid": "152ec162-7401-423d-beee-23dabba33145", "comment": "Malware payload", "value": "05e8060e6c449cc7755802055c56333d", "object_relation": "md5", "Tag": [ { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367536, "uuid": "1cb6b830-ec93-4824-8566-6791a2d19bbf", "comment": "Malware payload", "value": "5c2cbdefe7dc16cad6482ae4f9eacf80ebcc09d5da13dc877db773b0a5fb0783", "object_relation": "sha256", "Tag": [ { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367536, "uuid": "62f66db6-a3cc-413b-84df-6e6785761898", "comment": "Malware payload", "value": "12a42b3b08a4c24dcf3c84a00332911b3391d8a8", "object_relation": "sha1", "Tag": [ { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367536, "uuid": "be9ab8e4-6385-405f-96e1-66d1f29fe27f", "comment": "Malware payload", "value": "a09144d28a07fecafe9110cbe965a779d1dbac4ca5cace7cc7c0a80973fd47f7ce25b4b14eea7920f69ff60d5204961b", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367536, "uuid": "a364aa9f-b384-4b5b-aef8-a626582597cf", "value": "T18731F628A63095A87077FCD778264D116F069938F3EC465508A0DF664D104B3B2EAFB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367536, "uuid": "73461b45-3b14-4ee6-8fdf-795210da915a", "value": "48:XU0xeDejsksS1u2CsjSoBAG9Ml+hWle+ZsNW:kBcNjol6BCls+mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367536, "uuid": "4a874e93-2648-461a-a19c-8ba2e2958e0b", "value": 1640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367536, "uuid": "2848b202-154a-4a08-823b-a46635f4829e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367536, "uuid": "a69c4152-bd23-4f60-96fb-e02c39eb658d", "value": "5c2cbdefe7dc16cad6482ae4f9eacf80ebcc09d5da13dc877db773b0a5fb0783.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16748430-54d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1779341819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779341819, "uuid": "f3c0cb56-6519-45c2-8ef5-65af459f33fd", "comment": "Malware payload (Stealc)", "value": "d1394ffbeaf063c3781e0d97fe861842", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779341819, "uuid": "72e9b0af-f1df-4447-b421-408008bb9c7a", "comment": "Malware payload (Stealc)", "value": "5c807ad6b96d051a1db40918015541d35f6b6a82c9541823b413409b61ef08cc", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779341819, "uuid": "30cbe62e-c621-45f0-87cc-4abd930d63c2", "comment": "Malware payload (Stealc)", "value": "8f68a3220c03d62c392e67c51535b873bc5c2ac2", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779341819, "uuid": "1fd59a64-26ac-46c0-9867-28d12b5d88dd", "comment": "Malware payload (Stealc)", "value": "03c0106e8e8db3d26a934760595c3d9ee06ae5e8802587ff3fe961e6f0d0f631896fd489d014a8c633361d5c09948f11", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779341819, "uuid": "31699876-998e-44d3-a2ab-7fb26acb5fba", "value": "T13BA5337782133000DA7D05383AD39AB8A42376676856F7E05D8F93C61FCA5BBE36684D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779341819, "uuid": "dc5ab6e1-9043-427c-8704-db14cda0806a", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779341819, "uuid": "d8dba95a-c3e9-4757-99e9-0ca38c4e6299", "value": "49152:ZNws8SLrH7ccWLPmyTDBdUM6P2x4cchO70gldIJy/tY:Zt8S/H3WLOmU5G4cGOfl+ktY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779341819, "uuid": "6f4eccf2-4f0e-4580-82ac-16e37c9ea643", "value": 2088464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779341819, "uuid": "ce08bdf4-2bd8-4545-9b4b-37a29c041d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779341819, "uuid": "77f2d487-77d7-42f0-aa42-94e5975a60c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1b2269-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370870, "uuid": "9bc2bcc7-7f95-453e-971d-9cc0a9592268", "comment": "Malware payload (StrelaStealer)", "value": "8a2485e70989555ff132c0d290a94c89", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370870, "uuid": "23d4e2b3-c1c9-4f1c-91da-2f2ae6082938", "comment": "Malware payload (StrelaStealer)", "value": "5c84243198bdd813d7bf7ad0d1a9ff321348f1ec3c7af8a026ebf6fd422fea02", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370870, "uuid": "717da6ec-f304-42c3-8c26-e30a0c623910", "comment": "Malware payload (StrelaStealer)", "value": "251dba258381b7c0f4d217b1e647eca6d0ad0c19", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370870, "uuid": "b2dd3ffd-8466-4683-b9df-af4b68789a58", "comment": "Malware payload (StrelaStealer)", "value": "a2e41a2e9dd89773eadc98c6ebeca4ffeba319dda041c0451ae4e89cb7590dd5b12b933ca61d1ede1bc5b763f3956517", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370870, "uuid": "5620368b-2666-483a-8fb6-218db9422b89", "value": "T115359F1396EF3E702A1A2D8DCDEBDEB9885F5C327C51CCF19AEB50AB813D4419562C06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370870, "uuid": "1b6592b0-7dab-40a9-a9fa-826908e45796", "value": "12288:elwEyyU1DiUsvx8axKFxi0Y3gua54cyufvtLtHuO:ww4Upinv6awFxi0Agu84cyufvtLtHuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370870, "uuid": "28f85070-01e5-4253-bfce-bab65fcd7ba3", "value": 1078654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370870, "uuid": "309ee207-3822-4787-ab8f-04cd044d226a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370870, "uuid": "2831a4ed-39c6-454b-a29a-6c1fe3e91cbb", "value": "22157106721035829641.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc22f958-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370873, "uuid": "3f552e8b-9819-47b4-8759-7123ab1df1d2", "comment": "Malware payload (StrelaStealer)", "value": "eb77180a06d545ba946f1073545fc21f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370873, "uuid": "29d18da9-2ba0-44fa-b0b8-0eb22e66ed8f", "comment": "Malware payload (StrelaStealer)", "value": "5cc390b465714a54fb34fc3950958fc40704bca6724a4a736a8f0aadae67f4c1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370873, "uuid": "f4c6ec5c-0236-4e2d-a523-972215b31889", "comment": "Malware payload (StrelaStealer)", "value": "40a04562c8055336d9ad5dabbe902a4cccd6a044", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370873, "uuid": "72068f3d-1d52-4294-a653-e4b8dfc00592", "comment": "Malware payload (StrelaStealer)", "value": "3dbcb9331c641b656646c687736e725176df7c6ed6595a4698590b471c1b5138aef6f3841d63c6f3838bd893a6a2093f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370873, "uuid": "2a220e2a-c83c-4ce8-b82a-e1c1795b2085", "value": "T1346508924981FCD0A4587F4D6DF02CD089DCBB603F13FA6922B739DB55692FD83912A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370873, "uuid": "1d6c46b3-1974-4f64-938b-913f149812f2", "value": "12288:9HSUv6l+B+warBNZ119Y1QCu4ElzET/m4ElzET/DZ7wVYfwg:9HPS0B+wi9Ktu4ElzUm4ElzUDFKYfwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370873, "uuid": "4c5de77d-a6e6-495b-9b4a-46de243eefad", "value": 1460059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370873, "uuid": "60b13e2c-ee2a-4263-b1e1-f03eaf31853c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370873, "uuid": "18c868b9-6004-43ba-a090-bf846ed2bcfb", "value": "381017375319162540.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0dd134-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370877, "uuid": "d0221d56-d317-470b-9e49-4468f8c71198", "comment": "Malware payload (StrelaStealer)", "value": "07059362f3f915439143b0e0e57e78ee", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370877, "uuid": "8d8fad83-17b4-4262-94ea-233320f7e688", "comment": "Malware payload (StrelaStealer)", "value": "5cc4145c7fe6f726af6c457585ba3a307fba8f6dac04a42b5169cb0070fc28fa", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370877, "uuid": "a5a58090-799a-4508-8ff2-713d65445c42", "comment": "Malware payload (StrelaStealer)", "value": "603636a0265655591f2836085fd89f43ffb57cb8", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370877, "uuid": "742a00d2-ecbb-44cd-bdab-799146bc57c1", "comment": "Malware payload (StrelaStealer)", "value": "9856aa651576441a1401e97c8354ab1fd4efa1b17fc0472d6315245e6f682cad41df8aa12b0127349515562c5581d55e", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370877, "uuid": "57ef52eb-a857-44ee-90e6-7dcd0498198c", "value": "T1AD92E184CAF4F013DCE8BA4A1CBD7581FCC1E3D19BAF012D175E61442DA658D6F0A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370877, "uuid": "a5db63e2-e08a-4bb0-bead-03ac3c2fe9d4", "value": "384:WxxmWc0ktxlS6q1gEGsvcOvIT7FvIaofRuFCYosQQzBwsl5/jsvF6O0:kxZAvlJs0Og3haR8osQGBw0NIv4O0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370877, "uuid": "03618650-a1d2-4ffa-a807-1d26f32b9a09", "value": 20369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370877, "uuid": "3d7adcd1-9672-4097-b16a-0f905412580c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370877, "uuid": "54c5ef29-4028-4491-a09b-8bf3e02b57fa", "value": "Rechnung_145-24_TuMa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c80a8c-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373230, "uuid": "0dc08610-ece6-4490-b77a-2c34a16a5f62", "comment": "Malware payload", "value": "a6ccaa88efd76f01dcba8dda63524139", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373230, "uuid": "2395c457-877d-4ccd-849f-44de9bca8500", "comment": "Malware payload", "value": "5cdb8e83cb839c3cbf133f694b82db800910b11432422aef7c0a127821f4b515", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373230, "uuid": "fb1e2633-70d5-463e-b7c7-82c9f7b09660", "comment": "Malware payload", "value": "c2ca7c7bade8463eb7144ee31e41b7d0a3acd810", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373230, "uuid": "6b57f209-ccef-4c98-b664-0b31567a13d4", "comment": "Malware payload", "value": "0fd3e4ab1286f3dbf80caec2dcb149d228c3003125c7bac4962b37c215c25085ce3135f70268c4285a04fb9b06ad3089", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373230, "uuid": "77b5b57f-f70c-4c06-bab1-3286dd059fcf", "value": "T1109533C09BF4740DAA6E8157520C32D83195EE25DE837C3E6AA84223526FFDE50E4EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373230, "uuid": "0e55b24b-aea4-44e7-95e1-d44339f9f9a6", "value": "49152:kO0wh23WZ8oDXxtdC7/vImnFdeRkm67265ipfkUUcYS8cW:k3wY3YXUvfnFdeat72kizUd3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373230, "uuid": "f84a28fb-239f-48af-a222-5a65cb372b30", "value": 1887338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373230, "uuid": "7d9a9cf3-473c-4389-9ba8-a86331df94eb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373230, "uuid": "23fd8727-e151-4d57-818b-6654eb4d7283", "value": "ArrivalXNoticeXInvoiceXforXContainerXNoXFBLU0089027.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c84abeb-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373236, "uuid": "d602269a-c0a7-45d3-bd63-9c50aaeeee45", "comment": "Malware payload (StrelaStealer)", "value": "301b1742c97ec5b403d06e33b955ce83", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373236, "uuid": "499e881d-9815-4083-91ee-feb7e26797af", "comment": "Malware payload (StrelaStealer)", "value": "5cf88ad5e64fd665b8efa6fd6cb3764d28eceb0c889c6612ff563628aed67989", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373236, "uuid": "a97e53b5-e554-4943-81d7-614d09561022", "comment": "Malware payload (StrelaStealer)", "value": "30a1ae2edd5c6d433e8e61de231d139eadc46eb8", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373236, "uuid": "d67b43e7-d8b6-44a1-86dc-c8dc6072f713", "comment": "Malware payload (StrelaStealer)", "value": "4b222b1b44628c91f4d7ca49e98a5a914048c446ba89620c7ad2808e6539c4a00d68626423c210bf640ba5729e630ce9", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373236, "uuid": "28369710-3489-45c4-b9d0-6a6fdc507f65", "value": "T12721C6295859A218ED9309F21067E7814719F9B05B296E6F418E4CC96D0C2C4BB2A3C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373236, "uuid": "d88b65b0-357c-400a-b1a1-0461cfae1128", "value": "24:9W2a1fHpGdy+YfIAwzS1WhGU9CVe2YbhHyZWausGuq6KdgoSLC/2xn:9Ha1fH8eI/79WYbowauNuqlWVHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373236, "uuid": "1eb5c40c-b44e-4424-8d05-32fc0ea4bd6d", "value": 1173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373236, "uuid": "0d09b7f6-a72a-43df-a997-ed6edd5e449b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373236, "uuid": "e2ce8982-c9a1-461d-b974-6fa85714ea41", "value": "BahnCard_Rechnung_(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404092c8-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373243, "uuid": "24dc5257-6ac5-4c6f-8b71-03ff7a735473", "comment": "Malware payload", "value": "6a3a99973060ffe6b233253f9ae954dd", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373243, "uuid": "eb4536f7-670b-4bc9-aa24-f05e594e3122", "comment": "Malware payload", "value": "5d4d9789bbb26d40ecf64e52b029cc8504f8232f7ff22f6717262abe4d196b2e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373243, "uuid": "70aeb565-9e91-4c33-8363-6f74fa078831", "comment": "Malware payload", "value": "45ffe002e2252f202684db4f10c6d2d5b1128501", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373243, "uuid": "95b7624a-4c00-421e-9ce4-4fbf5f8435af", "comment": "Malware payload", "value": "15dee7057a434a59c324526da5bb3f3a78854b80fbcba68c3ff8696d487b7cd1d17b9600f48f6d77e0c7f4e4d84693db", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373243, "uuid": "6044d70f-1fd6-40e5-9502-2f130ade8263", "value": "T12ED423F205CE219D2295877055EA53D698F6A2E8BC4FC4E48C3D0EEA9D33C5FF681918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373243, "uuid": "645d0c6f-5b56-4e0e-b03a-5f487fbf7d6b", "value": "12288:JLfPU0eqdPnyJxE0vlUBC49SY5AQBbf2G6I71FzpsCbghotoBVci:JXdtvyJy0vlUBC4jF14hoeB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373243, "uuid": "8fa958a7-7254-4e2b-9110-0e0545209e2a", "value": 631535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373243, "uuid": "f84c2531-1c93-4409-91b7-20634d5902a3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373243, "uuid": "1e6b8215-81f3-4468-8728-ce083b1b333c", "value": "Payment_Transaction_copy_Pdf.arj.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9773bc-54f3-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779353961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353961, "uuid": "794d6a47-da36-4d99-98c1-075fa2b3ae0c", "comment": "Malware payload (ACRStealer)", "value": "829bba138c9827ee1d35c19cb8719aac", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353961, "uuid": "0d3728a4-5b9f-4996-a4f0-cd5dae951b1a", "comment": "Malware payload (ACRStealer)", "value": "5db98fe4345174b29bf30cfc328a44936439bacc655eb244b03749e759e5cec9", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353961, "uuid": "3c11042f-dfef-44ec-bafc-04009ab44a38", "comment": "Malware payload (ACRStealer)", "value": "115dc1380d8ff4b5465af74ac2c2c1e9327b1b2c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353961, "uuid": "6d094ab7-c5e1-4c95-b231-0aba2ef3c872", "comment": "Malware payload (ACRStealer)", "value": "4f51497503476e980deec8bdcc6c3a848d808ca4dff28cbedd9261462f07978f3b7521fa4b76a3b2331c43d7212b5dad", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353961, "uuid": "bf90fd80-db2d-4c78-97a6-1ea6cf7a8f65", "value": "T1C0C58D85FB8755F1ED1758708157FB7F4B21EE02D920CEB2DE58BA89ED33A22100D629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353961, "uuid": "78273703-a8fa-461a-92a5-c4d63c0fd5cb", "value": "f11716690dc3b1ac312b344caaf28102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353961, "uuid": "1bd8b6ef-4642-48c8-8ddc-b8eeb7105479", "value": "49152:KY527ryayKhO4k8mc/b3qrw00ZQEb/h6TyHBAUZLYasUpGaXBuQQ9u1h:bMrBhO4k8mc/LCw0Fo/h6TyHBAUZLXTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779353961, "uuid": "c43fec33-a422-406d-90e7-e61734cb1df1", "value": 2680200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779353961, "uuid": "b2e34b69-6682-41eb-ae31-89ace66b1f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353961, "uuid": "88c3692c-19d2-4d6e-a881-52d056586041", "value": "5db98fe4345174b29bf30cfc328a44936439bacc655eb244b03749e759e5cec9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43da1e01-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373249, "uuid": "5e286b13-9258-4aea-be43-4a92e500a96f", "comment": "Malware payload", "value": "51cb44903b0473381049d073d98480fb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373249, "uuid": "6cd7d541-f046-411f-bd4a-bfad77df9dda", "comment": "Malware payload", "value": "5dceb632ac039e29a11e01788955bf3a90d24227ef2227ef53bb455125562803", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373249, "uuid": "9b314a81-4844-4416-a2dd-78330a95601e", "comment": "Malware payload", "value": "006ad373f092ea253c4bbf9c6b870f41ed68bb4a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373249, "uuid": "3837f1d0-995b-444f-b09c-8c33abeeaec9", "comment": "Malware payload", "value": "b3c8f44684e8b1cb7a584349ff6bbf560702c230f151db74d955a3da14ab0ed7c1d361824fa687608cbab35eb5cc6553", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373249, "uuid": "5181d1fc-b0b7-485b-848c-538a7cf865ab", "value": "T10502AF0678DFAE66F9FE5531A5DB80A12947900391D0A0F931F444B32F712F382A2E97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373249, "uuid": "ed7aaa98-c1ce-4921-84a0-acd215c25725", "value": "192:hKXcMGDj1I4EomTluUukfq3za+pumvB2e3aVwAKm:s4jm4Eo+uUukszDTksaS1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373249, "uuid": "8418332e-817f-4318-b661-9bc95f4916c3", "value": 8398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373249, "uuid": "faa3e16d-9adb-4807-bd3b-989d1c317d84", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373249, "uuid": "371e8d2f-26c4-4138-9efa-09a67f1a69c9", "value": "Rechnung_61279078_(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c40d38-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373252, "uuid": "d620a089-131c-431b-8021-d424ce627765", "comment": "Malware payload", "value": "bce1882a8e0632fa296306caf93a9d13", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373252, "uuid": "c7bd36ba-57e0-4a18-9930-b0c7618c3105", "comment": "Malware payload", "value": "5dd698039f1950bb73d45ec1472e3f089f2b38288d1d3d79973552073198f27b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373252, "uuid": "63a43cca-1802-4f54-8694-57b30d420376", "comment": "Malware payload", "value": "80960c9192ac71316557fc39e2bfc786331636d4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373252, "uuid": "90c7af99-af95-4908-878b-1fa26152a9e1", "comment": "Malware payload", "value": "aed6f829781448a8db5db5d0502a9cb892ff68c8504850b408a60a1fdf89173dab0be42d470261362de1ac3945073810", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373252, "uuid": "97aa5161-f63b-4974-b8de-2e08386dd936", "value": "T125B12B7E0F9A14F3FB2E0D33F66F5290F39FC41E5385A42E091A178548C25A5618FE96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373252, "uuid": "f73e3e7a-05e4-43d1-85f6-f84b6cc085df", "value": "96:AXN6dQFXcuQ5FUnKkQmSwKXkVyUlUnnXN6dQFXcuQ5FUnKkQmSwKXkVyUlUnf:AXX6BFUn7QmSelUnXX6BFUn7QmSelUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373252, "uuid": "5a753a84-287a-407d-a513-4183b9f6dd31", "value": 5096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373252, "uuid": "6c8a404d-f019-425d-8572-d1ce32c6b820", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373252, "uuid": "2e1dfb58-f7f1-4261-82ec-7db80275a68b", "value": "Contract-789788938.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47baf9ca-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373255, "uuid": "896bf48f-1c3a-4d6c-979f-da36e2dce551", "comment": "Malware payload (StrelaStealer)", "value": "720f278efbd9512abb2c509c189497b1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373255, "uuid": "1a86e6ee-fa06-4a19-8e2a-8222e13b2f64", "comment": "Malware payload (StrelaStealer)", "value": "5e170f1b52640886b343eddcda9a15050af0b1dec15b2d58ce3bb28d0968d249", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373255, "uuid": "32157bab-db7a-4e78-99ef-e7c7c841c072", "comment": "Malware payload (StrelaStealer)", "value": "3d66f0e161784bb7f1d90106a1dfb825c58cb82d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373255, "uuid": "333d4727-c243-4a11-9826-9228dc5d7fdd", "comment": "Malware payload (StrelaStealer)", "value": "ae968c1cb39f4dfd19d83621dc1d9f934f920f9a32c3096456ea102d0df229d7698aa42bc66068fd5b1dc2e56f149bdc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373255, "uuid": "4582b2e2-a6a5-41ea-a897-65833b74566b", "value": "T17C022993BB03098FEA811598F951B356895CC133030A607DF4EED35F966A0AE931B93F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373255, "uuid": "cb256d97-d92c-48b8-9f39-e681366049fe", "value": "192:9P5YluUB9yM5bPx5b6w+7tk0dSJsNvCCpKm3:9PatB9yM5TF+7S0YSVT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373255, "uuid": "faa01f0b-92cc-487c-9b32-a5cb41ca054d", "value": 8922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373255, "uuid": "a8754db2-5590-4b54-9555-e8c539f31270", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373255, "uuid": "d6fe0d3d-b65a-43ef-b285-7a8fe9d38b0c", "value": "1141086681404013061.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b8eb3e-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373258, "uuid": "4270c3d4-e1f4-4b62-9f54-6d25a1f8aed0", "comment": "Malware payload", "value": "0a190a33f29c7cf6e273eddfc9d008b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373258, "uuid": "4809dc87-ad1d-40b2-865e-c99795d65984", "comment": "Malware payload", "value": "5e1922a744bc4df2ef384022a4554908baab68c8ee6c14305130c1d4fef79a3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373258, "uuid": "2d091a47-a55b-4a02-851b-a37e5c6bb973", "comment": "Malware payload", "value": "3ab87c38dfaab32b853e96b3b2161fd0e6b70291", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373258, "uuid": "5babbc29-ac46-4c7b-ae17-eae2151a86b4", "comment": "Malware payload", "value": "f21f45ddf397b592f85a6e5b73f4c9d5287169a6f2d93e7725e44273454e3fd7fda18589724db22b664ed996cc9cfc7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373258, "uuid": "5d5f5a83-561c-4f6e-9bd5-94f089fbead9", "value": "T19D7533CAC9102845E835A7B315C77AF095678C0189939EFD3C239747C92E16B29EFCB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373258, "uuid": "c5c60a03-8e1c-42aa-980c-9028e0f14c9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373258, "uuid": "f42deee6-e35d-4cc0-9706-c32d691a1c47", "value": "49152:q7K93fD4n1FCDU8ghnrl6ybD3fCkLLky:8K9vGF+ghrJ6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373258, "uuid": "992fd822-49d0-42cd-a3e4-346fdc2ecd01", "value": 1631744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373258, "uuid": "e1f36ada-1ec4-423b-a5ac-e7740637f5da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373258, "uuid": "7516856c-f1bc-427f-bf69-648da885d523", "value": "new_request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc8aa39-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373262, "uuid": "21013c7c-b7fe-4d1b-b742-2c572c216fd0", "comment": "Malware payload (AgentTesla)", "value": "02b65cab46d7a0d3c0f035b9fa4431bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373262, "uuid": "6a35c853-2753-4449-b90b-df52dbe6b0e0", "comment": "Malware payload (AgentTesla)", "value": "5e2986f110bb58fcc2223136ff3db47c4864a325726d4fbb514487d00e378781", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373262, "uuid": "91a36849-afed-496a-82a8-bc3818bef22f", "comment": "Malware payload (AgentTesla)", "value": "9d651ed64a6c32114069bb006d6e1a2885163d10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373262, "uuid": "1def8c7e-4653-4abc-aa62-fc8a72dd0aae", "comment": "Malware payload (AgentTesla)", "value": "147db33bfaf68bcebc0669e6cf57a4e686c85289febd62ea217c32cf326c1ae251e4d1aa8ae24ca2e552a2933d6eef39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373262, "uuid": "d3597cda-55d8-4bcb-b8d5-d829ec99a6c6", "value": "T1D8D423A69D3C372BE65FF7FBE04C036013683688795918F7239069A4863DCCAC51996F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373262, "uuid": "ae095991-c094-4c5e-944d-e442d9ac7869", "value": "12288:thTiE7PTj3mYl4ISHPeNHax2pZJP2zRhLvpJ8bzFtdIbGxHi1XwUApw62oIG9:mE7PX3l4IiPeNHaxnj9J8dlxAXwUAew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373262, "uuid": "755ec857-419c-4522-9b41-6ce1f76bfd64", "value": 631401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373262, "uuid": "4024754f-9ab2-4278-b93e-7b51fce11cb2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373262, "uuid": "9c470dcb-de79-4dc3-a2fc-aa1203b9323a", "value": "MT103_126021720924.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c014e26f-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370880, "uuid": "2b4d639d-429c-4e02-bc10-07096216636b", "comment": "Malware payload (StrelaStealer)", "value": "627beb50f06d86a27caa03bd76d40c8b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370880, "uuid": "221a9b4f-e6ac-4f3a-b195-5d04f59438d3", "comment": "Malware payload (StrelaStealer)", "value": "5e2ae1a54f1532b0c47de92f0ff81edfeeda44e0e405179e039cbf716cd9ffc7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370880, "uuid": "92940066-bf8c-4207-9224-4b3e3e9a3bdf", "comment": "Malware payload (StrelaStealer)", "value": "a1c27d59f46ec3560beb1492cce0dc4e09866a90", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370880, "uuid": "877ff17b-a169-44d5-869b-bd22ff8afa03", "comment": "Malware payload (StrelaStealer)", "value": "c5097eab26586071a37eeaa06bd395da67851d6e77ca62573e5c8bec5486831c113a55300368b151bea5b116076c7211", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370880, "uuid": "92dfca83-5a8c-4c9b-a2a7-59767a334808", "value": "T12534053DA01793C2E3D3E66C9271F6F634CD2C95C28C57A0D1A5CAA2AC7480CB957AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370880, "uuid": "7c68a85c-f121-4cd6-85c4-a972d9d1f0b0", "value": "192:C2dEZQ535CIJW5WW2/YnWge9IjkOgY7q8BH1VA//tNW5WW2/YnWgFWWEvdZ5rM/z:vbdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370880, "uuid": "40bdfbf9-da58-4c0d-b0fa-10ff125317d0", "value": 230880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370880, "uuid": "694fb79f-5ca0-490c-b1c7-aa20090f499d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370880, "uuid": "2363ec14-5e17-45ee-911a-cdf0d5b1c279", "value": "69302850367678035.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ddd6929-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373265, "uuid": "d274360c-df19-4896-8ef9-65e8c32b1674", "comment": "Malware payload (Formbook)", "value": "6c5b670d7f5357af973d3719e2bf603f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373265, "uuid": "3a5d5bae-70be-4976-a88d-69aff3288b7c", "comment": "Malware payload (Formbook)", "value": "5e34f10aad66da3d4137e4cc4ce01ac33922d427141666bfa4a6f8ec6d181bf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373265, "uuid": "c8697e68-4ba9-45a7-9bc1-4c11bebbc1b2", "comment": "Malware payload (Formbook)", "value": "decd80a3b416687d83a445fa133d34b0c47e4598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373265, "uuid": "75d99402-2547-4660-aea0-b463ae2cc70d", "comment": "Malware payload (Formbook)", "value": "caebe3253063602013609a230417deafba9cddf0ce6162bce7fa1785a9199a7c583dde84e7b4aa7f2819fa53c92ccd7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373265, "uuid": "481c09d7-cb51-49bf-a36a-b6b7a17caf2f", "value": "T16605F1103AF85FAAD67AC3FD5110A41913F2B91BA1AEE6464EC770DF2A76F050B50E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373265, "uuid": "cc30a526-19b2-4aab-b527-81781f54afce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373265, "uuid": "74a9c586-d673-445e-bca1-a33b43a1859c", "value": "12288:s0BVVgHbuUutcCwaqh6SbSb6g+nR2SCCcRtC/8FEaxDBlHVjso3lqcxI1LX3XT:VQfumsNSbSWTPpeo/oTtlHVjs8Uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373265, "uuid": "16c31273-46f6-45ff-bcc4-a648d504b393", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373265, "uuid": "4a57cf62-adf1-46e5-b80b-55862ee5d82d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373265, "uuid": "17965e4f-585b-44bb-91ea-d22fc4926414", "value": "PO#82924A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff30b51-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1779373269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373269, "uuid": "adf41020-42fb-4114-b4d9-17f324c4b3e1", "comment": "Malware payload (VIPKeylogger)", "value": "5ae648766417827444b5b842b6f57d77", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373269, "uuid": "82a631d0-02d6-419f-94fe-686111ebe7ea", "comment": "Malware payload (VIPKeylogger)", "value": "5e6b1f78a4be2be743351bf2c0866146afba3cb59fb219674429ae158f4a4876", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373269, "uuid": "e7c421d9-efdb-4765-8878-af0179f8c863", "comment": "Malware payload (VIPKeylogger)", "value": "de940a40da4b788422e66290a0f0c3e79f1aa8b2", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373269, "uuid": "adba3159-dc20-4857-ae36-404085095a37", "comment": "Malware payload (VIPKeylogger)", "value": "2d567d46d92087cc23564bd0a4f9cd08fc7fb064ab03ae306a3943b50c23bc4c4d316cbb7858a580baff1667db58e163", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373269, "uuid": "fddfdcdb-2483-4ca7-9a61-df75f79452f5", "value": "T1A7D423D0AE261FE9A1CAE2CC5426577DF8A2B1E446CB36D800F5BA050E5B1D59CEFD03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373269, "uuid": "01dd017e-3dbc-4459-a51e-8b1ad823b703", "value": "12288:4jINrJNG8kUohxSCo3TysM/ckP25grUg8VRU1RBZSdacSIk0u0MqBaQ4:GeJNG8kUoL/o32sgckPEgrW+/EdaIktN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373269, "uuid": "e9fb786c-c7c0-4d0e-bde4-0591c8f91e77", "value": 611218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373269, "uuid": "05fb3361-7dd1-46bf-9657-6dec17e05875", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373269, "uuid": "7b3965cc-b85b-4699-80e8-578f594cae1a", "value": "FinalXorder.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b1c62e-551e-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1779372545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372545, "uuid": "8f267834-1ff1-454f-b2ed-f1d5c77a5dc1", "comment": "Malware payload (ScarfaceStealer)", "value": "1499aa90dd355825820ffffa4cfb071c", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372545, "uuid": "f988080b-bbc2-4218-8b89-de723bedcf08", "comment": "Malware payload (ScarfaceStealer)", "value": "5e7637ae599e08c4d3509b18a88832351cc79c0d7756dbf46e480c20d7f74950", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372545, "uuid": "ab7ccf14-2366-45ee-a24c-5a8395f522e5", "comment": "Malware payload (ScarfaceStealer)", "value": "53e35dca03fc86cf1d979fefdc309db2e36a0766", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779372545, "uuid": "6020f223-2003-4aa4-bd42-29469e0f55d7", "comment": "Malware payload (ScarfaceStealer)", "value": "0d30d0a73392c4040f7b7b6a5213ce62de858128bf6ae0f845be1a575e911d836541295f0afa3c9760abf39fa70145be", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372545, "uuid": "c17063c6-91bf-4f1e-93cb-0e1008ede0a9", "value": "T1DB187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372545, "uuid": "c0be8397-499e-42fb-b334-d92c477aad06", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372545, "uuid": "cef85be4-84e1-4cab-92cd-cf56ebd43378", "value": "786432:4AZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:4AZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779372545, "uuid": "282bb3d7-5e70-4188-a485-286048c8ed4c", "value": 90256896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779372545, "uuid": "2cd54dc3-4dec-44fe-886a-d4732ab8c02f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779372545, "uuid": "93251dcb-0d8b-4687-9f1c-874e0581dd03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2207751-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370883, "uuid": "495336cd-04d0-41d9-a8e4-aaaa4671c869", "comment": "Malware payload (Formbook)", "value": "cf75fce0077904e7966f388e60a253a2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370883, "uuid": "2ff6f792-163f-46b3-96f5-8aed1a626bee", "comment": "Malware payload (Formbook)", "value": "5e7ac93da07a2e0e28b91b9cf390c122d361ed6ec880a59b489b9ba189cfb82f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370883, "uuid": "78323f68-3f6a-4c60-bd82-cc2749c4cfc6", "comment": "Malware payload (Formbook)", "value": "85687d8a1f246eea6689525d2b6953ffbce0b59c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370883, "uuid": "dcc517e1-85d6-49ac-8528-52eee22ffad9", "comment": "Malware payload (Formbook)", "value": "aa6645e1e2bd4929e1b2bffb41a91f85c9660a5d3438a57492df76e712704808c3c48a026d3e4ec12e20d74e6360a339", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370883, "uuid": "76cfac5c-bd96-4226-ad07-68ee9d18b49c", "value": "T120E433DAD99C41B8B849135833CFF4DCBB142021B1F9A59C928AD38C9FB473844D8EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370883, "uuid": "60f6de31-5dbf-429c-8bce-27530b705828", "value": "12288:I2oAo6DyX7hjfYj5U9xSun0k+MFU+lwJtgQpdbYnZtru23pEo4Nryc:ohuuatUDj0kbO+lYg+6ruYsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370883, "uuid": "522668d9-fec7-4b49-bba7-89cf7af13365", "value": 715480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370883, "uuid": "f3d1fa76-428a-4636-80ce-7dcff17bd94c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370883, "uuid": "d2f68be9-c210-4f7f-b253-0a901434fccb", "value": "invioceXpdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520ae05f-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373272, "uuid": "48dd88b3-f77e-434a-92e1-041ccf10d92d", "comment": "Malware payload", "value": "97d6d713232acb9e9acaded63c84da00", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373272, "uuid": "4542cb53-416a-4050-b1d5-c6810a22cb2a", "comment": "Malware payload", "value": "5e8fb42209017003727833d0d7a95a63d0ad36c1f362c24fc8fac1a4f1ac9f33", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373272, "uuid": "ff7deb12-f576-4ed2-95aa-a37e3f99c953", "comment": "Malware payload", "value": "f334fefe15c3c814f094cf6df856f29a260c2162", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373272, "uuid": "af48b092-e565-42f6-8956-ac70cf111b3a", "comment": "Malware payload", "value": "bdebfec0302acd2f82cadb0b0181287fb29082462a29e06fc013783617ce3e45f72900c858b9da5ae403eb16c2ed87ed", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373272, "uuid": "9025f31e-7c08-4279-a9cf-0f11b5779ac8", "value": "T1D555336053D38F60A6F28E74861D17763C1AB4A216D3FC960DE340298AF5B7B57D8C8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373272, "uuid": "5af44478-1c0d-4f11-a82a-e6b9beb03a15", "value": "24576:x64VykEPJWFsHbsSomkYwOT4a2fGeCgwvN+i3Tyus8/7ISSPOfTB9+Mu/NnJzCj3:A4ApR0sHbZfkYwOT4M1Qi3fj/3SP4d9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373272, "uuid": "9c8313ef-46d9-4a83-bc5b-8f315cfdd725", "value": 1318322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373272, "uuid": "34dd3875-d672-4b85-ab19-7f4fd165fe71", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373272, "uuid": "c4e51cd9-92b5-42c4-b879-d34696c5177a", "value": "INQUIRY_2024-SP0006-B(01)_INQ24-012207.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748e4d7d-5514-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779368176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368176, "uuid": "7764bfb4-0be5-43cc-939a-8e36a319d12e", "comment": "Malware payload", "value": "ea3e2d6ff2bcf390852b336db6f32808", "object_relation": "md5", "Tag": [ { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368176, "uuid": "b26d32b4-3927-4657-8639-5c158e5623e5", "comment": "Malware payload", "value": "5e951d5240a50da074cdd3ed4fbeaea6ee581902cca93f2725c88adabc6c84df", "object_relation": "sha256", "Tag": [ { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368176, "uuid": "209c63d1-c371-4b28-9272-d23efe80d678", "comment": "Malware payload", "value": "96305091633e784adf04362a4373c9e683719a9f", "object_relation": "sha1", "Tag": [ { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779368176, "uuid": "2d025494-d1bf-48e6-b114-6e7ab81b5607", "comment": "Malware payload", "value": "890b8c7cc63eb49c9d9b63cfb3b0fc54bdb2a55a4facd979b199dd5827ccc53b983a2aaa624e244882d5ec97c3f302de", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368176, "uuid": "a4f0db5a-7506-409b-8856-00efd32198ad", "value": "T1C28132847DC4F19C0B62F133196F6C4BA72BEC50681E4D1CF234E9A0BC697147AAB6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368176, "uuid": "d624cfbe-5d14-46a3-bd77-6e733b498759", "value": "48:qI27GA60SOHMNLDwhKvCx5dJQKz6C26YiqcLREAYGXbtg/Ws4hFNzNmG264HL72X:C6AxS3wHXzRV0HLasHCXedHuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779368176, "uuid": "1e0aae69-985a-42db-8f28-8c42f2861ff1", "value": 3986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779368176, "uuid": "456ea936-6f2d-48e8-b68b-e528a63b398e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779368176, "uuid": "795a7c70-55ce-44a0-92c6-ce57d50c2460", "value": "5e951d5240a50da074cdd3ed4fbeaea6ee581902cca93f2725c88adabc6c84df.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541a8e4a-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373276, "uuid": "52f0b563-b099-4bda-99f7-f6800bcd6c8a", "comment": "Malware payload (Formbook)", "value": "0673e83867da3f4deabe306d188e1f7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373276, "uuid": "1b30f449-c446-4514-b7c0-1672eeaef521", "comment": "Malware payload (Formbook)", "value": "5ea6b79d0efa5db5514fb0eb7f6307d35e504425a3af39bd226c22ac39121603", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373276, "uuid": "27f8f196-2963-4e00-951b-09357727306e", "comment": "Malware payload (Formbook)", "value": "e22ce7b7a9242e188c2849393aa90fcd6645c679", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373276, "uuid": "e7d27c69-bc15-40b9-a4d9-65be7d0cc820", "comment": "Malware payload (Formbook)", "value": "9cfffc9a8ad10e10857b27d4a3012b053962eeb5b9aeeb2271cafac110ab23748df5f9dfde23121f307024293b54d6f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373276, "uuid": "982653f0-28ce-4d09-8089-197d439bc561", "value": "T10805231A32B8B83BE9F3C3FA60B0512117B8A1682424E6C95CE472ED3CD1F755659B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373276, "uuid": "155d6d15-3bfb-45a9-be48-488a009de317", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373276, "uuid": "33579604-b566-4b26-9f8e-de3dce2538a2", "value": "24576:8HtJWGs0qw2NbwDHx0y9u/5K5dOIMl/5BDe:YPsB9wd0yAnl/5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373276, "uuid": "73cd9fe1-5d5d-405e-a552-3f3e847075eb", "value": 829960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373276, "uuid": "83ec964d-4ec7-402e-9f9a-79250f946e48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373276, "uuid": "b1295e52-1364-42da-8ea0-1a3bb0464724", "value": "52oTaV20K4bWnvN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5632ef9e-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373279, "uuid": "0730865e-da44-4140-a0cb-a2ee7b79a0f1", "comment": "Malware payload (AgentTesla)", "value": "e9f2d167b66a5b9029f0f07ca59135be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373279, "uuid": "3786b2f8-6385-4d6a-8508-72414694b8bd", "comment": "Malware payload (AgentTesla)", "value": "5f54948ef4ea19feac07408f4109df54c07137d35b34804250cd20eeccfcd254", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373279, "uuid": "e8c5c2b1-efbf-4966-8930-c056fc03590b", "comment": "Malware payload (AgentTesla)", "value": "34c5afd93f8ddf7f90cf90c57b5442b8a30f3f3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373279, "uuid": "06c8a61e-b25d-4235-8759-3d09992da0b8", "comment": "Malware payload (AgentTesla)", "value": "c0f9deb0ac94be0e041147f802f052986119847fe30c0d12a7f75c91c45eff1167c605efa69d93c6db879c9bd294de2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373279, "uuid": "975a8988-7012-433a-86a6-f965d3e609e2", "value": "T105A52282B28B6EA3FD491674D9E630F104FC1C87B9F2609FEFE50C7559426BC8994932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373279, "uuid": "f1ce77f8-1920-4d63-9069-5ba78f780044", "value": "12288:MUawwS7C60E7FcsUCirWX6Ho1xIUkL+tGQipWm+01hWAiywiQOGTgSmBt:MUaLS7C2G/t+91xoem+Is55In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373279, "uuid": "746ee75e-4415-4305-b8c5-be80b1bb7dce", "value": 2107542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373279, "uuid": "9ac691ae-a752-41f1-8d71-cafb20099419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373279, "uuid": "5fa189a9-3b6a-4240-a180-611a70ddfdc9", "value": "PO_CW00402902400429.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4138382-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779370887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370887, "uuid": "1c990153-536c-45df-ac3e-e9de0daed63e", "comment": "Malware payload (GuLoader)", "value": "9f4f7877140f52cc4225e1db07f659b6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370887, "uuid": "5f0d3818-ed0f-471e-9ba9-6e361af9ce27", "comment": "Malware payload (GuLoader)", "value": "5f792697f057de6b724892329f4013647f52fd32eb6862cd72d7158cddc6d884", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370887, "uuid": "7e3e3d30-cc82-4e2d-9ade-350ec470b8e3", "comment": "Malware payload (GuLoader)", "value": "fb49852bf031ec96b91af632ef2a71e8c72e7aa8", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370887, "uuid": "9deacdfe-de93-45f2-9f8f-9f25737c70b8", "comment": "Malware payload (GuLoader)", "value": "d1bc124179afa72f7104bc1684343685403ca03880daff5518dc7f7f90a9629bf08fe199ae8cbfa850cc7d885c617e2e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370887, "uuid": "596d8244-26c2-43de-bc10-cb553a28f8d2", "value": "T1F4B4237EC0B06736ED65C9BB58DDC26782CA5333E11FA9A9172F1D26401F217460B3AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370887, "uuid": "1c90740c-f86d-4aeb-99a3-4b8e02b603dc", "value": "12288:9w8qqBJLxnfZ7aJIbNKZHNjPuPG6C1LgM/XPNKYEfGY/eu4p:9/qoaibcZHNiQDHVEfG3uI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370887, "uuid": "aae3f6e4-7886-4640-a5cc-cc06a3bdf264", "value": 540000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370887, "uuid": "a24e543c-f561-42a3-8252-9ab623bfdee7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370887, "uuid": "3eb72eb6-9b4e-4b0b-9a00-299d0c83a5db", "value": "justificantePago_es_5678021862895.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58287200-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373283, "uuid": "c1b48448-eed9-4852-a5cf-ffbe591b26ab", "comment": "Malware payload", "value": "28790d8858b72de943a09c3da4a4985e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373283, "uuid": "816320ae-851b-4a68-8915-309516e2f23c", "comment": "Malware payload", "value": "5fdd2761218dfd838de92cd626daedfa234ba6bafef95a686855fa9d261d3773", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373283, "uuid": "dcea5657-e118-4d12-9b05-6f66258556f4", "comment": "Malware payload", "value": "591493fd68faf060abe9749d446b2b2ccd96dcef", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373283, "uuid": "dc5867dd-166a-4575-b0bf-2cde890bb7d7", "comment": "Malware payload", "value": "e4e7f6df213116f7d68925b72e6c7272a1b09cedef6ba5da044c12e78db00e7f780d6212ad4a615cff038df664b61048", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373283, "uuid": "2be941a7-7d4a-47e5-ac38-a8f463fa9118", "value": "T17F83123AEDD870BB5709223E1232CD86D06E5DBCF7D459C00A8B26B8E7C3E59418B791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373283, "uuid": "9e594be3-f46e-4363-adc6-6d89216b2cd8", "value": "1536:9rChMXNP21WCmP8tyb1bhxE1C6K7MfGmbSvmWwpfIGMPnVmPBfHfWIf:9rCa217M1bhxaCZCaOWoIvPVG5fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373283, "uuid": "6029e0af-5209-4fb0-a32e-30eb83714063", "value": 83231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373283, "uuid": "5f5d83d5-2dbe-4cbb-a06c-80ba8a1ad84d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373283, "uuid": "5f16a9a5-d2ad-4314-9b8f-be43de72a13f", "value": "Payment_Advice_REMITTANCE_EUR100999.99-AUG-14-08-2024-00029192_pdf.tbz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d136c58-5568-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779404107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779404107, "uuid": "670ef73b-e036-4521-ad50-6a2be70b3a49", "comment": "Malware payload", "value": "cedea923d22b33d778b1a48102d071e3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779404107, "uuid": "b0518597-571b-4298-89a1-dca38cbdef75", "comment": "Malware payload", "value": "5ffd86adef74a4ee71a5884e74987f4ec573eb6355f794a6c2b993c09466750d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779404107, "uuid": "4fe729f5-5ce2-43ef-a03a-5e56324dcbe5", "comment": "Malware payload", "value": "2d766d5d0391c642dc0ef4b0f721728c11ce9b67", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779404107, "uuid": "1d58feae-ed53-4512-ac7d-f1907bc9f943", "comment": "Malware payload", "value": "4ae6de8e7babc540ce0fd128e9b5b7dffb19936929dfdf166eb12e9fbab3549f27da613610d4f522b449a9db241631b4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779404107, "uuid": "23db553e-51b5-4310-a73d-efe0966bd4a9", "value": "T11A72F93A8C41AFF5061D36A2EA9B1C0B2E4007129564389EF89FD85D7BBD780E3D695C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779404107, "uuid": "1b786256-70be-4053-807c-521a0de45d8f", "value": "384:KEI5mNIu6MPjlpvCbpn4YFwdqAGPKp2mOa:Kx53MBh4Zj+mPKua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779404107, "uuid": "11462a76-505e-45f2-9f45-7e00376b909f", "value": 17305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779404107, "uuid": "057ffae0-c44c-4635-bf6d-0cdf912dd21b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779404107, "uuid": "b1540e2f-3906-41d0-ad73-2443eb0fb8c4", "value": "New_Order.txt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5c3c84-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373286, "uuid": "93e485a8-0641-45a0-9bc9-b7115c1b0c98", "comment": "Malware payload (Formbook)", "value": "4ef25b9f1f37a326a4aa50f2233dcae9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373286, "uuid": "5d591ccc-f94e-4353-89ee-2e96fcead4ac", "comment": "Malware payload (Formbook)", "value": "6015f531bbe7081826657bf3a96e4f9c8650066f00068de3e5ea0214c2a012d2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373286, "uuid": "f4cac770-a767-4356-b27d-fae4780c8e31", "comment": "Malware payload (Formbook)", "value": "639ebbd0f7173bc8f983876a15e389857e6b6813", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373286, "uuid": "8146dbcd-ee8c-4e49-abfb-9f5247bbaf2d", "comment": "Malware payload (Formbook)", "value": "cdd12186ed9f2ad4b5411baa34a2d91b9df619095a44c13929dc8473ad83c448f66c7a6d3d3bf176b590d8f59e8c54a2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373286, "uuid": "c72a47f2-814f-46a7-b6a0-0f917e24bc53", "value": "T17205237CA821F3319F7A1E7C057D2815E94B3C81A489075F2C72648E56227CB6BF526F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373286, "uuid": "5ba486f9-3a99-4094-993a-b235edaaee6d", "value": "24576:yoPCvD9M1rFBfFAhv0nh5lc2pgbcmi5jsOXv1MC8Ez1:yLDG9F0CXlc2pgbo599MtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373286, "uuid": "b2afd18a-f90f-4db1-95e1-97da3dc912aa", "value": 796875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373286, "uuid": "6c2b40b7-bb0d-42cd-810e-e9a2fe6a4a25", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373286, "uuid": "cce8577c-f59e-4407-866a-673c062b07b7", "value": "Ant50068.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee93edda-54ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779351631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351631, "uuid": "0b99ee91-5c23-4735-8027-f6c94fb7cba4", "comment": "Malware payload", "value": "6538a17328ab4fc193ac9d0a4874a9ad", "object_relation": "md5", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351631, "uuid": "d4c4451e-23ab-43d3-bff8-887696f1f179", "comment": "Malware payload", "value": "60532d9ea5f66cdad5568e5875acb5d18635c397992e8fe99b3510fd8d66ad43", "object_relation": "sha256", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351631, "uuid": "40daf465-9fd1-4523-b36c-a43b20ac8508", "comment": "Malware payload", "value": "81eeaff8de32c7271005a59fa291f633537e440a", "object_relation": "sha1", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351631, "uuid": "c49880f5-c0bd-43cf-bab4-3a9f049a3c66", "comment": "Malware payload", "value": "54cb3442838262b358cd80e09b1241b171c8c60d231d1c0e4632c6fc9754ca0c8bb1b5169f6ece785797fe82f9a5d531", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351631, "uuid": "10593704-3521-4dbc-8f84-5c0dab07af86", "value": "T17F71E00293E84627E87B4B396DF703633374F8149F63976E2960025D3CE47245A31B70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351631, "uuid": "b6385ab6-dbc1-479e-8608-60fda8641229", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351631, "uuid": "c2057a23-6557-437f-b378-fae74be901e8", "value": "48:6ZbB+bfSx8jjcAkH+kihkvAUmFrBx1ulH7a32Uq:oB+bfSKP2H/i+vAo5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779351631, "uuid": "4c8fdcd7-568f-44ad-8890-e844173e328c", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779351631, "uuid": "b3d0cd29-b489-4db5-b59b-0e45043b4ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351631, "uuid": "8017c231-9f11-41c0-8570-1aab727d4cae", "value": "toz5smzq.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e969c8e-5505-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779361590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779361590, "uuid": "cb8b925f-d266-4425-8b68-93228b138235", "comment": "Malware payload", "value": "994448e69ba915bad29cd751682ad853", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779361590, "uuid": "857a7bd2-0cb3-4d9f-9f0c-8369ff981791", "comment": "Malware payload", "value": "6061119190545cf3c94f712fd5fda321f54b106bbdb9cf08d64b872dab5fa756", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779361590, "uuid": "fa61ca08-d309-4bc8-83a8-63ea3ff5da33", "comment": "Malware payload", "value": "ec42cf75b2e56f486ded244bfa5a14458f2c3bd7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779361590, "uuid": "7dabbcb3-28a5-46f3-a646-46a94aa6afdf", "comment": "Malware payload", "value": "7ad427be5c22fe444c5ca87dcd0c903e3c4f54c16d7e0e32bb0a54051b2429eb9207b89656e7b73f49a2d8bfd375fb40", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779361590, "uuid": "6e619203-ebac-45f8-9620-d2625ad87676", "value": "T195D42308D595DD39E206077B7584CBBACF91FE231C23E96DE2EFA268543C44D6A422C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779361590, "uuid": "0fa6228e-5ce8-480f-b43f-1d800b9fb180", "value": "0a811601677b0fef62610ac5d6438e32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779361590, "uuid": "d8699137-5cb1-47f8-bfa1-3426ed38995f", "value": "12288:NtUOwCPqQUef9hY0dCR0mbd7tiCq2UK5hpYanH7xjblxXkX5a:jKCI8bYoCfRiAj/HdblJQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779361590, "uuid": "368b308a-e117-4092-8286-1b4991a01f66", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779361590, "uuid": "506a8f2e-b3b6-492f-b341-fa03862790e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779361590, "uuid": "fd7d92bc-7511-4ba9-bc30-e0c3e4f2d523", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61bb1fe-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370890, "uuid": "261dc4eb-1667-4caa-8478-1abcfa606fa3", "comment": "Malware payload (StrelaStealer)", "value": "1e749067de3d75d0dc5c6a8a0ae9e8c4", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370890, "uuid": "791cd865-dc97-4948-9cdc-ad16de3faef4", "comment": "Malware payload (StrelaStealer)", "value": "606cd17e86d15d50e35e49d2f559e9f29cf50ea5562c0f01d8adfdfe0a64b4af", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370890, "uuid": "c57a2319-b2da-44c3-8ff1-8fb03ac6f653", "comment": "Malware payload (StrelaStealer)", "value": "da94bce16ae40b48aa007a706cbb71f5056cc5d4", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370890, "uuid": "d7e78893-88df-45af-8ae4-9cf3a9f7d6e1", "comment": "Malware payload (StrelaStealer)", "value": "ba9abc529ea37bab0d25d3ba73f36fd98ffcbb2d9c6327fa47c1abaafe26631607be9b84ab3b8963769ed25f241f2122", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370890, "uuid": "12f43218-5c94-4a0b-8dee-33306a0fcc10", "value": "T14B642387E62CB393B47FCA1CB441ADEC51E606B49F4E187FCB7D45024C70DB6A828496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370890, "uuid": "521d690c-b001-4dd5-9345-19e594efa9fa", "value": "6144:IB2vUak2zqzlR0txvqcrndLo7FIjE9FEY2xATWU/7O06YLUn:i2vUaGzlR0txnZKNFoMO06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370890, "uuid": "89c07d81-b401-4d32-a336-d0f43be72823", "value": 313256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370890, "uuid": "36446afd-c128-4ac7-9ccb-5a94a2b589d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370890, "uuid": "0e3be643-c84d-4c17-9749-a5f8c6ccb627", "value": "STR-0022382.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab20e93-553f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779386601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779386601, "uuid": "72e6bdb1-244e-4173-97cf-18114e4aea2f", "comment": "Malware payload", "value": "331105c6e991dfc78eebaaf5cfb811e9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779386601, "uuid": "287b498d-2ccc-4ec2-bb10-523ca4e3b77e", "comment": "Malware payload", "value": "6079d0bdf04ddf95a9ec0abbe0c378b42f4233db9683ee9491ac38bc62208771", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779386601, "uuid": "8b6eb827-5768-41b6-a2b7-74168409daa7", "comment": "Malware payload", "value": "356f360dafdefdc982aa2fe9a777c13c1ad72c80", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779386601, "uuid": "81ffb485-ca46-4eef-b63c-460e1f425112", "comment": "Malware payload", "value": "47c61d6756811d8dda80827137ea78a664da06b1cdc9a1fe600cab59e033a5182d4ace3ae038aa30bf58237cfcd1bc3a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779386601, "uuid": "05d792d5-167a-41be-8ea1-0e2d68a179d1", "value": "T198136D6526953C25AE99883B5D7F2F0CB9A983E2304491DDBFCA3CF18C15A9CE31871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779386601, "uuid": "2cbf5c19-4587-4382-92a2-af48da59405d", "value": "768:wr9NyXsZztC59GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:+HusZrco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779386601, "uuid": "3d71bdbb-49d7-48db-88b8-935e07640917", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779386601, "uuid": "c69b54a3-1b2e-46d5-a49c-39bb2114fb4b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779386601, "uuid": "59f55b66-e349-4bc7-a31d-3afaafd6b562", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8211404-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370894, "uuid": "5a538f85-3891-4989-a686-a9d8036c6456", "comment": "Malware payload (StrelaStealer)", "value": "d438cb9316c94d7c5bb1dcaa14bdfe60", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370894, "uuid": "b42c7364-5a2f-4989-93d8-775d9d622693", "comment": "Malware payload (StrelaStealer)", "value": "60cf0a147160040bb0258b2522ed682698c79f4f523b08aabb1adafe067506d5", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370894, "uuid": "504778da-062b-4457-95d4-23f605f17785", "comment": "Malware payload (StrelaStealer)", "value": "b7944a90fd1aff462b2a8955889d20685b21d044", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370894, "uuid": "4f9a268e-bf55-4d16-b54a-397f4cc8b19d", "comment": "Malware payload (StrelaStealer)", "value": "26f1305ca89616faa023e030564715290afd653ad52f50f4618f3f4638506d40d3c676acae26744817d92b5dbb474320", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370894, "uuid": "2b2521d2-b191-43e3-971f-46ce4e6db98f", "value": "T1CD64233A30528768F0F45A3570C9B95E33950A37E8595DE888F2AE3D97042C8CEFE657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370894, "uuid": "46aaf722-924b-4d1e-8b81-1a179e08fe22", "value": "3072:cWNLzk0VE9RyN9V7j1oojN5d2ARC37XdzHhQJRRe0ZP0r4GNqOHlnfZqgWyFCWZ9:caqyvV/JjN5Qr37XtHKJgqCCOFCTQTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370894, "uuid": "4c6ba4bd-01ee-40fd-813f-53184a661722", "value": 332979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370894, "uuid": "560a7cba-aa36-44e3-be71-c25144b18064", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370894, "uuid": "cc8e3304-09c9-438e-bfca-7af3b2f1d5b1", "value": "Verkauf_Rechnung_2488032.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097dcc7e-54ee-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779351676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351676, "uuid": "a6985d7d-b956-44a3-bea1-d8a7424d9627", "comment": "Malware payload (ValleyRAT)", "value": "f7fc30d5d7170ccc57179746f905999c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351676, "uuid": "97a6b024-3ec7-43ea-81de-b91d64c151a5", "comment": "Malware payload (ValleyRAT)", "value": "61b5cee56af11e9cfaf7b5c120372a718fc00207afdb0a3f5480a1d0ee50e576", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351676, "uuid": "7727114f-c27d-451f-a444-4990c5739f87", "comment": "Malware payload (ValleyRAT)", "value": "e0aed6fe93e0e85045ad40f4d6f245d13d48ec22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351676, "uuid": "a5acaff4-f279-447f-a3da-1edad97e55ab", "comment": "Malware payload (ValleyRAT)", "value": "a7aeef766081e837e6976a4bd9d0fc2b73c856b38fafcbe9596dfa341cc14d9c3b2192ffd510cb4f12cf3696535fea25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351676, "uuid": "f51331fc-b52d-4942-acb9-12ac12c4a110", "value": "T1D4842A432E944C84EA9F2570853D98EF9CFB3DB9EFE0918D1394B2CE09F179158B2256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351676, "uuid": "16ff58ad-d126-474e-8e7c-0f8f7f94c637", "value": "61aee1efa149f59d7615c8dc7392ffa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351676, "uuid": "cd4cd9f9-156d-40c9-8b4f-6a2630a0cb87", "value": "6144:APJu1P6gdR/owWwtPgdRLBEh729ZWx+LM:UuNo78ywh729ZWx+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779351676, "uuid": "1d383be9-5adc-4040-9bec-b5121d46731a", "value": 394232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779351676, "uuid": "d92a91d4-9742-4dd2-8179-879c66bfa911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351676, "uuid": "fdc52cc4-48f9-4186-987e-baee38ab805b", "value": "2026 \u88c1\u5458\u6587\u4ef6\u53ca\u8865\u507f\u65b9\u6848pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa9ad4e-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779373295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373295, "uuid": "94ff814d-09da-4350-9550-e364c482c548", "comment": "Malware payload (RemcosRAT)", "value": "6b1f51f9799e3d97ebf2eade61bc3eb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373295, "uuid": "d76f7b28-e520-427c-88c4-c63b73232c85", "comment": "Malware payload (RemcosRAT)", "value": "61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373295, "uuid": "4b31e20a-4417-4ba5-b690-84aa1e5fcbdb", "comment": "Malware payload (RemcosRAT)", "value": "87d0098fea6792e60190dd6481b825b2b25cea0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373295, "uuid": "9d9e3a3f-161c-4ec8-a2ba-e24979b9077e", "comment": "Malware payload (RemcosRAT)", "value": "092a9c16913b2356bc5fc117ecce1660760ec3601aaac328e9cdd4688703256b91b2f65913e37f2fc255fd8b66cdf3ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373295, "uuid": "10441e70-69f3-45f2-a6ca-6852f302179b", "value": "T1B51512A91278E649D6B903B40A76E2B60B763FADF410C30D8FDEBCE77056760B914742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373295, "uuid": "6d26cd1e-195c-4a40-bea9-d6c14963c78e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373295, "uuid": "5ab05b1f-3c2c-4a40-94d7-f382311fec41", "value": "24576:TPDcc0tdP9W1+HWZIyp4E65NtcPqwq7lkE:7NOXHudUDcP1q7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373295, "uuid": "80d4d0b3-97c6-4217-8d2a-dba0694189da", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373295, "uuid": "91c7bee4-ebe7-41c6-aec8-541b15aad2dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373295, "uuid": "a63b1ba9-deec-4700-86c8-ffce30b9bfa1", "value": "att1-240906081402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a3b154-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373299, "uuid": "219e8222-43b2-483d-ab3b-7ea2f93997a2", "comment": "Malware payload (Formbook)", "value": "7547bc649685334fb550e068942a8743", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373299, "uuid": "d5e8f79b-5eeb-4867-b392-500e5b098c56", "comment": "Malware payload (Formbook)", "value": "61e15f11c7f13da4c2247f6da065a30a39c57dd3565bc1adf9838ab7603041db", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373299, "uuid": "8fb7c015-73d2-49be-a005-e70dbfeffa5b", "comment": "Malware payload (Formbook)", "value": "d4ed83a08d30ef07542ed4a80fc0cf5adc4eed5c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373299, "uuid": "3bece42b-c9b3-4bbf-ae5f-ad3fed8200d4", "comment": "Malware payload (Formbook)", "value": "b6c9158eeb8cb7353ed7a0522c20fa327530dbdbb9e891268800188ec37f3614bccec765a59139b6ef4e84c8b198fd1a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373299, "uuid": "23f10020-9aa9-4d82-aaa8-b0176f62ac16", "value": "T1F105331A76E334171BC20C424FB9AD0BCFAA9641C82C620517C936266B95E27EFDC77D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373299, "uuid": "5adb2f2a-0ece-4775-8d9f-cc61b279cb15", "value": "24576:zmMLhZ9tHN/LCHc+WIEQeuZ7NMG24NJEdH2+SGWJxqvT:/9tNjWcwEQeevIHBfW67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373299, "uuid": "2e11de8e-23e2-4934-a3a2-38461862f3ce", "value": 850786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373299, "uuid": "abb43c42-d51c-43c6-b5ff-21ad54e2d97d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373299, "uuid": "18022933-41f7-49e3-9d03-2a4e764a14f8", "value": "RFQ-5024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d9daab-5512-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779367286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367286, "uuid": "92d32743-73c6-486d-a67f-77668240ab70", "comment": "Malware payload (Mirai)", "value": "36eca9c3721471a3e570101088ecd819", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367286, "uuid": "53c693d2-88b2-4a75-b343-343bb8c7c7dc", "comment": "Malware payload (Mirai)", "value": "6237be088d8e3a8f4b3f9f709f0892f4fd85eaec942ead26a1b071b3dd75e333", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367286, "uuid": "c286bd8f-6861-4968-ae11-b73b27c6a7db", "comment": "Malware payload (Mirai)", "value": "fdd53c6821e38b3fcda619f2ab17b280270c2f44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367286, "uuid": "b416912f-50fb-4613-983e-983ecff7f25a", "comment": "Malware payload (Mirai)", "value": "5e087b2df03671ccaca4c95a501a49726179f6450885bbfdde985ad3e1fce0691318e8d21b158ab4fc993ce2692081f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367286, "uuid": "1f0fb78b-2c88-40a3-9cfe-1259aec9c66e", "value": "T17743F2B062A269701B2435B5E46C83CB9AF55B7864FC73D316240A69309F9D344FF1A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367286, "uuid": "76d8c4df-a2cf-4536-8342-02b591077652", "value": "768:fz3Qlasi8QwD/1RxPwU3wqBP9rN5qg0R+7lA6BEXJqNRs/NBu5tjUqLvptidTh3k:bglSg/4U3RzXq+GJXINqBu/TTpti/MLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367286, "uuid": "daddb986-90f9-474d-bc79-2ddff5d6e587", "value": 56932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367286, "uuid": "849fd5d0-0dce-40fc-830c-670a510ab2d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367286, "uuid": "864c1c57-7bd8-4642-b216-b534ff00613d", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a05f7e-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779373302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373302, "uuid": "162774e0-2c29-4aa6-8543-da28083d7bdd", "comment": "Malware payload (SnakeKeylogger)", "value": "80acce1b0b734751adf1b9dcdf7db484", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373302, "uuid": "50810fc1-9f3b-484c-95bf-84b6079ca591", "comment": "Malware payload (SnakeKeylogger)", "value": "62b5e59a7d36f291c024e126bb932ae698e6d5e98a83f2f855f23852fc5696e5", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373302, "uuid": "e1cc8bce-af1d-432e-a743-509057866ce7", "comment": "Malware payload (SnakeKeylogger)", "value": "36a0dee59932579d6804d5ef135981e222fc394b", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373302, "uuid": "ba5177e5-7cfa-4b71-988e-b22293e6a730", "comment": "Malware payload (SnakeKeylogger)", "value": "7eab99c5824182db907c3c276d480e28e6cc77623f4b86adb6e14c16f141f563e695ece8588f0fbf96e23917f6ff0e6f", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373302, "uuid": "be70ce87-9bce-43d1-9085-f3d7cc6e24fe", "value": "T15A25336915EC24429EAE4845C26CDAD5F02F63EFCDE73CB85E87C26B9D147C0620295D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373302, "uuid": "df984581-6dc7-4974-833c-0437a6db123e", "value": "24576:4t7Y8R39qYXC6ruzSTzEyIT9e2j+nBupwmYhXr:4t7Y89qYXC6ruzS8n5dawqhXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373302, "uuid": "dce7c36a-e085-47c7-ab74-1cbbfb9dc732", "value": 992706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373302, "uuid": "7022ed82-e094-4ad0-a275-7e3f30da461d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373302, "uuid": "90c8a6da-72f6-489d-920d-7be47610595d", "value": "Quotation_1380567_FLUID_PROJECT_DOO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2ec91f-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370897, "uuid": "10cdb471-9f08-4a57-809a-d30eb1bc4f47", "comment": "Malware payload (StrelaStealer)", "value": "7d2f31260055eded5c12e643657a524b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370897, "uuid": "ba3f562f-b0cb-4907-979d-f6ad86b89750", "comment": "Malware payload (StrelaStealer)", "value": "630b4c722fcc0614589fce966fa339978ff42a793073fdbd58fe841d9be1b04c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370897, "uuid": "19475847-4e33-475c-a209-13072720724a", "comment": "Malware payload (StrelaStealer)", "value": "ac8025eb2be84262995bfb0a986a0fb06a68bfae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370897, "uuid": "e7f9380d-9e9b-4ea5-9cce-d717204808b0", "comment": "Malware payload (StrelaStealer)", "value": "ff17f396e3aa311864e5c39366633a9702e0e154116f5f6ea205171811a625e757989ad555f7f3976e6927838a43eaaf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370897, "uuid": "9f906ffc-ada1-446e-85e5-d2b8b0e6c4e9", "value": "T127C42D26EC0D3A7D4C313E819644FB3C824A06B65D18CC889C7D2FAF4D75BD6AAE7914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370897, "uuid": "67ec576e-9ccd-447a-957c-9859e8d3cd55", "value": "12288:Gyod7HUMBmk8un7PpotEn0gQoPd/qc2onXadWVpYGXAu+w9QMVS9/jKlx2PoXa+f:Gyod7HUMBmk8un7PpotEn0gQoPd/qc2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370897, "uuid": "38855ac2-bb8a-495c-b7b7-c86ac3d15036", "value": 564688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370897, "uuid": "c2e963c8-410a-4f18-bfcf-0118e2744469", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370897, "uuid": "bbce3904-0543-4c47-af69-11d44745fc80", "value": "463425474175875268.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1ea407-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370900, "uuid": "ce96b9a5-ca22-4813-b139-a4b541d06eaa", "comment": "Malware payload (StrelaStealer)", "value": "a2667a80f74fe894ab905fbe36b86240", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370900, "uuid": "2254410a-d059-491c-a011-98e097d42bd4", "comment": "Malware payload (StrelaStealer)", "value": "632d5cd8d069e9e9abaf9b4b7dbd804f84b9a91765e71a5051b140b137fb8878", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370900, "uuid": "63500910-a397-43d3-b324-af090e07cd01", "comment": "Malware payload (StrelaStealer)", "value": "f96ad5017fefd1ad3737f343aebd941ac60817e5", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370900, "uuid": "830dd8aa-558a-4d2a-8c58-ba37fa06ade2", "comment": "Malware payload (StrelaStealer)", "value": "545be2af3b1903417c18b33ae9886d0126f8c617537fee690d4241ceb63953f5696455e95215b74f17f8a8e2ec22968b", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370900, "uuid": "22263574-75ed-4b9f-bb83-83bac3fc97b8", "value": "T1AE12AF3EEDC9716AEC0A63F8153D958DA80349F89703D31C3D9CB9897358F676923452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370900, "uuid": "dd5ef0b8-9ab1-49f0-821e-4aadca97a411", "value": "192:y2oqstEQp3825K535L81AMu1b5NUT7hGERYu72f37dvApiMld2avk7a0/:F35C+QBu1daTgbTgiMldyR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370900, "uuid": "d2d63cc6-a2fe-4b86-84d4-9e1af27251a9", "value": 9440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370900, "uuid": "c5569000-077d-4b61-b537-5716d3f945cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370900, "uuid": "c03a5352-b028-48fa-92c9-2b84f0739c6c", "value": "R2024938-17.11.2024-FlaMar_GmbH.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672d7c88-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373308, "uuid": "df9023cb-a07c-4a1d-85a3-4a3bc858dcd9", "comment": "Malware payload (Formbook)", "value": "4004f7d09f1ff465d2307fdfb0c1df9d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373308, "uuid": "5f30944c-83a2-4ff0-a60b-1333800f908d", "comment": "Malware payload (Formbook)", "value": "6345b969d4b0eac65192bf6f6b9803ec27c63f9b26a01324b3f5e663d86e4cd8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373308, "uuid": "b9e4b732-8a91-4606-9d44-58eb86a8eb83", "comment": "Malware payload (Formbook)", "value": "13b438caa8d2e5dd4f19450d95ea293aaf815b20", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373308, "uuid": "69a7fb8d-7a02-4044-b6a4-df37119fb403", "comment": "Malware payload (Formbook)", "value": "917dfcf91d6b4628cb0d711905411c62072f227bc2474814edbd5baf73c0dd2bd716a8082bda4634d54df885d0c9d5ee", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373308, "uuid": "41f00280-1861-4d4a-beaa-cb066a771d58", "value": "T15FE4237FAEA1975F66B65EA6C4C9C1CCB5BB206E1113D051E1289047727B188B0FC2EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373308, "uuid": "d1d5f857-e123-4a33-a772-3d13e5892813", "value": "12288:xpD2CFejbzh8A1nLsQpivjLJ4uIn1yquVsfbVRM0QlEoMEl1I4ezI7:L6G+J8EpCLJ4Nn1yqAsXHQEoMElJeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373308, "uuid": "f3cb3c90-1568-4f9d-b451-cb071f34d4b8", "value": 718491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373308, "uuid": "f5a6b5b3-a529-4136-8c7c-d51778c7b35f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373308, "uuid": "e2f07ab2-8903-455b-93c5-71a7664fda22", "value": "PO#82924A.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693770cb-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779373311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373311, "uuid": "cf82bab8-6bbc-4833-81ff-ccb7737f26e6", "comment": "Malware payload (NanoCore)", "value": "e095ad7079e3f917e6fa3520f5f6837b", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373311, "uuid": "f60f7523-e02c-472e-8993-d97d49075b20", "comment": "Malware payload (NanoCore)", "value": "63473c0a1e1cb330bfea9ee05aa9518bf26f6089391a58cc4b02ef82837b4597", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373311, "uuid": "653b557e-6705-4999-8288-5aa4b819f9e4", "comment": "Malware payload (NanoCore)", "value": "4db5b3a212e2c09b421cbd545eaf1677dacc1071", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373311, "uuid": "55905a70-2edb-479c-82a2-19cd28aa813e", "comment": "Malware payload (NanoCore)", "value": "ab8b5f954fc2571e8f98f0751545ab07cef6631f3d5b072ad40c78b438f82a7bcac381c282a808652996569abd84c1bc", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373311, "uuid": "ffa8dccf-e507-478c-b3ef-61b4ca77ed31", "value": "T1AAF4238A809182EE998EF41AA56B27BED087D4DFC7B3C94435803E314FBE55424CDB6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373311, "uuid": "ea89486b-bd0f-4644-9ded-b630148cfc6a", "value": "12288:xAyun5p+C5eZaHr3Nvcjp/6ir5txtza630SoVnHkW/B7skhcozqrSPtJ96eroLlA:xAymcaDNsp/6u7xhaO0jVnHkChnzqG06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373311, "uuid": "53ff244f-c26d-4ffb-a3eb-f31d54a1d87a", "value": 775572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373311, "uuid": "364a2563-d6d4-49f8-8e0a-22f7bad9605e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373311, "uuid": "60c99436-a20f-4673-960d-43a88c48ea9b", "value": "QUOTE--GEIXREFX2177700XX024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0ec647-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370903, "uuid": "3fefa49e-5654-4037-a269-785aa7d157e2", "comment": "Malware payload (StrelaStealer)", "value": "f6056d312705fb66abdc58ed2bcb9803", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370903, "uuid": "34353370-7fa7-4266-b8a7-43a78bb1e589", "comment": "Malware payload (StrelaStealer)", "value": "637278fd1144e7eeec4726257f32cb88508a7760b12ed33713445f18a1486a27", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370903, "uuid": "7a8a5331-749c-42b5-8d7c-869c3a5a727d", "comment": "Malware payload (StrelaStealer)", "value": "1a1e5db3742be336582fa889875e4a984b64cf3e", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370903, "uuid": "190c715d-a068-43cb-ad0c-ccd2328b331d", "comment": "Malware payload (StrelaStealer)", "value": "0b22c0ec2a6038e7cd96ea6142be85bb0f8c32478b411ccea33d8af4709d1d1688e50037e41b1942b8259a2da46b14ba", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370903, "uuid": "4baea509-e4ca-4b4d-bad8-fa08f811d642", "value": "T1341423A14CD14849C71F19FA25A1D2839EBBEB002BF7181ED39DF79271429FC968DA4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370903, "uuid": "25020ce6-ae5d-4685-a627-90ac51419285", "value": "3072:sfZZ04lXH8HTpec33OuVSa60vlDXtKDPxfLXEByE1T3lffwKZvesV+xGjKNByFzi:sRS4NG7+30tDXtYX2yeT3JfJGsggKyFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370903, "uuid": "335023f1-fc04-4505-b8f4-a34af90170c4", "value": 196580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370903, "uuid": "408ea7f9-c9f1-4961-895c-f09cd4e9100a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370903, "uuid": "180afd90-97bd-4fda-9084-06c12bdfe56f", "value": "Rechnung_321661_2024-09-25_1233_48_529.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd28349-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373317, "uuid": "af6e5d75-b4fd-4514-b9d1-04cd9d64c124", "comment": "Malware payload (AgentTesla)", "value": "a0e599da4e39fa66822f2cc2b250a2e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373317, "uuid": "c8006f89-85de-407a-bf33-4a2999cb0815", "comment": "Malware payload (AgentTesla)", "value": "6395396ea7ab2d1c35062f10ef2cad39e5c42a5f8ff50d6a6564d76259542b03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373317, "uuid": "3a02907c-f164-44e8-9f9c-d6b6ada9feee", "comment": "Malware payload (AgentTesla)", "value": "d0da7113c2756450e3037b5ba6d2873316374e6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373317, "uuid": "4297d368-a1bb-4fa7-ab45-0adf9add6df1", "comment": "Malware payload (AgentTesla)", "value": "662571b9d06f90c234b9f682ebc6e65c7b5a902a3c656f62517b23c360f77a48bf3d4c4675d54c21e9406fb72d5352d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373317, "uuid": "84a444a9-80ff-45e7-902f-a3ac929c0812", "value": "T1D235BF027391C062FFAB92734F5AF6115BBC6A260123E61F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373317, "uuid": "77a26f74-f381-4fe9-95bb-b620252903c9", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373317, "uuid": "e09681cd-c4da-4c47-915f-1faaafc2b18b", "value": "24576:HqDEvCTbMWu7rQYlBQcBiT6rprG8aUAsOmfTb3QF6:HTvC/MTQYxsWR7aUAOLbgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373317, "uuid": "17a4c440-673d-42a9-b66a-4d3abb34a835", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373317, "uuid": "10c73291-b6f9-4d5d-b4b1-a5a179a13d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373317, "uuid": "2b9dd922-a23d-4417-ba5d-a44425d2c8bc", "value": "COPIA_DE_PAGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01143c2-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370907, "uuid": "ed9a83b2-dc25-4a20-bb58-8d773ceb180e", "comment": "Malware payload (StrelaStealer)", "value": "bd61a6a623003d79a019aef296a3b23d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370907, "uuid": "52083000-ea50-45e1-ad08-b7a8ae309d3c", "comment": "Malware payload (StrelaStealer)", "value": "63e7782414720ae514562f43513351dc1071a6d70e5951bf7eaf579e6957f3c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370907, "uuid": "093f5cb6-e385-4d06-b137-1dd970d0b256", "comment": "Malware payload (StrelaStealer)", "value": "dd793b3180e01a813eca7a1cdd7d7ecea2c4f1f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370907, "uuid": "aa3719ac-79dd-4ca6-95de-1dc2fd3a5d2a", "comment": "Malware payload (StrelaStealer)", "value": "2c71db0e2edf7c8f99483317c53b6514241715293d0a95ed5389994f65e09f73712cb966d91fb52c3fb20df2a187128d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370907, "uuid": "9d0937ad-8b36-4dca-85a5-516210d2caa7", "value": "T1CB93CC6F4BA6F3BECF5BC18D90C50AE5C1D08F4117135A1E96AFA26592421DACF023E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370907, "uuid": "70702eda-961e-4a96-8d54-83a1c69da087", "value": "1536:peUOL6HwRBz0L6M03L61giF4+L6A9zpL6pI+7L6iL6yRxlwcL6AsOWy0FBlbNsL2:peUOL6HwRBz0L6M03L61giF4+L6A9zpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370907, "uuid": "4d904351-c286-49cc-8b3b-ed7c2f5fd404", "value": 88883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370907, "uuid": "d0a6131b-9071-4df4-9ec1-55803c5d5036", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370907, "uuid": "b41809b0-f48b-4362-b99e-5da6c32ff8d5", "value": "99143121155889081.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708dd796-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373324, "uuid": "632edb92-63fd-48ae-8f1a-9226ceb5dce5", "comment": "Malware payload (Formbook)", "value": "9f91dfeff30e605d9bd18ab68547fba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373324, "uuid": "b2de1e19-a291-4fd8-8b42-3118280514cd", "comment": "Malware payload (Formbook)", "value": "644892e9fe96231990ad8095237bafee16d1fb77aadde35cd20105cef5f4b922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373324, "uuid": "5eb72fcc-a753-4a33-83dc-f7f9681542d5", "comment": "Malware payload (Formbook)", "value": "b3dad7503cf0472834ce368230fa2d36f4667f65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373324, "uuid": "7ba88f63-46d3-4579-8a43-ba5477874581", "comment": "Malware payload (Formbook)", "value": "aadcf7ed71c11d41cbd55e3362ee3dad5dc4cd592a0f01110bdcdc277a40e3a68826cfa0b220d044203472cf10c230de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373324, "uuid": "7589ee71-c7ba-44aa-a579-e61ee60e0074", "value": "T14C25DFAC361079DFC867C876CAA86CA4EA60747B471BD203A01705EDAE4DA97CF141F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373324, "uuid": "970de4b3-8d28-4497-bad6-a372fb79cc77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373324, "uuid": "cc6366d1-f25f-43ac-9d10-434d926a2300", "value": "24576:601WhUk+MCR3kXIv0MMZBdeXMpHQ8e2R5M:60Uik+Mol0d/deXMpwnAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373324, "uuid": "da7d2aae-3aff-40cd-9719-f509e0034d62", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373324, "uuid": "1f7426c3-2aaf-4e7b-86ce-7e8bb4fa1850", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373324, "uuid": "99ee3c32-b8cb-4865-b239-abc18c35daef", "value": "Purchase_Order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72927567-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373327, "uuid": "e7a34108-1f65-4142-9073-670925748f60", "comment": "Malware payload (Formbook)", "value": "6fd182ad2cf1693dec1d061d8088ba58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373327, "uuid": "72fb5e0b-4276-4d74-b884-43784ba12cf1", "comment": "Malware payload (Formbook)", "value": "64b37e90dd772573c46014c2fa8a1a7a1b69df4a6a16f573d0312360e404c60d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373327, "uuid": "db85a82b-0f69-4833-ab5e-3554d6ca46a8", "comment": "Malware payload (Formbook)", "value": "36e0b6fca32afe276aa6264b463dbc36d5590864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373327, "uuid": "4eef04c5-f6b4-457c-910e-178fdf5604c0", "comment": "Malware payload (Formbook)", "value": "bbadab4cb10dbfe3914b666bc79509f0678375149d81f670fe3a4c5b49ef3c550b81c6e8629181444869665ba5d5763a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373327, "uuid": "9ca16c55-dc3d-46be-827c-2e8c43bac11a", "value": "T19F55C00373C1C062FF9B92334B5AF6515ABC69660123E62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373327, "uuid": "593b5bf2-c619-41fc-94e0-b73efee54afb", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373327, "uuid": "e19aae99-b847-4815-a1a5-1b2f15713519", "value": "24576:5qDEvCTbMWu7rQYlBQcBiT6rprG8aBq2GuYNciMhzBU5H:5TvC/MTQYxsWR7aBqPuY+iizBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373327, "uuid": "8436863a-efdc-4d2e-8e2e-a620ad744ff7", "value": 1303040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373327, "uuid": "f30ae3c2-cd62-45e2-849c-e5b4ecf82352", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373327, "uuid": "0af56f18-033c-4026-939c-8bcfef5253f1", "value": "Quote#011698.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c9074f-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370913, "uuid": "6a2b6f5f-9677-4e55-afbc-6737c0f149fe", "comment": "Malware payload (StrelaStealer)", "value": "12c540a6c057f162ac6c91ab326e9cd9", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370913, "uuid": "dcf5bb82-886c-4280-a088-45fc185b1707", "comment": "Malware payload (StrelaStealer)", "value": "64c14cb1ffc900c4233b2b4b68ff32a9b89658371f8191508aa0916f60c9120a", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370913, "uuid": "d0400ed2-cb1f-4d8b-ba61-3f060a3244a6", "comment": "Malware payload (StrelaStealer)", "value": "4eea4efa6e4c234045601517312a408c0674f3d0", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370913, "uuid": "37bb64e7-54d7-43fb-a13b-1297c8c556cb", "comment": "Malware payload (StrelaStealer)", "value": "25ae9f31d8a79e304afbee17399481e649aa63d1686f89a22f5753e1d57fefda57b0275a76fa2763bd0b794827fc8e67", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370913, "uuid": "de20380c-7902-4c91-81c7-525348c63853", "value": "T1736423CE5CDFF209BA94E8BC0E689717B60B753A530436E69DAAAF30147C5E8CC560D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370913, "uuid": "89bf8f09-33e3-40ac-8545-d64e3a74f998", "value": "6144:lGoVJayNHDaprT3kwNhC0EIfP/WZe29t+CslrX3dUpJKx:lGQNjaZT3kwvzfPw7KrWjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370913, "uuid": "f5179ed7-2c27-4b7b-ab17-eb7ff5b1d6c8", "value": 317448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370913, "uuid": "9a201966-933d-4847-970a-c055fb4fab53", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370913, "uuid": "19ce4275-5d9c-4d62-b3db-bc800249edb3", "value": "Re._2024-36__2414__Petterweilstr.20,_60385_Frankfurt__2024-07-18_Energie-Bedarfsausweis.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762d1415-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373333, "uuid": "ee4adc45-8b45-4a48-af79-2951ee306484", "comment": "Malware payload", "value": "342da473b30b3d8e5c0fe64647fd10c8", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373333, "uuid": "e1272661-fcb7-439b-ada5-9e008b02dd05", "comment": "Malware payload", "value": "64c2209bee18c83bdcda37d0594c92245c1ca53a29ca183ee41141db2836cc97", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373333, "uuid": "057794ae-7fbc-400a-bcc5-7dfac784f58e", "comment": "Malware payload", "value": "d2663728d9fb30729d683f5ad0a8d0611edc3cb2", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373333, "uuid": "488ab52e-c7c3-4e2c-a97c-bbbbf50435a2", "comment": "Malware payload", "value": "ee20b8664770e05eba1e6a3b6eb0227bce6cca9f1cbf523a5e437f8ce30b62395fa2ab25fff9dc72dfb63f3790a23c10", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373333, "uuid": "bd1f69c7-2a95-44af-a68c-528455ffb669", "value": "T186F43363900CA8D31B8E376A9293A4C1447AFB56877C57EC33687CF70E886F974A5D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373333, "uuid": "2226d6d8-ef9d-4f54-8461-0f48ac107777", "value": "12288:ZyPNqFcZj8qjshYWHxA//1+TtFoMJhkxOQvmOYkRNDDobvVw22/uQHSUEFhkZRFw:cVqg3GYkA/dmtF0UamOIv2Y0Sx6RM6Fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373333, "uuid": "9822116a-51ee-4406-8429-a87be6b2c2a2", "value": 732996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373333, "uuid": "45c334a5-5d4d-4ddf-bd87-a61092f974a1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373333, "uuid": "ff683cb4-1a29-4c7c-8e4d-55f11af3773d", "value": "products-list.7Z.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d73f87-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779370917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370917, "uuid": "c85bf166-0226-44f1-b228-4f75e62ac439", "comment": "Malware payload (SnakeKeylogger)", "value": "ed54f068782aaff84dce2776a3ffbd73", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370917, "uuid": "619f43b8-91e2-48ad-9292-ae1c39d35637", "comment": "Malware payload (SnakeKeylogger)", "value": "64c7c1b70a135415a835bb48c638ca47db929b1df28bb62aaacd9cdcac76553b", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370917, "uuid": "453cbe7d-ba6c-488d-b5ff-a60a03d3ace8", "comment": "Malware payload (SnakeKeylogger)", "value": "48a75d4b075131bf9abcfb3b77e64ace881f1b8e", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370917, "uuid": "cc0f5914-f268-4759-ba7d-a809e13e6d33", "comment": "Malware payload (SnakeKeylogger)", "value": "46cf30ccc5d3c71fa081ed0b3a150f98bce28bc804d1b27790080578b4a579764d19ca851b2293393319b8e59209570b", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370917, "uuid": "b4ed1116-fa12-4c9f-8b39-0f57bfc0bac6", "value": "T1C7D3250222EA6008F1F33F569ABA59B94F6BBD59593DC25D548C1A0F1BE3E40CD217B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370917, "uuid": "3017ad38-2c37-4e40-8823-237925a0bcb1", "value": "3072:SXs3fFf2ghaYlNAuaq/XDptbxILKDngt5pPGwm:SXSf4eJA0XDjbKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370917, "uuid": "b05e652c-b5f9-4345-860b-0ac666999b39", "value": 140828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370917, "uuid": "e0e42180-bbf4-4ed9-86a1-043ca464d544", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370917, "uuid": "ea66a923-c4f4-4f8b-a1cb-af5722dec82e", "value": "INQ02010391.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214c0b27-54f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779354293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354293, "uuid": "30c9ca94-7036-4962-b174-8cc5d6cfe24d", "comment": "Malware payload", "value": "cc4f465f03963314143cfdfcecdfa223", "object_relation": "md5", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354293, "uuid": "4eb68db8-fd32-4b61-b422-25e47fcf2493", "comment": "Malware payload", "value": "64d5c02f52b53a785e199ce040baba4f8520b46408ea7660ef99ebe654660ee7", "object_relation": "sha256", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354293, "uuid": "ec35873e-7e37-46db-8705-5f0ae365b9ba", "comment": "Malware payload", "value": "da48e66c7112fe57d69470e06eea9b4a5e52a251", "object_relation": "sha1", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354293, "uuid": "4ec6b5c0-b808-4cfa-b9b4-636c6b3ff175", "comment": "Malware payload", "value": "b08c28b3f73c3eac11ecb062a5974e605111a06cda4a5fc59e56d1072c778542efe99c52474705c2d06e63c11bec287c", "object_relation": "sha3-384", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354293, "uuid": "3ba27804-ef35-4858-92ef-e56b031b8fa8", "value": "T13031251457F9071AF3B28A7869AE5205883BFC1FE9718F0D8365114D20B4A13EB7AF27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354293, "uuid": "5f3b3538-773e-4d2f-a254-0519abb4094c", "value": "48:8NxoWGPBa6x1qZzALDxdiz1qtVzFRaQR:8NxEJTqZ4Dkq7FRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779354293, "uuid": "378ba7f6-d3e1-4150-baaa-c6e46492bc53", "value": 1742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779354293, "uuid": "3fd1808f-2d04-496c-bdb8-490686fb70bf", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354293, "uuid": "0ecef33d-d810-4801-9456-989cfab29255", "value": "MR List for RFQ 5307.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c67dda-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370920, "uuid": "cfc63a22-2ffe-46ed-a19f-99d721936ef7", "comment": "Malware payload (StrelaStealer)", "value": "9585e51078aedeffa328deda0483c1a5", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370920, "uuid": "6f4d58f1-b3f6-4f04-bca5-b74fb098e8fb", "comment": "Malware payload (StrelaStealer)", "value": "64fcd0ffd9c3b6c2738a6bb91c6e1fde8353cc2c7916f935e22a83b1138780ac", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370920, "uuid": "c0f6f769-dfaf-4b8a-b91d-e0899eeae034", "comment": "Malware payload (StrelaStealer)", "value": "4b0b3806175477b7cfe45643959d8895f01fb92c", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370920, "uuid": "716e25e9-a7e8-4e77-a1d8-a921dabc1d58", "comment": "Malware payload (StrelaStealer)", "value": "7375562b28a950b5f27ae311a1d458f7c0294b73aec45c756d2d16e97eaf6e145cc5bd179d06c4a2f932296bc424316c", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370920, "uuid": "221baf73-34c6-47d7-9475-2f2ee168a79b", "value": "T125F31229F49B9EDECF0880D3F10316749524B392EDE334EB79227395C968C047AAE59D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370920, "uuid": "a5ebd681-931f-43a6-b013-6b06ae58ee03", "value": "3072:4hcoxvqUPuRZcOpZI2EnOuYLH0svyA3fcW5s6dWLDF3QD4D6cTL2a3b1MBmn+9:4hcSdaeOpZIh+TNfn8a4VTLH32BT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370920, "uuid": "1c145618-c344-4413-b84a-7e6744b01ae2", "value": 164871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370920, "uuid": "a9102f28-3e40-4d12-bea7-f75820d11d41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370920, "uuid": "3f2849ed-9259-40af-bc44-b811dba69031", "value": "R_C332175.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cb46e9-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370923, "uuid": "8c85ee58-3711-48c2-854d-817ca6ebfe05", "comment": "Malware payload (StrelaStealer)", "value": "3a3057f5878942ae34911719025bbdb5", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370923, "uuid": "a264e161-7973-4c73-be75-4c2bbb4106e9", "comment": "Malware payload (StrelaStealer)", "value": "65043cc160cd769115d4c1c4a7f66f96c07910cfbc258e9d9f909106ea2a6e62", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370923, "uuid": "0bf587a1-820c-4bb6-afa1-4e0c498d351b", "comment": "Malware payload (StrelaStealer)", "value": "23972d92bd78d62b9a38342fb20d52b8c60fcba9", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370923, "uuid": "82e6efe0-65a2-4f9b-b074-9a0287fc7a26", "comment": "Malware payload (StrelaStealer)", "value": "4915383c6c598cda59547e9c0399480ce2d29298319574064164b660b189616d14921e490d54cc40d92f7ece4e037676", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370923, "uuid": "4a1299ff-7b9d-4f6e-8ebc-21b1e08988b5", "value": "T18264233753701996CD1C7CF22FFB3241B20879EA1BA96BE7930616428F9D58613DF181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370923, "uuid": "0c62df30-1758-4ee1-8c2a-3aef9c4a261a", "value": "6144:vSLEw1tMWZjaVdqyaShun/h/lauLHo3dSc6cpTSUkxfZSfcTUs:aLEwQPLPaShuJgaHo3UcBSUdfyUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370923, "uuid": "060968d7-21e3-411d-a328-e21718a6f54b", "value": 315876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370923, "uuid": "d9630654-8224-4778-8dcd-117bae0a27f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370923, "uuid": "78d2726e-7fd8-4f53-b21e-9da0bc0d3147", "value": "RechnungX3422343.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcf2d88-551a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779370927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370927, "uuid": "3e93f049-1d08-4aa2-b282-0fddedd9c1c9", "comment": "Malware payload", "value": "8d366af5bf2de7c8453c6886d3b1ad2a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370927, "uuid": "0c48838e-18cf-4144-a637-ffb21f0671e3", "comment": "Malware payload", "value": "6590d9056b142452cc3133327c4a2d7d38175728b1512581b6abded3de8510a4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370927, "uuid": "e6f763c3-b9ae-48d9-a676-733947113c37", "comment": "Malware payload", "value": "820e87689644052965f835b03f2e70253fa78f0f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370927, "uuid": "56d324d2-7f77-43bb-bc32-953c15694c39", "comment": "Malware payload", "value": "a03a522adc65a6baa7695d2c46adef8462344de72f9e4e62690e24bb2702debbb942e9e3ccbd0c3190d52c9d13dd976d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370927, "uuid": "8cfe1b6e-5d6c-47c2-ae93-f85d83e02c9d", "value": "T1967302B298719AEDC78A817719C8223DD388990F5F4F411EAB62C6FD94BF0774751141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370927, "uuid": "3780b950-547b-4726-8d05-b0f97b0309db", "value": "1536:Xte6trQ5lcyjRgDJYIq1tI34qbjfU3jmgzIY0I7B7+B0aE:ylchDJqMZUzmgMY77ZaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370927, "uuid": "8aa5c82e-1a84-45bc-b351-b474fc913045", "value": 76421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370927, "uuid": "be9856ba-7bdf-42d1-ad04-31d5a12da5fa", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370927, "uuid": "9b8524d6-222e-41ab-a878-075410db6174", "value": "CMRXART009.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf07b49-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370930, "uuid": "f27c5143-aebc-4041-ab9f-383835c7de31", "comment": "Malware payload (StrelaStealer)", "value": "17e0afe3bd57b0554d373397f235a037", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370930, "uuid": "68591eda-0720-457f-b5c5-a5298f9bc294", "comment": "Malware payload (StrelaStealer)", "value": "659ec5b697134eab7f2e0f89e807c5bcff6a6bf5644618a2ae777be7b28d122f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370930, "uuid": "303251ff-9d3e-4c14-ae47-27b52cfd1ae2", "comment": "Malware payload (StrelaStealer)", "value": "91ec25ae1d4741019e45e44933a9a2d4d519f605", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370930, "uuid": "15f9f25b-9b6b-461e-af3e-ce189688d7c1", "comment": "Malware payload (StrelaStealer)", "value": "9fda88dca9f597fbc55a29346adf5bb991d83ca2f7791cc7db478faf57bc0131aa980a312e204cf062f9ff97f299264f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370930, "uuid": "7af4d7e2-962c-4157-8e4d-7c91a2834dbb", "value": "T10A25AF70CD5956117CA9AC8E82EE237D558E1F337D2588E8DCEB27050932FE39CB251A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370930, "uuid": "2c95c89c-753f-429d-a832-42d724d67427", "value": "12288:xcAONqEji7mb1Rd5dOqbxpaRjj7ojj50j1C+0r:jOMR7mblzpwWWC+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370930, "uuid": "145340d7-3474-4208-a75f-77c54613531d", "value": 1037610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370930, "uuid": "6b3e10bc-7c74-48aa-9ab6-f20d9302c3d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370930, "uuid": "a1d8d42b-8195-4f3c-be94-3e45dedf0152", "value": "15621181301528125969.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e007b7c5-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370934, "uuid": "2330ba4f-9adb-4524-9bf7-c4baa7e110c7", "comment": "Malware payload (Formbook)", "value": "afb5764df2c2a4cab0c9e3d20561466d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370934, "uuid": "3b2f64bb-ade4-4533-a491-d52b9aa947aa", "comment": "Malware payload (Formbook)", "value": "65d0365b8d8a2b138824652c42e4042887969eb374322261f4d651caffd99c6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370934, "uuid": "77df3882-93e8-4e03-b535-6ed749435688", "comment": "Malware payload (Formbook)", "value": "465aea153deb26553e6475df5e5f2ee74843a0a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370934, "uuid": "c9043bbb-5225-4426-93b1-2aa6fa8612ad", "comment": "Malware payload (Formbook)", "value": "c490f0faa9c34b473fc388e0d13d7cc024abc70ff85e730a768bc607ddbd990d8a0af023b46427488dca40e13ef83874", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370934, "uuid": "cdb36f53-23e6-4b07-8f9d-49d27a281def", "value": "T1BD35BF027381D062FFAB92334F5AF6115ABC69260123E61F13981DBAFD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370934, "uuid": "f9d2a69e-bda0-4e2d-ace0-4c5972c9210f", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370934, "uuid": "117d8180-673a-4a38-87a2-abf0e41512dd", "value": "24576:qqDEvCTbMWu7rQYlBQcBiT6rprG8a8hsY4/:qTvC/MTQYxsWR7a8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370934, "uuid": "f5cca983-61ae-41a1-9270-69ae48c148b0", "value": 1140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370934, "uuid": "ec4c0324-a025-4f1d-bc6d-d68222b42eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370934, "uuid": "71f91c9b-67e9-48a2-8e74-a054d8c3cfbd", "value": "Quotion_For_Product.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f1902b-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370937, "uuid": "8c62801c-5db3-48bf-ba5c-9c518066be52", "comment": "Malware payload (StrelaStealer)", "value": "f3b06d5a24837d05c4858c273ee79409", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370937, "uuid": "00b66cd7-da7c-4d4e-b1fe-f3c2a157dce1", "comment": "Malware payload (StrelaStealer)", "value": "65d3187f95aeaed4b294ad79741b6dd1b7a77d7d6f257c545f64363b9ee1caf3", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370937, "uuid": "67d93e2a-13e7-4ac5-b037-22f40ce9e187", "comment": "Malware payload (StrelaStealer)", "value": "8de2b1be18e062e6c5041d444e3cffa769f8ff41", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370937, "uuid": "c9afecfc-0636-47ed-93dc-e1993367e7df", "comment": "Malware payload (StrelaStealer)", "value": "ed975a6d8220526c5a9993067139e6f2d09c564893ad4693260ad0d6517d70f885303801104130cd37892b0b4744bf83", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370937, "uuid": "d24f110a-d35e-4e0b-b844-80f8eb2ee753", "value": "T148E1AE542B24C1FEC3636277458F06145C068B2F1DF763990E713ECAA4ED9B50A50287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370937, "uuid": "da973d5a-24b4-4884-baac-6178256d183a", "value": "192:VFFcDBzG0Q4Ky06ECc/Ha+sbkoFMJjKA2t:tcU07K9ba+sbkgnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370937, "uuid": "f6987f02-87c4-4f2d-9d3f-cfb0f52795ed", "value": 7099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370937, "uuid": "ef5b7d84-61f6-40a8-b243-cfd2b68c9e25", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370937, "uuid": "41d02515-1b11-4014-ab8b-cb233febc9ef", "value": "AUF-10114363_E0_SRR_#001_INV=241336_.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a67803-5513-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779367903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367903, "uuid": "63867acd-154b-42a1-ad3d-767a1c2c7d34", "comment": "Malware payload (AgentTesla)", "value": "62dd3f8d49ca6520efe7c03eb77ec3a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367903, "uuid": "bbef3175-2b77-4f9c-a3a3-5f9754037e6a", "comment": "Malware payload (AgentTesla)", "value": "6628f21874f23d2a124d7571a0fa7e11d54ebe363fbb30eb8bc9a5b32a3c9c9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367903, "uuid": "4f4ae060-f9bd-4d62-80ad-40c6708add84", "comment": "Malware payload (AgentTesla)", "value": "98d418fe403a93d44d7b5e882bd2fb462ae7ba45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367903, "uuid": "7fd6c222-02ba-4b9b-bd26-5ddbec8ec9f0", "comment": "Malware payload (AgentTesla)", "value": "47ddf51f3caddf2a29a819dbf267ddfbffb131e3ff33764ed99f163bd8590c3c8107089391308e4714e8e7b6924e28bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367903, "uuid": "9014f412-01ca-40a1-ad6a-d8000e92dde9", "value": "T19E3400027F88E715E1A93E3782EF6C2453B2B4C71733C60BAF49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367903, "uuid": "3acbc6a5-0e8a-4910-bb54-5840eac9d9a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367903, "uuid": "78121e18-da9a-4026-b114-4fe481b36d91", "value": "3072:bWbqayiqH2zSyo+AskmTHo9rG8KaG5jnTh+SYufzz:4qayiqWm1Isq8KaWTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367903, "uuid": "8a29a28e-6068-4056-b53f-686bdbafdfd0", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367903, "uuid": "954b6f9a-e9ba-4bd2-b983-b7038dccdbba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367903, "uuid": "08958617-f056-4fd6-9d42-7cf5dddca840", "value": "6628f21874f23d2a124d7571a0fa7e11d54ebe363fbb30eb8bc9a5b32a3c9c9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d50c39-54ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779351666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351666, "uuid": "683e29f4-e63c-4f0d-ae76-2125ff8de311", "comment": "Malware payload", "value": "3b58b39f58ea42fc389c0417f80a8a26", "object_relation": "md5", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351666, "uuid": "02c596be-61ee-4676-a976-a2583edb3a68", "comment": "Malware payload", "value": "6666a47a7083e446d8e1109176c5cb80ba0a635fec7af7a5962a1e1f7227c55c", "object_relation": "sha256", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351666, "uuid": "7c56ae23-a457-4358-ba33-6e0f0494db35", "comment": "Malware payload", "value": "43c7246ac711c03a050c7c30e2e70bfe3f827300", "object_relation": "sha1", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779351666, "uuid": "77604078-8c85-4a05-b954-8932eee0eff8", "comment": "Malware payload", "value": "3a755dd9949ad5f14867e6c7a3c9fdc98a91fdb4a99a9aec90dce01b5fa8d9a1a7ee997ca502719faaae04b6c5009e06", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-94-238", "colour": "#9AE039", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351666, "uuid": "b9cd63fb-0de3-4bf1-abeb-ed1586a17b15", "value": "T1B171CE0297D94766E8BB4B3869FB43633374F8548B73976E2E60025D3CA43645A31BB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351666, "uuid": "1674e15a-512d-4835-882d-43e0d8a6af94", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351666, "uuid": "b77c3572-d610-48ec-9564-0dbbb50ea6c8", "value": "48:6KbB+bfSx89jcAkH+kihkvAUmFCmnJsx1ulwma3Zlq:PB+bfSKB2H/i+vAFBlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779351666, "uuid": "4f539d52-cdf7-489d-bbcd-3a4711257945", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779351666, "uuid": "72753459-4448-42a8-a1a8-8102fc8a7a99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779351666, "uuid": "7958b77c-986a-4d39-8a1c-cc721ce0c63f", "value": "hfrv1kux.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d234a01-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1779373345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373345, "uuid": "2552e49e-6ba8-4729-b8e2-d665538a01b1", "comment": "Malware payload (DarkTortilla)", "value": "d5ad94feabf991691b8b57ee85204e9e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373345, "uuid": "7b2760ec-4fad-444d-b917-a40321e01acf", "comment": "Malware payload (DarkTortilla)", "value": "666fb4b1bb4e141a62f0a084ee2c93c195cebf6cd9d44903c8bc0e72064e07e0", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373345, "uuid": "3ed2071c-89b5-4070-b086-49d887109c50", "comment": "Malware payload (DarkTortilla)", "value": "c95f37d2632822da4ee9b8f4d6103eec35ca7d28", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373345, "uuid": "c165e67e-9348-447a-ba09-3563ed99c483", "comment": "Malware payload (DarkTortilla)", "value": "55a688abd29cc68acc7214a5737dd8fd6e79b5f5ea92a78e8b421c115c23d09cd954d499d26bc41b59ff7c3b69727132", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373345, "uuid": "95e41269-7eb3-48f6-bd9a-64ae0b8c7d44", "value": "T163B423B7938636C6BEBDE87080DA44E451D7F53450D9C79281A9E4CF86C4F3AA52F222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373345, "uuid": "570dbd0c-017c-42c6-ae02-575b767aca16", "value": "12288:EtFGALvoOC5QPPFtSpol7SEqXyI8h3GAtJ7gI1FBmzQGjpQzRw6iQpr6Q:W8ALEQ1Fe9Xy2UgABKQ0KlwIF6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373345, "uuid": "9d5de795-df4e-48d5-8f02-6b3a800c9fe1", "value": 506881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373345, "uuid": "2bb58218-f17b-449e-9897-cc89d27bd4a8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373345, "uuid": "dcba0015-ca6e-45b1-b241-b37ff6a3405d", "value": "Drawing_specification_and_August_PO_#07329.7z.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4581b8-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779373348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373348, "uuid": "b4cdf48e-4c7f-43cb-ae0e-03844fafdfd5", "comment": "Malware payload (GuLoader)", "value": "4522797730ed245cc787f27b3dd1181c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373348, "uuid": "f4fecaa9-8086-4ed1-b6ed-a41ab1513b17", "comment": "Malware payload (GuLoader)", "value": "668fee6188aac65571cd204837a76a08a4262ce075948a6f78469d93d8e3c1e8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373348, "uuid": "ba425e14-7951-4deb-8c9e-da963a588708", "comment": "Malware payload (GuLoader)", "value": "f93ff1916b83f32f8c3c50e6bebfcbd4e1ce711f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373348, "uuid": "dd4c31d6-1add-4fd1-8c1e-682974b37ab1", "comment": "Malware payload (GuLoader)", "value": "ff5cceabb6a27b8ce5130343d2dcdecd2c429dd54d354a4cdff254c7b13af64a22202b46e75a4fef34424d103fb9c216", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373348, "uuid": "116ded5e-6b6e-4757-982f-abda7afcf4d3", "value": "T1F8B423BEA39355D2C988FB451EC2A93E63BD063B0CE6904C8388F5F96B93E4445F7941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373348, "uuid": "e8ae9d93-e885-4b95-91dd-5d0431599fa2", "value": "6144:/ABmsclZenMXoQ6V9fQ0giG0yZuacTZapGG1zb/YzuTrO6zw6n+nRhEbUloIX0Xy:/r3e4mADj0zZd2fAzYsn/KIGR1WF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373348, "uuid": "08b624ed-a531-4142-875e-bbf34f684300", "value": 506184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373348, "uuid": "efc83828-de02-47d9-bc75-5017273c74ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373348, "uuid": "64c16a2b-8525-4972-8e15-84746cf95fa5", "value": "Invoice-Issued-INV-03310-2024.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81843682-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1779373352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373352, "uuid": "31c7641f-fce5-4377-b5cf-8fc2aab662cc", "comment": "Malware payload (VIPKeylogger)", "value": "712d52572d74dca2791564d8d95bf9df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373352, "uuid": "fb35d629-8ab2-4708-a298-7a73176f3e5d", "comment": "Malware payload (VIPKeylogger)", "value": "6718622d94d373a123cac9f8cc6789bc1132eed19a5a9232dd0454ee869d910c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373352, "uuid": "0b68d09d-61d6-48c9-8a7b-11e324755315", "comment": "Malware payload (VIPKeylogger)", "value": "43744b690615c05b82ad978ffa5e36c519eca621", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373352, "uuid": "681437f7-d093-4f6b-91fe-6606203ccc5c", "comment": "Malware payload (VIPKeylogger)", "value": "23b7f3b31256d4ea17d19f0ca9395d878fd813090a52cddcfeefc88ffe46195ef63e8d25d4c972de5c184dd23d580f24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373352, "uuid": "0abcac02-f391-4642-b347-36fde3993d3e", "value": "T12935BF027381C062FF9B92334F5AF6515BBC69260123E62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373352, "uuid": "17620001-feb9-4205-8eac-52486e340281", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373352, "uuid": "686dd721-1c0d-4fb2-b66a-ae930f0301e1", "value": "24576:jqDEvCTbMWu7rQYlBQcBiT6rprG8arHUD5sx:jTvC/MTQYxsWR7arHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373352, "uuid": "babda977-9198-429e-b913-0499d341efad", "value": 1139200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373352, "uuid": "39e33c07-8dcf-4c05-a5ab-a213e6bd4dfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373352, "uuid": "be5583f9-46de-450c-b086-8588fae09b5f", "value": "Final_order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d1e4b6-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373356, "uuid": "ebf34e06-ca5c-4922-ae87-a0f435fde18c", "comment": "Malware payload (Formbook)", "value": "26906d51e80b1b7f765c757453559f1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373356, "uuid": "df1223b4-38b8-4eee-aa67-67f9a71e5b95", "comment": "Malware payload (Formbook)", "value": "673e673800b807ec8ab291b464f62dc81576874956d702e7cfa152af61844421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373356, "uuid": "773c0fb4-b16c-4d6e-b44e-f4ff6dae3e0d", "comment": "Malware payload (Formbook)", "value": "d9951e57a05a7725f056064b3132c972c9888d54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373356, "uuid": "4e1276a9-4788-4c96-a8c0-18bcc3bbaa71", "comment": "Malware payload (Formbook)", "value": "00b0c074bea546b4b5b8bcb4aaa87cd3ef1f5ec3e360902fee4e945a1d02097e15973938ba82208c6a54e37055e17756", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373356, "uuid": "022a3498-694e-4753-b309-e0502fc30f2d", "value": "T10FA512093A934E17FCA80A79E4D53AF601FDAD5B70F3AB2FDF155C00842967C98426B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373356, "uuid": "17f686e7-7679-4fc5-8cd1-dbe8bc0ed863", "value": "12288:Z+nbOwBgG5c+40sJvNRqWB6r0ctwUhGw1ojPrUZzUh5:gbO6CD0wvNRqWB63wwT6jTUW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373356, "uuid": "fc091e5a-5aad-4f94-828e-bbc3f4e9906d", "value": 2130494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373356, "uuid": "c5fd74c3-9b72-48f3-bb69-d2df2d7cbdcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373356, "uuid": "ff8cc5d8-4f30-47e7-a6ed-5fbfb30b3604", "value": "\u043d\u043e\u0432\u0430_\u043f\u043e\u0440\u044a\u0447\u043a\u0430_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5982b6d-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370943, "uuid": "c505c3da-79c7-4021-a841-7e7837137dd5", "comment": "Malware payload (Formbook)", "value": "e507f1731ea81cc870bde6523fa53a6f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370943, "uuid": "94e29876-56f6-44bd-b951-38dcbe498d72", "comment": "Malware payload (Formbook)", "value": "67b00e02d19e1105a88d33be4417337285935d53e4b0e0554e73d009e79dae23", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370943, "uuid": "5509a29a-9475-4db1-9f6d-445aeac462f1", "comment": "Malware payload (Formbook)", "value": "e969d76196739071a013d757c6731095e568405a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370943, "uuid": "a2ac5273-3a43-449f-ac43-e3af4ab5679e", "comment": "Malware payload (Formbook)", "value": "a2d8982441667364a55e1aeb5a6471c98be733f9d18ed5205bb2f2448435ba54be552a3087a81624ec7b56056fb4d5a9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370943, "uuid": "414b8424-3699-4a2f-9fb8-3ddfa012ccbf", "value": "T12A12C16DDB23DB70F5EDAC742DDCC44C83A448371176BD55A79A5495E27230EB701381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370943, "uuid": "ceeaba6f-029d-4825-8611-97e4516c843a", "value": "192:/z1hRb0m3yEoi31u9x9K4nuFl9Oot7PqmDqxi3Q5TRpjetB5V:/FIwTsNuFDzt7PrQn+BL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370943, "uuid": "3dddb1c8-b9a6-41d0-9a32-25b59cd8867f", "value": 9298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370943, "uuid": "fc9d9d17-80b3-462c-972f-2333fc17a93d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370943, "uuid": "946939ef-0ed3-4262-a906-5516be3f7f5f", "value": "965600.invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d9fc9f-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373359, "uuid": "7bd3fa6e-531e-4afe-965a-3c4b31ead661", "comment": "Malware payload (StrelaStealer)", "value": "b8f0d1d2baffb79623fccd5a3de691f3", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373359, "uuid": "7e896fc4-a13b-477a-82d1-78bf5671fdb7", "comment": "Malware payload (StrelaStealer)", "value": "67df6d372dbaaaa2bb7e309f933da99c95d23f0aea2552d320c3b0df3a4d55ad", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373359, "uuid": "b85d8154-e932-4ae3-b205-bad63c881797", "comment": "Malware payload (StrelaStealer)", "value": "3bd14124f197ef8f4b4c76507959b417a9a0ad88", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373359, "uuid": "0b406c39-6a41-4881-ab75-726e5496294f", "comment": "Malware payload (StrelaStealer)", "value": "7d5c9a04463b0510a9d96ef2fcc17a4fefe980bdef81e04ae30b7ecbd42bf7d647e9586a4f21f099895242b8e991eb87", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373359, "uuid": "732e39a5-3dca-448f-bebd-ad43054e6da8", "value": "T11F11D8AC10CBED84DD434CF53601FC3E6F08E1E000C1C76E198759AA40839C969D9B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373359, "uuid": "02640106-d942-4300-ba38-0f6d9e698d51", "value": "24:9wOS+wxIcHbUvwb+343oOv+JpDllbH7qKNeZwM+oxpu23su:9wOS+wxIvYbJYnfDTmKUSM+oxk23P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373359, "uuid": "0dee6d18-8226-4af2-ae83-594abcdbc3a3", "value": 1070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373359, "uuid": "80642ca9-a9b0-4ffd-a4e7-ad7a8ea48065", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373359, "uuid": "40c3060a-2b4d-48ee-b02c-002a57e45406", "value": "22421695628206.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e974d6-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373363, "uuid": "727c29cd-3932-4b98-8dc1-f93cc8701eff", "comment": "Malware payload", "value": "3ffc665012fa54399725f4df7b01dcbc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373363, "uuid": "e8a77936-0c14-43a2-9ffd-9ecba338fda0", "comment": "Malware payload", "value": "67f993074a9c7983ce8e7a37f4e81dbf691979d4241b5a23b4a700ff4814b830", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373363, "uuid": "c422ec88-cadf-4410-9cea-d12c0694614f", "comment": "Malware payload", "value": "ddc23f05d83e3befe6149e7cc19666d77187487f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373363, "uuid": "348920c3-65fe-4d4c-b0d8-09b5ad338a20", "comment": "Malware payload", "value": "70631fc26d3770e2c9d3b474d918b41a22a6f414df3e2a3a595792cdadcc707e3307c0d82285acd8fd045a547c1f055f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373363, "uuid": "77611af8-9ce1-435e-9697-9d62269d1aba", "value": "T1D9D17D20EA96E8C8CA3619BD40992F99C31DBCBA51F9504B50D661634CF3AB2CD945F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373363, "uuid": "dc09745a-234b-4441-a98f-ab72d9307804", "value": "96:YBDsRTaRGXOJLrO0YdnozBnTHCGrzckOUMz8JHXFMZJkvGtCKmQIJ669E:JG0uEipmenpMc3CZJkvuCKmQIJ6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373363, "uuid": "ac213e10-b237-463d-b0ce-1c409c966342", "value": 6358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373363, "uuid": "f05a9263-d7d5-48d5-9be7-2b45adbf5cd2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373363, "uuid": "db32ad9b-1c77-4e44-967c-f688b2a68b7b", "value": "Rechnung7208303.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f59d9b-54f6-11f1-a769-42010a9c0008", "comment": "Malware payload (SideWinder)", "timestamp": 1779355299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779355299, "uuid": "783bc029-01be-48c7-ac22-05ceec927267", "comment": "Malware payload (SideWinder)", "value": "6b2a5de03e6333423c9845e60d38ea0e", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779355299, "uuid": "f9055a1f-bf13-476c-aa7f-c3e98afd69fe", "comment": "Malware payload (SideWinder)", "value": "68027dfc748fe9738aab7572a2bc0093d5374a83e2e3aaafdef1c038167c870d", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779355299, "uuid": "19b74814-b97e-4aca-aab7-722c32ca5519", "comment": "Malware payload (SideWinder)", "value": "9b7d45b3d244c1028e709e55f6302ff39143942b", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779355299, "uuid": "78984c93-6c0a-451c-8ad4-2975f5a114ff", "comment": "Malware payload (SideWinder)", "value": "aa82898b8f9f5ecbc8b4aad5a26db05f6b1c2274089408569ef1bed9b86f1df176a7db2c3208c9712262dbdc60684687", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779355299, "uuid": "ed70ae75-e5d3-4108-a392-6728e845018c", "value": "T1C1F075D9F1028AB8D44776BB54750F62DF82C4E75C10271715BACDC42EE5071DB8104E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779355299, "uuid": "89550a18-e693-429a-af4f-79e6c86317de", "value": "12:5joOXi9clGVZEcK6vM/fKaHkHM/IyhcyYlYXwJaq:9niKlG4cK6vM3KaEs/IpDCwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779355299, "uuid": "c5ff3cbb-fbcd-4683-9e9d-eb3d4d071835", "value": 535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779355299, "uuid": "f29ebf58-462d-4982-a00d-49079ae8ebf6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779355299, "uuid": "126aa792-f750-4991-9f3b-e2151b5878b6", "value": "Order_2026 (1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a96b17-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1779370946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370946, "uuid": "551791b9-b015-4af8-8271-1f431c74b225", "comment": "Malware payload (RedLineStealer)", "value": "fd4a6f44bd140ab7554562f2a1c9e4f4", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370946, "uuid": "b0599f9e-9371-4805-a2f3-ff7305582221", "comment": "Malware payload (RedLineStealer)", "value": "681b1da6205fb081be44f00c88c3e694f665038b21690a55b7df99f08dd7c39d", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370946, "uuid": "c9b971bb-4e2b-4204-a0c8-361ea45c4953", "comment": "Malware payload (RedLineStealer)", "value": "05f3a46923321ab735d8e9d857e5d219941cce7a", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370946, "uuid": "6fe1bcfa-338e-4b3d-959a-c65b07f4b85a", "comment": "Malware payload (RedLineStealer)", "value": "d7c08cce1c43e66ca49edacef1f8166c33cded52dd10c3c1ab5e513fa24156cbf9e16709d58ffa5b38b6a21201b09805", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370946, "uuid": "8fe0a6fb-810b-48e5-aae3-57dd263d2379", "value": "T1E465CF21B5C69036C2B323B19E7EF76A963D79361336D29B37CC2D211FA05416B29723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370946, "uuid": "bddf5b82-987f-4c9f-bbed-32c41c5b5ee4", "value": "24576:ERmJkcoQricOIQxiZY1iaCc9OU7VuuYxFMU2S:BJZoQrbTFZY1iaCcYYKFM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370946, "uuid": "ecc3b6a4-747b-4a33-ba5c-5bbee4356fca", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370946, "uuid": "9be766bf-3f00-47f7-a6b7-14a2b20f7a9b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370946, "uuid": "6d4411a0-c875-4732-8ab3-ca9dbcb3e2bc", "value": "\u00c1tutal\u00e1s-meger\u0151s\u00edt\u00e9se_469253,jpg.img.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a19bb27-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373366, "uuid": "f78b0258-6469-4956-8b4d-4525b64f4090", "comment": "Malware payload (StrelaStealer)", "value": "a68aede6106892c8985d7f5b1db71e37", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373366, "uuid": "9ace8354-00cd-4be5-867c-992e1ac3b0cc", "comment": "Malware payload (StrelaStealer)", "value": "682bea06c5cfeabc74f1a08f5a0383bb48c6787b9c08d4371efa2c3c7753bd55", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373366, "uuid": "7742ba29-0f09-4d9b-91ce-ba67f3e9df40", "comment": "Malware payload (StrelaStealer)", "value": "f1dba17c80ffdda089859c04d8e8121d924a0d04", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373366, "uuid": "c57c9e1d-6bf5-45f3-9e69-5ae647da992d", "comment": "Malware payload (StrelaStealer)", "value": "18757cd244393c3cf6a0ebd781351486e603f26d5d219b2b81dc7ef09c7f62663e24a59019e284b88c0c2710dfef5ca7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373366, "uuid": "2508b3f8-04fd-4bd8-be68-f212244f2f33", "value": "T11E320A2BB150228B19DBDBAA745952D0D93C4032070E7399E5EF921FF54F8ACD326E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373366, "uuid": "bd795c22-0f27-4a71-a3f7-b2f866d09c9a", "value": "192:S6Z2ZVSeU8zfjVUaaYe0H6paBEEkILUUuKU9BiIpVOG/YvM64/gg4TlbWb:SQejbVUaaYe0H6paBEEkILUUuKU9BjVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373366, "uuid": "51b739cc-f460-4d37-b5da-d5330a745a11", "value": 11932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373366, "uuid": "b941aac7-c957-444d-83e9-4f22610d39e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373366, "uuid": "3b80ff58-135b-459f-b407-036909b84a19", "value": "112802522335817807.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9dd04e-54b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779326373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779326373, "uuid": "9cc607d9-1f1f-441f-93cc-f59a1fba3c9e", "comment": "Malware payload", "value": "0fe4d46039005a2c87e0cddd05e7a0df", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779326373, "uuid": "bbda001b-6ade-4c99-8813-76a634b5febb", "comment": "Malware payload", "value": "683e263918425ae499c8f51ea8d76fa71292ab56bbf567d2b767122b092adf0e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779326373, "uuid": "d4b5020b-bb97-4446-9593-6fc7d2411985", "comment": "Malware payload", "value": "40193579fa3d20e4c8111e746b4a1c1038abdab9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779326373, "uuid": "bebd8df2-9cb9-4098-be80-ceb76859fbca", "comment": "Malware payload", "value": "2e9c2aced4bd2a4f642a7b378d8f1c71f2a95e68d8a8cae54f6765592dbea59abf9e041616389f47e67058e180b03153", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779326373, "uuid": "29335a71-e85b-48d1-96b3-78d28a381ef4", "value": "T1D1D097B200A302B0E8634923F9C6F50271458F7E9D22EB6DF45B46303E81A09F0D13B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779326373, "uuid": "c9c302cb-6f77-4f01-867a-d14ad994b98f", "value": "6:hTuIF2fMWsXo2Fx4/2DHAulNXYq4HvXDG+NjVsNXYrkJ:VJ4rsXrFm/2DHPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779326373, "uuid": "fbb53344-506b-4707-8345-156397405ac1", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779326373, "uuid": "4c692757-e95a-4a7e-aa43-36df3220ae37", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779326373, "uuid": "7a88c4eb-fe92-4466-8b00-31db2361d0d8", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69898b6a-54e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779346254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346254, "uuid": "3d5f1a9c-95ee-47db-ac7e-bc75a7930efb", "comment": "Malware payload (Mirai)", "value": "ce278957c3bd7f819cc98b66684bfdf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346254, "uuid": "a9827a99-ed8b-448a-8ead-e8e479c19cfb", "comment": "Malware payload (Mirai)", "value": "68b282badea74f349b1e6facca0f5b81b026b49d85385bb15b66e920628e485e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346254, "uuid": "6ed0ae73-f40b-4353-833a-c93ec39d6789", "comment": "Malware payload (Mirai)", "value": "1a33e33fe6115cd03c6617610bb31da5ca68fc6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346254, "uuid": "7eca5cc2-d5d9-4e09-9d07-637cdb2ba509", "comment": "Malware payload (Mirai)", "value": "6f4cf630fef2f847c912c9e85992f66e68d56184d305045de1f9627b5f22ab54d75854c62f4d4aa2257ca27f411b4ba0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346254, "uuid": "316ccaa8-905e-4d4c-aaba-488db91f309a", "value": "T143B31B41BD418A13C5C21BBAF7DF87593B26B664D7DB3302AA187FB42F4768D0E2A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346254, "uuid": "47e88f16-0f5f-4938-bb93-63d590c7d163", "value": "3072:kz9vwdKAB6jABOkGR67ewYJYmd60/5IwzNjMQ8Bx0Z+x:kzxtAkRkew0Ymd601zNjMQ8Bx0Z+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779346254, "uuid": "5150daa8-ce72-430f-b2c7-a68733ee2641", "value": 114883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779346254, "uuid": "b70caec4-0c02-405d-983c-f635cb37c369", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346254, "uuid": "d75c1efe-2439-49f8-affa-f97a38d0b59d", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99a1145-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370950, "uuid": "f380275a-b178-47d5-b325-cb4c9966013f", "comment": "Malware payload (StrelaStealer)", "value": "866f6cf625e2cd3437b10dbf846da292", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370950, "uuid": "d4273374-09ac-4157-99f0-50319d37ec05", "comment": "Malware payload (StrelaStealer)", "value": "68bb3590c82d942fe1c10990594bcd1e40f52f89ebf44d324b3574dd19b86c87", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370950, "uuid": "a2ebf98b-bafc-47f1-8700-fc76c3c06054", "comment": "Malware payload (StrelaStealer)", "value": "f39923044f0b614a58b0666d66f90ac0c9410d6b", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370950, "uuid": "3fb21cd3-2c43-49fe-aabe-aafcbcbeff5a", "comment": "Malware payload (StrelaStealer)", "value": "b24d7d39c71a206199d314e11330fa4d24bbab00048ef4e77e2c5319bfdc2cc4fc7e57019736d43e519cbc8f9492d1b5", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370950, "uuid": "22ac80ba-fb43-4d15-96b5-49ce6fcce6a9", "value": "T109B2E0C215DC11B4C0490FB89CE425B38FC1ABC16965D98F2EAEDA76D6A4CCF0B93E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370950, "uuid": "81863422-4b4c-4afb-b0b5-6aa22dbb6c6b", "value": "384:LFwwP99Z1lraayvuMP42B+3msY6/BjDpOf6IO1vmv+2AqOraE8DnUM6IcmIQzkj2:5wOlrrLwB+2xMB39rUvSra5TyIbQjlXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370950, "uuid": "988a8845-cedf-481d-9b2b-f31a65397bac", "value": 24271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370950, "uuid": "3d4219b3-088a-49aa-8d83-9c20ac4f49b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370950, "uuid": "0da6b3be-abef-4e87-ac8b-5bed7afad5ad", "value": "Verkauf_Rechnung_2489550.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9449266-54f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779354118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354118, "uuid": "4b8bcb29-d609-4179-a3d1-54bbbea95e49", "comment": "Malware payload", "value": "d4dae7149d6e4dab65ac554e55868e3b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354118, "uuid": "e27a0d47-cbc8-41a6-ba82-1e8082fafa58", "comment": "Malware payload", "value": "68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354118, "uuid": "0887a3ca-d227-464f-90c8-18370f7f007f", "comment": "Malware payload", "value": "b3bea0a0a1f0a6f251bcf6a730a97acc933f269a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354118, "uuid": "98c0a15e-567f-4a8d-9428-f37d0c5e5fde", "comment": "Malware payload", "value": "1bc14e85f8377e3ee1bf8822a95150200389c93f80a38b121ae9bc0c52312a3aa12e0d69654dd21fcc3fce6aeb48cc90", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354118, "uuid": "ec335a97-0235-405a-bd06-b0c2220a2935", "value": "T1195144E3A3689126E12403B9899BC42C7B35D31503EB975739C8126F7F15380F4B3861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354118, "uuid": "c8aa2502-1f8f-474c-98b5-bc11197260bf", "value": "24:eFGSGrc9MmFScG63DDJQpXTl6p3yqkcPnRuV4MPgic:iGrc9M2brtmTl6ZRuqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779354118, "uuid": "cbc0ec2e-5c6d-45f8-b913-8c50122c4747", "value": 2560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779354118, "uuid": "3cd75be0-94e7-4304-a31d-0248d6acaf78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354118, "uuid": "8ef07969-f232-4597-8c60-11e2b63c455a", "value": "68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670ce887-5512-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779367295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367295, "uuid": "7ae91dc5-2562-4ff5-9250-7f6ebd30d46a", "comment": "Malware payload (AgentTesla)", "value": "9b190bd8a9fe51ab9a888c801e6982b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367295, "uuid": "1e744f47-a5d1-481d-8fc4-9321a17a67c1", "comment": "Malware payload (AgentTesla)", "value": "68cf1513ec32d999f06e5f11c9ae79a49f2508fac1492cb717419a63cf055964", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367295, "uuid": "966b4f06-da7f-45e0-9d51-e76bf60e3299", "comment": "Malware payload (AgentTesla)", "value": "d9497e7be4238f6571051a6d0dc99b05a1b5b329", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367295, "uuid": "7a536593-beb6-42d9-9d0c-c20903973f7f", "comment": "Malware payload (AgentTesla)", "value": "97382bcea8173e6f5dab6942e6c010648c348515e09cf5cabce1b053dc9b2745426e2c968153a4f2d54106f699c10627", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367295, "uuid": "f3117358-2b00-431b-959f-083264b081b1", "value": "T1A5A55C17D66F974E18093B61006A1D9AFE89CAFCEF72BBC4E0CF90B614EE1110B455A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367295, "uuid": "c6d8772f-6d07-42e1-a6d0-3062ae063ff8", "value": "49152:VFW8lYQbkNqcp4cRu51JN1i6wF7eXzdcRo:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367295, "uuid": "db537047-77f8-4fdc-a44e-852c7e9954ef", "value": 2185137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367295, "uuid": "cb33f6e2-7631-4152-b7dd-3b3e7779e256", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367295, "uuid": "760649a1-2e7f-4d00-9781-cb947f094de1", "value": "Nostro Ordine 264418 pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2cda03-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779373370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373370, "uuid": "904a7456-bb41-47ad-9b1d-cfcc0de5ad0d", "comment": "Malware payload (RemcosRAT)", "value": "a51261f76d9732206ec4c3366a2c30e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373370, "uuid": "9bbf4da7-2eed-4778-bd38-813477bf7b13", "comment": "Malware payload (RemcosRAT)", "value": "68e48a8c19e8d95c80445e5d6290802a6c69ba25d0b020789ddec0983f23a832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373370, "uuid": "e6e7e7fa-54ef-4f4b-9314-4e350104e62f", "comment": "Malware payload (RemcosRAT)", "value": "5b539d411fc17def59f2f4ce50fc7b1ce2aba2c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373370, "uuid": "eb3458ef-d243-410f-b22b-fe6784cdd820", "comment": "Malware payload (RemcosRAT)", "value": "af7a8a7296ffc92716a36086068bf41b9fc7053b661499316d9cbbe8329a50d46a18c60c1586ced55796787cbf8b6f70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373370, "uuid": "74e898d9-9c47-44a4-8900-63a091e6f6ca", "value": "T18E1523A772C2C854F11163B8C4B98DD54A917430DEBDBBABC310FBDA1870285D58AAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373370, "uuid": "a6cb7e21-e29a-4bfe-b4f7-3252ef4ea60d", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373370, "uuid": "e099813e-161a-4f3a-934e-7814a70f9fc9", "value": "24576:niUmSB/o5d1ubcvKHHAJsIck+ljL/sBGudBX87pMG:n/mU/ohubcvKHYFczs58F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373370, "uuid": "6f47556d-a3d7-43ce-9abb-160db1b14278", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373370, "uuid": "5ed7eb0e-14c5-4955-8a19-b21db4d5f90a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373370, "uuid": "18ed67df-e9b3-4fb6-b3c8-a462f7a0b5bd", "value": "yoursalarypackage.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a012ba-550b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779364465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364465, "uuid": "8ea479ad-b9c5-4c8d-8f46-f096b70debd0", "comment": "Malware payload", "value": "b246a14fcc48367644224f7532d263a8", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364465, "uuid": "df91b4cb-9fe6-4061-9a2d-a4a471a006b5", "comment": "Malware payload", "value": "6938684a498374fb97335577028a826165608fecdecedcfabee0f323ce2aac3a", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364465, "uuid": "23230cfd-0029-4c18-9617-ff1071acc2f4", "comment": "Malware payload", "value": "a72d5ac2d432949ce49eba09144d85e1fce39c98", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779364465, "uuid": "2293eda0-9f0d-4bf7-abc4-06159b142b85", "comment": "Malware payload", "value": "13d9b62705368b822e791cd79f6683c9b9bf4ace70940e513d5e517fb7c9c2e97f746db444947e712936d22350e19754", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364465, "uuid": "d208c40a-8625-4544-ad03-044c689f9325", "value": "T1F4667D0BFCF904EAC28FA2789562B211FA25B4804F5557C74AE4F7A56D933E046BEF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364465, "uuid": "8e688e4f-807d-4e8a-95da-aaf9bdacc1ef", "value": "d6c19ce52e7a53024dfe85f4bb02cea9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364465, "uuid": "af182809-7a70-4fd1-ba1c-ebed0e0a1c60", "value": "49152:vhR01NV7gCq10Ujx83VUX9u/Ch0wRLkAX6FsZpZhp5AS/qEMpXreLZQqj8GABKeZ:vh8CBa+WLuFjpLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779364465, "uuid": "b14e4f91-b3fd-4f0d-adb8-f3842cb71f32", "value": 6605328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779364465, "uuid": "fde6524c-9c6c-4e64-a7be-e4a6e4b81cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779364465, "uuid": "03f15dce-bcf5-44e0-affc-234840e42ee2", "value": "20260521_032348_abyssalkraken_fit_6938684a49.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3b230d-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1779373373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373373, "uuid": "42088d85-eabb-4b60-9449-809b252e18d2", "comment": "Malware payload (PureCrypter)", "value": "9193d76e7df5d736b0b8388c36272dc5", "object_relation": "md5", "Tag": [ { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373373, "uuid": "9c281341-0b4f-4d6b-8b44-874c45d23ea3", "comment": "Malware payload (PureCrypter)", "value": "6943ab211f5bd816bfa51f3a1c85c8789597959e33c2dcbaabc090bac88a915e", "object_relation": "sha256", "Tag": [ { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373373, "uuid": "22738e52-9ca7-4b86-989f-d83229cea13b", "comment": "Malware payload (PureCrypter)", "value": "91effcb03a4654ec6d736051da714a98d3f519ab", "object_relation": "sha1", "Tag": [ { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373373, "uuid": "4f50e765-f4dc-4d3f-b95b-f3bf35787cb3", "comment": "Malware payload (PureCrypter)", "value": "42b3a9532aa9a5b9aaf269217b15bd37896e513f970a4fc82562a1cda8dbf3160e81019996006448e9e92f11a9dfb6de", "object_relation": "sha3-384", "Tag": [ { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373373, "uuid": "616e7f57-b094-4284-b603-8ba4b14e9054", "value": "T1AC23F19305F2AA5C011FE065D12131A86733745BDA62180D6AE78D07DF8FEDE3E7D6A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373373, "uuid": "ed4ccc8b-a43e-47f8-a72c-31b1d4c43fd0", "value": "1536:tvv3ab9k/fnK5MJ6dZxYSZ3MrObE2KoEjGUL:Zvqb9k/S5M2YS9MaIHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373373, "uuid": "3966212b-6ce3-4fab-b9d2-dafcd1ed3d90", "value": 49322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373373, "uuid": "faf6b7de-11e5-47d1-9dc1-6f66acddfa97", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373373, "uuid": "a2dc77ba-d1ae-4787-8404-189e294c3bea", "value": "TR-31Payment091-H462-J828-N3091-B5740-UHA910-786F-CN87402-M8198.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93981ce9-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373382, "uuid": "75e215a1-052d-4aaa-a6cd-269b3203e697", "comment": "Malware payload (StrelaStealer)", "value": "c378c44b561e57e75e5c3ffc318ddd48", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373382, "uuid": "23030eab-6010-4dfe-9c00-8ac20f8eb338", "comment": "Malware payload (StrelaStealer)", "value": "69f297794c23d603d869d588404ef7f93f9a525be50a7029fe0b1c61a329de38", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373382, "uuid": "873a6779-c69d-4edc-8860-60a27300776f", "comment": "Malware payload (StrelaStealer)", "value": "12617fc4f1f2c06632570a7505ea370e94fb5cb3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373382, "uuid": "0eb11693-6ec5-43bc-89b6-eb66376c3720", "comment": "Malware payload (StrelaStealer)", "value": "80aa2656680858b02acfad4d27acb117b99287268fd3f1a020af95bf09533163b68e3e8c55f3b01399f496f8e2cc66e9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373382, "uuid": "dc425fe8-a522-4abc-b894-0a98c65d651e", "value": "T190920811D071D75AF21DEF1CF6DA92AF5E7C37B59AC3C1243C0889284AE154EEA8DA0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373382, "uuid": "09c1e1c4-3c40-4e66-9d3a-112d6d039503", "value": "384:UA4tVmIx7bkn9Uxil/LsMtk5VXD7Z9eLCkdSAxRAAI:Z4tZbTyRkLfSnxo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373382, "uuid": "74878851-12be-4784-8637-bdd9bb9b12e6", "value": 20817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373382, "uuid": "ebf49f24-ba94-4e1b-9245-f27e1cea49f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373382, "uuid": "3054c265-3179-4e7a-9550-ef0722e5a6f1", "value": "15497122031997232427.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f59ab2-553a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779384693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779384693, "uuid": "02f1f19e-2105-47a8-8dfd-ca7b07a0da03", "comment": "Malware payload (Mirai)", "value": "9da45fa17a4770f2c1b6a68bb39ff3f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779384693, "uuid": "c6dc15e2-80ae-4bd3-8add-ece60972b710", "comment": "Malware payload (Mirai)", "value": "6a41023f7e6c466b2e17ff09d856f2ef6f4f83165c78ebbb894ff4e1d6e1bf53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779384693, "uuid": "c6296b10-14ab-4e40-91b4-72ece6de4cad", "comment": "Malware payload (Mirai)", "value": "c8865e7e14e09eaf61826b9fc388286cb41be7ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779384693, "uuid": "ab2e8dbc-321d-4ded-92c9-63d9611194df", "comment": "Malware payload (Mirai)", "value": "00134e288b92a4fd644f72a5bd6cdb5021ba1cd4e28c5289272b51bf3a9c49c150aa51a0f9671b9972cceb9a2f5e237a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779384693, "uuid": "942b991c-0fbf-4bda-b2b5-84f053b8c4e4", "value": "T130762711FE8B50F2E9031D3105ABB26F63325D054F29EBE3EA407F29F97B691193A149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779384693, "uuid": "a45ba672-34ac-4416-9857-f8eff8668931", "value": "49152:fDcg444mBP+v3bUbRSkJiZu50cwOXT2VDDD4EvEuN2SD8LJNWUhHEvmCLpR5ELf:L+4vq3QbRSP9ODiDoEv3mZbsELf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779384693, "uuid": "b3c782bd-ce3b-4bb9-812e-f97f5f28cca7", "value": 7270584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779384693, "uuid": "13f44490-51c8-4d3a-bff9-b96345905809", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779384693, "uuid": "f1a2d579-22c8-4754-a982-7b4f7871467f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a8aa45-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779373386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373386, "uuid": "35a8e91d-a7bb-4671-8136-34ec8be1f48a", "comment": "Malware payload (RemcosRAT)", "value": "a931ca4f7b23b789a177ea11caa02b84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373386, "uuid": "c8c75a7e-bf55-4737-a005-1a5ed51e89b1", "comment": "Malware payload (RemcosRAT)", "value": "6a53c56172ce6e29d1ab7e14cbd2ad20069637828cbb8a12d240addcf96dd5bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373386, "uuid": "b2d2146c-349a-4b01-9e69-9f3229883b99", "comment": "Malware payload (RemcosRAT)", "value": "b4fe04283a3a0fd7d49164d4b3f0a74856a5453f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373386, "uuid": "5c14618d-51ba-4c87-a504-b7caedf427f8", "comment": "Malware payload (RemcosRAT)", "value": "a172e41fea9f266113f2a41ce0d5030e47b16c52774bde47c58650e97e2edddd7fb12187e985dc9db790982a898a3b90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373386, "uuid": "a62469ea-196b-4ddd-a8ab-10b5e3738698", "value": "T14B1512612162DA0FD5A22BB54973D2F817792ECDA919E3879FD6BDDFBC71B000A40603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373386, "uuid": "aa47e293-4b12-42f5-8a33-a687c3428c80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373386, "uuid": "abd020c0-2f84-4ed8-bbe7-ba9f99d09661", "value": "24576:Z5T0ImRCSibjodeNgzF2oRCYZ0gHH5AGWQoJcQI:Z5T0NdeNk2YZLH5hW9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373386, "uuid": "b9f5c2ab-b720-4107-a8c9-5625cd7fd320", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373386, "uuid": "cc2738b4-b447-4076-9f8e-db0adb97a64c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373386, "uuid": "3bd45d50-94e2-4d58-85b5-c41a6a4527a6", "value": "20240920060544041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b9732e-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779373389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373389, "uuid": "76460afd-ae3f-4617-906d-cca4ff5ec032", "comment": "Malware payload (MassLogger)", "value": "4045cfe18ef6c0a958c0c4039810b56c", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373389, "uuid": "736b46d4-2b34-4cd0-935d-dc2f65bf0c82", "comment": "Malware payload (MassLogger)", "value": "6a67e00f44edf98b5940f65f8ab9076a6ee5f54aca2131e370d9919aad577f4a", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373389, "uuid": "d72b8732-d0ca-4da1-802c-1b7bdab53b6a", "comment": "Malware payload (MassLogger)", "value": "3637153519f3d9113173749571cbf25fa1839a17", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373389, "uuid": "24a161d2-58ba-4909-992b-b0e63f011261", "comment": "Malware payload (MassLogger)", "value": "10a704d4fdc4e0e11439b5011ad9e4a750a90c6bbfd158d7e3d82487bac63dcfd55b58e927c1ddc3fe8473f00b886ec6", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373389, "uuid": "5a723a59-4a2c-4ad9-92a7-0f429f295c8d", "value": "T1FAF423F36C5B14B6AE587610E37C6E0A7A0BA3E6E913D63DF310D1D012DB499AB7A050", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373389, "uuid": "bd1e9de6-5b35-4750-a6bb-7a35f923fdb6", "value": "12288:2qlajLf30WHDJ8wT6GePhICDfA9muH5oWeDKLtqHbyyR+MOeSlZATJ9y745+MH4N:5lQj0y3+GMxY9jZQEsMySrATJjDmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373389, "uuid": "d929dc0d-b38c-4ec6-b339-9cedfd2a73b0", "value": 744646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373389, "uuid": "71f5fdc0-ce64-4d19-ac9f-b7f27e3098a5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373389, "uuid": "7d1fabe1-c72e-48a7-ac92-0c016e72ffe8", "value": "Maersk_Shipping_Document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1edcd6-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373393, "uuid": "e1e7e1ac-089f-4a0a-854c-062b608b0f92", "comment": "Malware payload", "value": "1ab328e7d971006ec7194a4e65fcf6d5", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373393, "uuid": "abdbee4a-f94e-4b16-884d-07dc6942a0b6", "comment": "Malware payload", "value": "6aa08f5c44391f809672ac0df2e26693e4c0713ca66c2d6b65e4cfde311d8b1b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373393, "uuid": "4369f14f-a886-44de-b516-1bba4fe66d95", "comment": "Malware payload", "value": "5639a7b8f8676983e04efa3ef2c4f1b1adad601e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373393, "uuid": "7261e71b-aad4-4ef5-9bd3-07365b97b46a", "comment": "Malware payload", "value": "9506636950b31e01a0ef59901a6faf99cc1dfb839a49d98550fd557fcde19567a4352dc4710e145cd2569333953fe952", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373393, "uuid": "70ab385d-b532-4449-a956-de7ca0dae883", "value": "T1B6F433397F835DA0346AC665E8871EAB7BE8F29593343D4921D7D21E0DF0296CBC601E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373393, "uuid": "1c6128ad-4ddb-475a-8b0f-a32142c424b8", "value": "12288:HuM8SmaVDygUT4Pp5/JyjHl+6xT05+a/fB2FSMA6K9dVj3OwYtT9+0mwVvzhDbH3:MwVDygUT4L/Ja+gI59J36K9XOwU9+4NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373393, "uuid": "c3b4d416-7857-453f-8813-fb0c84b9d809", "value": 771652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373393, "uuid": "6c24b435-773f-4e9c-9eba-39ca91e4125c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373393, "uuid": "3ab0ca4c-a972-4a7d-83d7-47d7f6e6c030", "value": "DocScan.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c138e72-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373397, "uuid": "4aaa8808-ea96-4623-a030-630442bdc082", "comment": "Malware payload (StrelaStealer)", "value": "f34f4a2ddb6d9a68f1c32b1b6ace1ae9", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373397, "uuid": "da38f119-a35f-4b2c-a408-c97c036144a5", "comment": "Malware payload (StrelaStealer)", "value": "6abf5aefd43f4addb5686c204305000c3909357e4f42aa24d4dd6a2b941f9d72", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373397, "uuid": "8ebd5b3f-43d4-4680-9a4c-0b6985176f9d", "comment": "Malware payload (StrelaStealer)", "value": "180961eb325df860bc330e3cb7ae13254e62993b", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373397, "uuid": "0c2f3e8f-08e7-4a0c-ad41-bfb82a3c6bca", "comment": "Malware payload (StrelaStealer)", "value": "c04fbe5c678e723d327e0c72c1de17a61c9f582479033c233b34fb5b73cf3bdf7fdbcbfeb900ac464a9950c6a4883aa5", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373397, "uuid": "666d77fe-6901-4645-a6e0-226acd8c1a2e", "value": "T1BE31C9DD7018F579F767C5765A21BA4E476B11442DE805F0CFCAAB4A2F846806D4208D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373397, "uuid": "1f3c38c1-aaf9-4dbf-82b4-d81c51e4dbb9", "value": "24:96BfvbFCOmhAhX+js+EVjXB3U8w5yBj5JZPKyoBbln4oLF8KKRvvlQZzJjJrGewl:965FAyXtXBkv5ij53dGlrLFmRvvlQZNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373397, "uuid": "8a47a1d4-addf-4750-9d49-cccfd6775fcf", "value": 1527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373397, "uuid": "33e3dcb1-a6ce-4458-a436-d65c2771cc0a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373397, "uuid": "c8db2fa1-7cd0-48de-b143-28678a4ca9c9", "value": "AR40-40508802.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c381eba6-551f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373033, "uuid": "41881db9-2ba7-4057-ab29-5486dbd4bf76", "comment": "Malware payload", "value": "c652aead0db4504ba18607ee14661f1b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373033, "uuid": "0d97f7c9-c3f3-456b-a380-e63222bede91", "comment": "Malware payload", "value": "6add03aad1fe113d88a28906655d56811e794c187334ce48fa50a5264831f9ea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373033, "uuid": "ea81afdd-20c4-4d4f-80ac-f19cbc15e66b", "comment": "Malware payload", "value": "0f9ef8ec2b1413663a97f7d766100815e21d3b2b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373033, "uuid": "f5851a84-ba03-49bc-b055-c39410a470f9", "comment": "Malware payload", "value": "a222f5267efd9a6c2690f0a395330ba4ef34c815734fcff466094fd2fc78bc0f4744957f950ed6266ccc8dfe72224b36", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373033, "uuid": "59b94756-1fdc-4687-8bc3-010b04567829", "value": "T11B25412DDAA5011BFDB2D714BDB50403A8277F562A3DC94CD2C9128D0B7390DB9ADB2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373033, "uuid": "08c6328d-c851-4d37-98dd-9de8871b9abd", "value": "6144:jNjQd6+uVBNLYCmcBUD1R9O3SExoS+0GptTxRCkKz7Ya+n0k3nQGWNL:BjQxuJUtDD9b5Vppg7sX3QJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373033, "uuid": "b67b70aa-702c-4978-8f28-c9ed1255ab39", "value": 1035946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373033, "uuid": "2af753e8-e5c4-4b68-8a55-cdc4f3fb4a61", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373033, "uuid": "efc52c82-1999-42ee-a352-5d043278468a", "value": "ELHO_Project_Files_-_Drawings,_Scope_of_work,_BOQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e14ebcb-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373400, "uuid": "0bcd27be-0084-4ebf-ba55-70761c152188", "comment": "Malware payload (StrelaStealer)", "value": "30b6235ef408b57a4b0d18d465b18418", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373400, "uuid": "fc862abf-8e99-41e4-af23-ac0429d2cff6", "comment": "Malware payload (StrelaStealer)", "value": "6b7435afd70e75ca5278e20f018ab17768b7b3be26c31dfbbc9d927dc455f2e2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373400, "uuid": "c1929a3f-4829-4d5b-b81c-58c7496e8f3a", "comment": "Malware payload (StrelaStealer)", "value": "89306eb00dbdb577b10178a6a08da815061e9b29", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373400, "uuid": "802a7d6f-19b0-4361-a60c-47fbfbb2936c", "comment": "Malware payload (StrelaStealer)", "value": "f5bab5b8d07968df70fb45c4d29fa04357faa68c3efa1030bcf09d92c266abf79fab1c16c400ee0c938f7e97d594ae31", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373400, "uuid": "37c6fb81-84a2-4cbf-be5d-6f49ae1e21d1", "value": "T104627511759A3676AC843C125A2DF1543BF9ECB3B5A3A5EE3DEC81A3A110843DF1487B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373400, "uuid": "2ca7f285-7df3-463d-b132-2bf98ee79768", "value": "192:Xd4HMkbxiLCtf54iiBLEbgrJ5+7E/JEbgrJ5bg9:E45iT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373400, "uuid": "9cfeefd6-024a-4422-b94a-18914a28d553", "value": 15579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373400, "uuid": "3dcadced-0f70-43a7-b4e4-eda70381529b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373400, "uuid": "5d9bdff3-d995-4a18-8cf7-08d81e853a39", "value": "1655510676587224552.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1597fd-551a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779370956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370956, "uuid": "ea664074-dc5d-4688-b561-a21c9834d1f4", "comment": "Malware payload", "value": "4cb51635512723175f9ef97770ed3ebc", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370956, "uuid": "d23a1fe0-ce77-4911-b25b-b4f04054d550", "comment": "Malware payload", "value": "6b8009e2aed88e2cb239c3f9a9799abdb0472bebc816e57a01ca8fa329ad2f1c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370956, "uuid": "80bc859c-7aa9-4fed-9f20-8e7ea0a21b0c", "comment": "Malware payload", "value": "6a828d4f8d5097aaf9a95d44e6b7603a4d26af96", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370956, "uuid": "1c9053ab-2116-4113-9d27-23d64262a76f", "comment": "Malware payload", "value": "c545f8a98cfef481325c940d317659de342234a1ab9b34e86225921535289d9cb73b5014f3f0d44bd928a247b1cc493a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370956, "uuid": "5eda5f43-7257-4244-ba0c-a476bde3347b", "value": "T12F21E6145EF30724E7B7DA796CBAB311C5763C82EE628F9D014059996935220F5B0F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370956, "uuid": "f5e54280-4ba1-4189-b157-9b1cae7f7439", "value": "24:8A4/BHYVKVWU+/CW/xiAGfc+jC9tUMkWbjC9PHhGO:8x5anrFtH2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370956, "uuid": "fed84d88-faa8-4293-9654-e74fcae90536", "value": 1378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370956, "uuid": "988b1ca9-d3f9-4fde-871b-656aff330920", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370956, "uuid": "1738c4d1-54a0-449d-9094-ff69f79b9dd6", "value": "RFQ_-_20246529947.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c7f108-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373410, "uuid": "0076ccee-9667-4723-b145-c2b22b5dff27", "comment": "Malware payload (AgentTesla)", "value": "98aefa9a2db2e0e71935a3028a882ded", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373410, "uuid": "02626209-9067-4284-809a-58253e3e0857", "comment": "Malware payload (AgentTesla)", "value": "6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373410, "uuid": "e9faf039-b7b3-4329-8bed-d78ada7015f0", "comment": "Malware payload (AgentTesla)", "value": "8ca579b53f29bbd7c089d19feff92a3f4399cbb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373410, "uuid": "f21f73a3-c4e7-4499-8200-be8643ea35af", "comment": "Malware payload (AgentTesla)", "value": "3bbb8fb8226b606e2334365cd127f14e8ba5fa28c92964ad028e68ca51f79affc621ef93ac35718cb96bda862a77e12c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373410, "uuid": "28c98f46-85e5-4d76-ab75-e92d5cb155be", "value": "T133E4125031A9E903C4864FF40972E2F82BB86E59AC12D30B9FDA7EDF78367555881393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373410, "uuid": "87ad4ea6-bdf5-49de-b589-96c429f8af8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373410, "uuid": "a810c6ef-4a19-4e1d-9ae1-28d5539028a4", "value": "12288:fje8bQbiBNISyKg1VK9THDGAuzwZK1aKR0Uk5GhrVdKczR+aPZV2rs9GlFLe6B0G:ZIOu5i720ZK1a20UPlVdL0SMs9GlFS+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373410, "uuid": "5053d12d-bf3c-4eca-adf8-ba503998bfbf", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373410, "uuid": "7a64eaba-ac8a-4878-8c4a-15c7b2972fe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373410, "uuid": "ab6ccad9-9515-483b-84ee-e9a33e9cc07a", "value": "PURCHASE_ORDER-6350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef23627a-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370959, "uuid": "f219f3f7-04af-4bb7-a9cb-367e3c3de094", "comment": "Malware payload (Formbook)", "value": "34d653e5002bb1621267a6e1ef478ada", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370959, "uuid": "1e78b03e-6ef7-4898-a502-030958c87027", "comment": "Malware payload (Formbook)", "value": "6be2bb3896cd0782009c37697c7b58efc577a46ccde3935dfd9449af0c8cc6ac", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370959, "uuid": "122c6eec-2fb2-43d4-b02b-4a023ea1654c", "comment": "Malware payload (Formbook)", "value": "650c783afc422a9c43c1f08ab675d106ceb63e33", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370959, "uuid": "71bd871c-34e7-43db-a5ef-8b8293a33316", "comment": "Malware payload (Formbook)", "value": "5d61c58ca431f1b991e52a12d19b2f951088fbba30b188b7d2764e2a8263cb2c31f1aae936aadb0f353ac1f5a88a18c0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370959, "uuid": "805335a7-e1aa-4f6e-96e3-fa9e399cb690", "value": "T19CF4331EF05A09B8B5A4B8D0C7D2908ADF8EC1E3C399DE882EC6B5615531DEFE710764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370959, "uuid": "2e086c51-e218-4bc0-8a37-852b997e9a41", "value": "12288:VzQ54HSdLLfWw8LgrFyGFBLYjzOp16HmaTjbi8m6SfZiHdVIPwLhw4RYxfhE+b:VzQ54YXfWwLrFfFBLbEmaTj28m6cZo6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370959, "uuid": "3551d1a9-992e-4342-bdc3-cd90d16a5fb9", "value": 725970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370959, "uuid": "a4c73f3d-98eb-474a-8db4-591268235c26", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370959, "uuid": "4828e5e7-472d-434d-b86e-484900688e13", "value": "WaybillDoc_5112006093_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e1bbaa-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373413, "uuid": "18f50977-6a03-4e6e-9a0c-e2d2ca3a3d19", "comment": "Malware payload", "value": "399fdf5b445551e2ab613cb448e026ee", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373413, "uuid": "e81d86ef-f563-4c66-818c-b489ee0af33c", "comment": "Malware payload", "value": "6c0511d9a2f5cf0c42366879ada1a223e3c4008b11bb191aa412efbd8f24e136", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373413, "uuid": "f4bd578a-83cc-4cde-a57a-af94d5c5d0ee", "comment": "Malware payload", "value": "182f05a09286b4f1f8ce21778bb5ee8f6e7f9566", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373413, "uuid": "d51a0356-cad0-49f8-86df-9ae3c396be32", "comment": "Malware payload", "value": "04928e6cd0478ce2d1628a129b1267ab07f459b3bba255ae9b7967d646f886f4a3fddf856da5eda9998cf976f0275156", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373413, "uuid": "e0edf7f9-e35a-409b-b4b0-873c5b72dbb8", "value": "T1C3853328F1986D57D2FA3B76821542204AEBE6C52570E45E319CDD4077EFA3B01B0FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373413, "uuid": "20570cc7-5c54-4f8f-bade-e2431489ef7c", "value": "49152:7DN2AAhAKB55UF6AW7+NFB9YyIofuUM7jIs5b4Z:XN2BeqTE4+V6bof87jIsdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373413, "uuid": "9a8522de-c603-4cb7-9f3e-5f84199bd274", "value": 1861632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373413, "uuid": "c8ffe9bd-a95c-408f-a2a7-1d627e9689e3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373413, "uuid": "295cb220-0720-4c95-a0dc-b894ab9e2641", "value": "RFQ_818-2024.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11a72fd-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779370962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370962, "uuid": "57b5e3b1-ea22-43a2-904a-4344c58cadee", "comment": "Malware payload (AgentTesla)", "value": "e115445950c680d96dd85c0c92615166", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370962, "uuid": "c441ba53-fc2a-46de-a4a7-d1514b95cac6", "comment": "Malware payload (AgentTesla)", "value": "6c2fbf874d04c404abb34b7c669e19996cb38175167445eb96e1186c2098ca74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370962, "uuid": "718ee332-3ecc-4628-ae58-f6eb91793fb1", "comment": "Malware payload (AgentTesla)", "value": "c0c2ba6aab46c9f8bed59b7e5266412ed86416c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370962, "uuid": "4adef8a7-a97c-4621-8337-dcaa5cddae20", "comment": "Malware payload (AgentTesla)", "value": "e776c5012fcec7ea86d18c2f90a6fd5a65107778c077e691bc241c3977eadcccd4fe880f4bab18e6ab9067c4a180091e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370962, "uuid": "4ef05d25-a915-4636-a392-c0d4570d8e23", "value": "T17FE42362825E75A4B8C3A68044C433FFB3DA63FA69374605205D1CBEE2E83CCF5A7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370962, "uuid": "2d6df7b8-54d9-4721-b918-1c9e692497ed", "value": "12288:T1s2MD5Qyum0AHmzlTATiHy4+sDaB8g//Zi/KK00pOIu1n:TKVkEHSl8iHT+3B8W/AfpOIuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370962, "uuid": "47b32d48-f810-4348-ab5b-04a316ff21ff", "value": 690560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370962, "uuid": "1696400b-5f48-4a2a-98f5-b98fe9a884c2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370962, "uuid": "5cf2e287-bd56-4a20-9b80-7f60c1218bcc", "value": "Advice_07122024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b415fdc6-54e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779346379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346379, "uuid": "d9ba6c4f-6438-4fde-8e15-686231d32ff3", "comment": "Malware payload", "value": "5933e269803f8deff293c00a86ee6e16", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346379, "uuid": "33adacb8-3001-4dbf-9414-5d8bf932aaf1", "comment": "Malware payload", "value": "6c4f502d97ab8b86533e19e63a1a140a0a0d42bb3f74f807547feafde10494af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346379, "uuid": "95711853-d7f8-4a64-b0d7-3fdcc55da767", "comment": "Malware payload", "value": "ddaf7d2da6245ec72cf56ff60d48fad63dee87dc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346379, "uuid": "4e343682-2601-40dc-b120-597a3572e657", "comment": "Malware payload", "value": "66282b24339c16dc7fce625d80fccaae9d2b4d7e3e7001750e2da51a368859a95658043f83d7404e64b7fef28d24bb49", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346379, "uuid": "7162274a-f535-497a-ba25-d3465a5fbf8a", "value": "T1D517125AD12F87EE16F4E5CC10E82AAB8B318C9906ED54293FD58CDE0FCD639997910C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346379, "uuid": "27916736-93e6-454c-82b4-1cff78d27523", "value": "49152:6P1PUPpPVPYPOP8PMP/PeP2PGPKPhPLP6P9PMPUPgPzPRPsPdP2PxPtP7PZPnP3C:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779346379, "uuid": "50d093b0-d162-4a73-9428-83d9bd0f9e96", "value": 19614214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779346379, "uuid": "77ddddaf-13e4-4c55-be0f-9791c1e02efb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346379, "uuid": "e1cb702b-186a-470c-8518-f450a2bc9c22", "value": "transcript.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c63cb4-5525-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779375451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779375451, "uuid": "b2985d27-e9a1-45c5-8143-eb0d0c202677", "comment": "Malware payload (AgentTesla)", "value": "77163aeacfc909162a8e2672bcd0d20f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779375451, "uuid": "0bbee67b-cbae-417d-be98-961f71cd7d2f", "comment": "Malware payload (AgentTesla)", "value": "6cc26f7c50c9d2a309cb6de2059976acf46d3c50930a9e72e9d260c432b28f54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779375451, "uuid": "5b027b86-0f8b-40df-b3de-99ffba916a7c", "comment": "Malware payload (AgentTesla)", "value": "ac0693d04fc26a85cf886e43f82cee95503f3b74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779375451, "uuid": "247d02e4-f794-43e5-a765-1bcf1b40d3a9", "comment": "Malware payload (AgentTesla)", "value": "0ca714059921f1a48c85fa149538d26f0ca158dfb227aef0f62a96470c5fb1845cc76187cc92ec655d0d480a7fb27e1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779375451, "uuid": "bd160c66-7ae0-4464-945e-79e621f2d8ce", "value": "T157D4225189D9CCB6F215B3B0D063CF5826723132CCA96B68D728F62E70B1247D983D9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779375451, "uuid": "9510fdcd-2086-4c1f-892b-801687f6ced3", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779375451, "uuid": "0de6280a-4407-430c-80b8-de44b2ef5aba", "value": "12288:uXe9PPlowWX0t6mOQwg1Qd15CcYk0We1FH4l6/B/yAzUAxLMT4J:DhloDX0XOf4X/yAzUYI4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779375451, "uuid": "73afd2ba-7a30-4c2b-a1f3-2d02e326a717", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779375451, "uuid": "f069112c-6956-43ae-8e73-fa6665095394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779375451, "uuid": "17975d7c-fd38-4e61-846a-b84658a0d2df", "value": "HAWB No Original 2 - (for Consignee) - HAWB No_ D889163[2].pdf.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7fa767d-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779373417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373417, "uuid": "ff7a5e23-55de-4c60-8d1d-63e3fdffe473", "comment": "Malware payload (SnakeKeylogger)", "value": "2f3dda6fd64e130db0b457a436a85654", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373417, "uuid": "c3a9c25e-2111-4037-bf81-6876bedab20a", "comment": "Malware payload (SnakeKeylogger)", "value": "6cdc73c825f3c1dd9d61f8ba2cc4f8a7c43f1236d94f196191c7a2a922ecb3d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373417, "uuid": "f1a3105c-de04-410a-84a3-f677c140d46a", "comment": "Malware payload (SnakeKeylogger)", "value": "ade841a7d134346dec1b628fc0a3abd05a7a963a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373417, "uuid": "c7f19958-8eb9-46d2-9d61-52b984aa11e0", "comment": "Malware payload (SnakeKeylogger)", "value": "1329d3c6f94d452a7937b8b0c0e40469ca89a2cfac57454088ced48219864ce60a80e9b06dd4ded2f2df3cc45a45821d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373417, "uuid": "29a57aa6-4bbc-4dce-ae3c-2a75fcd14f1a", "value": "T1B455E00173889D96C99B1EF1C47FD51452F8AE6E522ADB0E2842B6772DF3302211B6DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373417, "uuid": "1c9adec1-af40-42a0-ae17-7293a436a6ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373417, "uuid": "e1c2798c-8990-48f0-85ed-695a4dff3cee", "value": "24576:GNkS7wJHlq13k2zqKUGJRXt+TaMBkZjmk45nRV1evkN/IaOkgSXZQT5oRo2rUrFB:GR7wDERXtSvMsR/1N6F6ZQT5oRoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373417, "uuid": "48ef77ca-c886-46b7-a480-595f592d0b42", "value": 1364704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373417, "uuid": "4664e785-e516-41de-a38b-33c0b99e8d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373417, "uuid": "b9dfc4d9-784e-4a06-83dd-fb2b5d04b0d6", "value": "Revised_506133.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f63856-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373420, "uuid": "d3102473-2d01-4e7d-8ecc-1f8a8dd9ccc8", "comment": "Malware payload (AgentTesla)", "value": "f0b4be3c7c560c4e44db1bd07ade1655", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373420, "uuid": "accab9a6-5d21-4f58-84b2-fa0f8dacb204", "comment": "Malware payload (AgentTesla)", "value": "6d1142097d69b5d05cb3774ad591d53ab7759222ed8b563042121321b84db577", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373420, "uuid": "45718c69-9064-46fd-8ca4-d2ad5a22d6a3", "comment": "Malware payload (AgentTesla)", "value": "b3311a92175b401f7d6eec1b97d6bc20988f75d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373420, "uuid": "358579cf-6c4e-467a-8914-5cc95f0cf1e4", "comment": "Malware payload (AgentTesla)", "value": "214bd97f348c1f89466795820d3e555e2b1fa0ed47ded9961c4d3906c7d2f81a1588922bb3e93abdc65a63e08b5e2c35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373420, "uuid": "3432a2cc-d249-4089-b202-d1457838144b", "value": "T192E41240627A6B27C4AE87F50DA0D6313BFA7E6AA413E34D8DD23DDF3636B504581A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373420, "uuid": "69629bf8-60a4-443b-b0c1-24b1e3709760", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373420, "uuid": "400349e9-a066-4b69-a1df-684cbfe3327f", "value": "12288:c9iBCwgqaVouU9D8II0biIRjhAuQgQzaXRZT0dv0i534xjnwXqPnRJEaVOTvct:c9uC/qaSuU9D8I0ICWXRVIsi53ujwXqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373420, "uuid": "3d9b7078-1fa3-4601-8828-14f0ead0dd2d", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373420, "uuid": "65fc0d82-c5b2-48b0-bdc9-176b102909e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373420, "uuid": "87436d37-4765-414f-a2ba-6ab47ed827fc", "value": "New_order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d2e7b6-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370969, "uuid": "a59ae423-0dc5-450e-85c8-f738cbdace28", "comment": "Malware payload (StrelaStealer)", "value": "b2579a966e6f5f334592e4561c4681db", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370969, "uuid": "fa71913a-8e5a-4b3a-ae10-c0a365274f51", "comment": "Malware payload (StrelaStealer)", "value": "6d25a41c6fbca73ac8911275c11f82b9a568da14203d2b1c98fdfc837956612c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370969, "uuid": "ecf395cb-da18-4cc3-979e-ca60a7994d98", "comment": "Malware payload (StrelaStealer)", "value": "77e8feb588c3d255a9517f1004e8343f5cc8be59", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370969, "uuid": "cd26622e-3dec-41d1-9633-fba62d120305", "comment": "Malware payload (StrelaStealer)", "value": "ac1b85937d314e78dfce1244bb9ada46c3190fb02e3331d7b0ab85a0be30ea43878eaf593c7b0d1254327a1792289585", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370969, "uuid": "52c06679-7565-48a0-8550-58f4f3d02d07", "value": "T159857DE3854B2BAEE6FB5C8F078B3AE348155F2778586CC5AD2E43038E344903A65577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370969, "uuid": "d7bb0f5f-81fb-47b1-be4e-1f3a50eab647", "value": "49152:CSr2+bs7lPe277lNdl0QV7HRBd2DD3E/9crPLGNp7r+75r4tSeeD0S2e277lNdl3:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370969, "uuid": "7d8f112d-4d55-422e-bfe8-f678193d385d", "value": 1726660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370969, "uuid": "f356dfa5-9492-4128-a74c-8260d53c6b82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370969, "uuid": "5a4b7b15-dedb-430e-89ff-691087e04110", "value": "1696328461679528332.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac036d12-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779373423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373423, "uuid": "9ccfd0e8-9e6e-4aba-a4ce-c53bee2df800", "comment": "Malware payload (SnakeKeylogger)", "value": "3eb492d50988a1e7c5ad94add44310b0", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373423, "uuid": "7de5ab4c-10ef-4c49-8f32-155f2023f8ad", "comment": "Malware payload (SnakeKeylogger)", "value": "6d38e89e502363315b2520c21841a62574fa25a825b957fe082a7c2f6f286300", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373423, "uuid": "64eea9c3-9212-442b-87c0-1cccdefeba3a", "comment": "Malware payload (SnakeKeylogger)", "value": "a50fea5a22683f6a81773986d1584678e3f93e60", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373423, "uuid": "8b7d17fc-81fe-48af-a926-52ea047a34ee", "comment": "Malware payload (SnakeKeylogger)", "value": "dda17d1f78ec6669df82481bda567fc95d48475e5c8ab00c14520ba9be0b3481b86e9bf56ee706fd4039b51ea109011f", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373423, "uuid": "3c06d3e0-f2e5-4120-93ce-0223d7656830", "value": "T16F8423579CD5C4270C8751A189730694BFC312C2CB971EFB1BBF62AD9A065CE0E61B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373423, "uuid": "99e803b7-a11b-4df4-831b-9107109574c5", "value": "6144:AsE1Hid9GwWd7LEYJS90GHxOfWRUDwqftiQr8ZLW4WgZ3kmvDyEEyw5TICs:KdI0GHxOfxt981WWkEEyC3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373423, "uuid": "e322d3aa-164e-423a-a093-210dc4ba0cd2", "value": 387146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373423, "uuid": "8ab94c94-c72b-4fdf-ad81-947eaf171438", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373423, "uuid": "c783bdba-f982-465d-b844-1bb52154da35", "value": "PI_PAOO8368.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14e13d7-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373432, "uuid": "a389ffb7-cf09-4d4b-a5af-b0c4537746a0", "comment": "Malware payload (StrelaStealer)", "value": "049141ffc7497876ac77c9ed547e2ccc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373432, "uuid": "c588931f-1b41-423b-ac36-a38834edb710", "comment": "Malware payload (StrelaStealer)", "value": "6d9546a642119939153c1d31eba6f20b724b80a6893e44fd4b894a1656762163", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373432, "uuid": "1e52559c-ecab-403d-9f36-00860546bdc7", "comment": "Malware payload (StrelaStealer)", "value": "d1f03b653e57ab3dd80be87f7da64e273ef810e0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373432, "uuid": "2568f167-513c-4d2a-807e-2ce9e2bf5881", "comment": "Malware payload (StrelaStealer)", "value": "bcb108e49f3bd65fc15b50defe1b0f188fed1cb7140c94eb3c19c8aea03bb056b5de03ef5a4bacf3fc6eee60f6097e62", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373432, "uuid": "9590b2a6-96a5-445a-98b6-af56eea9479e", "value": "T1657200D2B3589999BF03FF843AA8101D485F4C7DD4AA871C7549E9BC9B33A38264F4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373432, "uuid": "0c47001c-2150-4bbc-80f5-468d09971266", "value": "192:5BZhK3BF3VtFmmPV4ADRRDkgWWVEpgUPzX/SSBv:XKRJVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373432, "uuid": "89644943-0146-442d-b6bc-27698792357f", "value": 16516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373432, "uuid": "c1ddebb8-7516-4c6d-90ce-ed45928b9f1d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373432, "uuid": "d61729a6-052d-44b8-a6bd-55b4fd1c8076", "value": "2712819041088312742.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e062db-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370972, "uuid": "d5758b2c-b464-4f97-8afa-b67e37e66f79", "comment": "Malware payload (StrelaStealer)", "value": "2d9ee3a9f4e6c209be7e61f61d7778a6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370972, "uuid": "1f6dded8-6a0d-4e2c-b928-c6b0c6d33a96", "comment": "Malware payload (StrelaStealer)", "value": "6e3758ced0404dafe5c4dcc482526c8a59af581aac2f72b4e1e53ef58e779c09", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370972, "uuid": "6c05e1f8-577e-489a-946e-afec1ec3d52e", "comment": "Malware payload (StrelaStealer)", "value": "f020f79f68609d3114c9eeef3f2089d0933e2a7f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370972, "uuid": "c36a8f56-ade3-4e3d-85fa-7d388397e3ad", "comment": "Malware payload (StrelaStealer)", "value": "38ab7008ace53b4174b1859944a93c40693679c603b5c0a35833f85b4161d92cc20ce30ccc112833e72d221e4f832ba7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370972, "uuid": "66df4798-789b-4312-a3a7-1c9c1cfad9e7", "value": "T1F145BF6BDB0B37CD1950AA5A88BFD1844B6C8F521E25E4F8B40E99434E16D273CD3B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370972, "uuid": "4a5e4a30-5d02-4d7d-b129-13353b0f6f4c", "value": "6144:YOdprF3QBk+SDBd46xzDi1MUcHFyEXZTtQCPh6UoDLb1PhKpKcFEKGfU6FFFvIDT:td9F30eBi6z2O1l2HP6qpT6qrTypSB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370972, "uuid": "10e5bcae-ec40-4865-9e46-db6b80c51a37", "value": 1169321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370972, "uuid": "ba01d6ba-4ffc-419e-bf3e-3feab87edb7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370972, "uuid": "85e1990c-426d-4b95-b3c0-bc5e10391fb6", "value": "19277250252810718861.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d06384-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373438, "uuid": "eb3fb9aa-a0f0-412b-a915-89e59da0f33f", "comment": "Malware payload (StrelaStealer)", "value": "32122d2e33f2dfcbb6e008a40fbe823b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373438, "uuid": "a1194809-65f7-4d88-8704-1e02dd3fcba0", "comment": "Malware payload (StrelaStealer)", "value": "6e5e5715059b4f8332540df413de5973d53294d7a5c158e7196fad6607a51129", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373438, "uuid": "d49281dd-78d1-4c0d-8b2c-f8826212b440", "comment": "Malware payload (StrelaStealer)", "value": "96d9873187cd53415718ef504d3ff16cb2aee761", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373438, "uuid": "66e1ae9b-50e8-4980-b5b3-f96381d7926b", "comment": "Malware payload (StrelaStealer)", "value": "f33c9f2a17763bb82357a3b96e8f26549e288919f594f7bbf61039d199de51e5daa775cc476ed66e24f6372123ae87fc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373438, "uuid": "abfb9289-2ccc-45b1-b613-fc37c66bbf3b", "value": "T1BC125C8AB38427A846D04B6954493332D15881A01BA7F269F55F531C8548CFFAA3FADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373438, "uuid": "c74f66a3-802c-423b-8b17-ccb75256e942", "value": "192:e0gWrKoITcaVJpGu5e8FUqtrhcGjISbZFwf5qOSpUL1TJDBXQhGowFBDeO:evhoSJpX2qtrhBjpbZFw0OqUL1TJDBXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373438, "uuid": "a1e483ab-277c-4d51-99e4-4d5e0c62e373", "value": 9909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373438, "uuid": "d52c0abf-4760-46f6-ba0d-517084b36fb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373438, "uuid": "22982134-4088-4f03-ab3a-4d1fbf40f703", "value": "35222523278945155.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86c2930-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373444, "uuid": "9e2b9a7b-cd2a-4210-b406-196cdc15e093", "comment": "Malware payload (StrelaStealer)", "value": "9b9165a4a8d03ce91910a9ddd5b66b32", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373444, "uuid": "d0e7962b-4e02-485d-b535-ba0d823f8fe4", "comment": "Malware payload (StrelaStealer)", "value": "6e9e0b92e2c290a48430b8ecd1a4f592effb2bd64bcaab121f06721f2a46da34", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373444, "uuid": "c99d7deb-9744-4c65-9cc9-3287240184da", "comment": "Malware payload (StrelaStealer)", "value": "24bb0fa72d40f950c81793aaa92cdca99d621af4", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373444, "uuid": "5830385c-a510-4d07-b580-46ce580613a1", "comment": "Malware payload (StrelaStealer)", "value": "2499e5cb3c0a10e02a82d0ddd86788459ce1a7c36d5df873444664dbff84a3c93bbcdbcaffe4af31ecab370e083b7ff8", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373444, "uuid": "c41033fd-fec3-4710-b39d-d78b83a84bf5", "value": "T150F002C5F53CF500DD8EC6365ECB222A6D7F1022A3E1AEC2432E27511D00FDB887940A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373444, "uuid": "d7bf9de9-cbc4-4890-b88e-27c4f4b8487f", "value": "12:5jcVAPWv1HMpkVJ66GHOdl+diMAwvUUBQ8RFpQpJn9AJGx5c2sllt7taW:97Wv+GVJRO/AUbQ6AL9yG82s/tR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373444, "uuid": "66298bc0-4346-4107-a47d-ce72f649ba15", "value": 654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373444, "uuid": "f29e71f2-1c63-446e-b7fb-7d8eeeeddd6f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373444, "uuid": "8c68d479-c77e-46d2-9adb-dc8e3afabba6", "value": "1542615.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7f2307-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373448, "uuid": "fce598d8-1b21-4bd7-a301-a91b41424fbc", "comment": "Malware payload (StrelaStealer)", "value": "36196546e26515d9ebb277d019f62f31", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373448, "uuid": "723dd9d9-6ca6-4fb5-8f9b-316bd985ea4c", "comment": "Malware payload (StrelaStealer)", "value": "6ec3461dd42456f2180653af4aae3d5f51fbe2bb1f735b09cf43ea3b70b59b51", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373448, "uuid": "d7eb3772-4f5f-4f1b-8771-2a0830fc8e32", "comment": "Malware payload (StrelaStealer)", "value": "378297d65d496790e3f2cb8de6e3506c06c49f67", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373448, "uuid": "3a2fcb1e-b6fc-48d4-a695-8448984ffda3", "comment": "Malware payload (StrelaStealer)", "value": "c9a3e9d235223c3818535c5f2150e4479e944556fec5107b014e3768bb47f5d7409ba77c3dd3f00bce1798264ef08e59", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373448, "uuid": "cbae06ff-2bba-47c1-8da0-45264825fcf3", "value": "T12531B50CCF4DCC65C44766FEC6A221A4A79C357886FD5BFF8621C8290C225C89E56148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373448, "uuid": "850b3767-c17f-4c28-b400-de1480b3142b", "value": "48:9dxUDo34G9e/rYY/aE/Bqdav62v53mwQSaYO/:b8FEYr4+66GSdO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373448, "uuid": "ff71e6d5-ae71-448b-95a9-dfed467cd694", "value": 1548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373448, "uuid": "4981caf2-4db5-4787-bc10-5b3fa713058a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373448, "uuid": "65d3f235-b7b8-4002-8481-cb9d739409c0", "value": "Rechnung_03.07.2024_30001751422.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc80fac6-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373451, "uuid": "348a915e-1db6-48f1-9686-4c4b6364851b", "comment": "Malware payload", "value": "1a362bc4870a9b5a545b6dbfa2c21f1c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373451, "uuid": "3220f9a7-c779-4351-82b8-30897588f519", "comment": "Malware payload", "value": "6ee356c1c83b2328332a201147ab452b912ec7cb9bc98a39fb0ba9eb0ef52241", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373451, "uuid": "9f5c18e3-ccd5-4035-87a6-a93f0cbe3e1c", "comment": "Malware payload", "value": "8de1b285cb09215322c72d3090cb79091d3d956b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373451, "uuid": "46209778-4ba6-476e-9c75-096070ccb55e", "comment": "Malware payload", "value": "901a63edbc0ce356d3703b344ecd47abc4c093e52e215de6353524c5c6d65f4e3debe8e67f16eea88af819b988285bc6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373451, "uuid": "ae4625a2-acc3-4132-af3a-256ca54c0a2b", "value": "T19BF0622C4B3C3EC2E16682F8371D4000708B4C215855BB9EC618F6F4EDADAA736C7243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373451, "uuid": "295bae00-eb8f-49f0-a963-b1969c8380ea", "value": "12:5jjrjrc8zulfjMgtRq4c/E5XrlAdlb+yO2sXwnwBjl2i9Srvj7tak:9jrjgplLMkhc/llqyO2awnwfzgrvjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373451, "uuid": "27b2afcf-b8a7-4e79-a16b-295fdbe66915", "value": 652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373451, "uuid": "61f7e8dd-fd01-41fa-a756-044ebf60eb84", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373451, "uuid": "d98f5a1d-3858-4fe9-81c0-f7561ca9ffad", "value": "FVUE-003417-24-MG02_67254---Berner-4135.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb65670-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779373455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373455, "uuid": "3caae1be-612f-4427-a69c-497eb2f8b0f8", "comment": "Malware payload (RemcosRAT)", "value": "f88f1bef834b75a6b86c5f6ca66f661f", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373455, "uuid": "d29fe83e-c8b8-4fa4-a048-96f043e8fdf7", "comment": "Malware payload (RemcosRAT)", "value": "6f092d5e0d673bd98e17937bbb94cf4f8793d5ae547d4ff4822e425c240b5c0c", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373455, "uuid": "85e908ee-ad53-422c-934d-d354bf17ad44", "comment": "Malware payload (RemcosRAT)", "value": "8141d9e2acddcf02c3936f7bc2ccf4f6fcc92f38", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373455, "uuid": "cbc7b630-4f9f-4c66-a572-b3b9411c0cc9", "comment": "Malware payload (RemcosRAT)", "value": "450eead78d856a9c266ca4e632c556d113d663d06108ecb039039fa6932206e5d12d3c2cf5b457fb276ed18f26cabc0d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373455, "uuid": "a651f7bd-9175-4fb0-9a8d-29e91a7b0e34", "value": "T13315333FFEF9983C883876507DF5262414BB620D110297765ACF791E8D5EB2A1B23287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373455, "uuid": "42ebcce2-1396-48d6-8201-d7e04d237bf7", "value": "24576:8zUYYhopRO5m6toh5SCRutkYXmNxoNqo2SbuejFFxz:Zrcg06toDrRekYmUN8IFLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373455, "uuid": "dd9ec07b-630f-43ff-bc6f-e992565d46a6", "value": 903299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373455, "uuid": "68f69da9-58e4-4a35-9506-8fd0857e2f1e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373455, "uuid": "2f9016d9-4a87-4e8f-8389-b69421a13348", "value": "rfq419.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ebd053-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1779370975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370975, "uuid": "6310456c-a25f-47a4-9c0e-f4cb45e21caa", "comment": "Malware payload (DarkTortilla)", "value": "965100ccdb71584c6d3eb5796677757b", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370975, "uuid": "f4bfdde8-c0ec-4851-96ea-57a33757db96", "comment": "Malware payload (DarkTortilla)", "value": "6f195a9d2317fdb860bb81c2e8fcb866a5f52348b54334f5c8a5b8b7bae8746e", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370975, "uuid": "7c122eb5-0dd5-47a4-8acb-95744331acfb", "comment": "Malware payload (DarkTortilla)", "value": "ef347d763a3a1f1ef93f85cef9fc98610154a650", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370975, "uuid": "1e8b32e7-a846-476a-abb0-83d5fd36977f", "comment": "Malware payload (DarkTortilla)", "value": "f633b297c10aa60c8a9dac67446c2328eb3364bff0bcbe1bf66859fa9ad24662eda0067f88dae33b279a6f84d6be2cde", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370975, "uuid": "be79fa80-f3ac-460b-985c-2ee828533992", "value": "T1AD05E04913E58A80E4BFBAB95475008803B9BE1BAC36E35D11A871FE5F72743DD113AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370975, "uuid": "714b81a9-417c-4cc9-9d0e-e71292745871", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370975, "uuid": "faf7181c-33dc-468d-8f3a-f77e25a27368", "value": "12288:guD49ivhz2yi7duIrPpY+KBP7RUntzvyQYm23FolZaNLn:H4qZBIrKBPanxqmiFolZ2Ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370975, "uuid": "e0a896b7-0051-4b0d-b36f-521deb98c0bf", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370975, "uuid": "aa942171-3bae-4aae-9ea2-3f0214cc198e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370975, "uuid": "051fb4fa-4392-4599-8c02-b19d5ecaa58c", "value": "009883827379283.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0daef0c-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373458, "uuid": "eca42f0d-dcc2-4dac-b823-ee88d4b2129f", "comment": "Malware payload (StrelaStealer)", "value": "2adb341aac40029b9def38a84bbc340a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373458, "uuid": "5c0f0dd7-90fe-408e-85f2-2d27a5b0b360", "comment": "Malware payload (StrelaStealer)", "value": "6f1d7c74e68fc707cf97686965acedd80b8f2e809618589a2a4d4cc0fa08a36c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373458, "uuid": "abf9038e-5d74-48b2-8f74-dd7e13bbcb2a", "comment": "Malware payload (StrelaStealer)", "value": "1a3d552738c7da0f090791b2f1744a713a25cde5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373458, "uuid": "6c8b5cc8-f50f-411b-a8dc-c18045b9600d", "comment": "Malware payload (StrelaStealer)", "value": "ddc7fbb63805dd33c03d204cfc4c47fe3d7a928aa8fe403a347acbc553fd09e9e8da2405743df705372355ea0e8425e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373458, "uuid": "74d47da8-7577-44a6-938e-797d4b91a510", "value": "T181C1F0AED8D11B0A59E4ADB63E609E042B8688171F44FCBCA2E481F498693FC7D73750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373458, "uuid": "69125a6b-73aa-4e53-b2d9-7ecb120d811a", "value": "96:oykZ9TmZ9cu1cuORJ8g4OHyHnrdDlD7j2lAE8kw7:S7TabzKuEslD7j2lAE8kw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373458, "uuid": "d1ac8424-eb52-4048-92ff-acfa2417adbb", "value": 5910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373458, "uuid": "1098335c-e650-40a8-978f-68609e397ed7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373458, "uuid": "3a626721-cc13-4578-b064-eab6380a14c8", "value": "168463451128271716.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2eb6cdb-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373462, "uuid": "1e9f2bc6-3654-484b-ae64-aff6aa169a85", "comment": "Malware payload (AgentTesla)", "value": "396cff0f2cb19ca26a0783dd5ac956dd", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373462, "uuid": "7a1dfecf-337c-4644-9d36-005cd331d1b5", "comment": "Malware payload (AgentTesla)", "value": "6f3b2062fee413c6b26e3ee6657d047a9d66c6a7c2dc7c43afe6bdf2c70820b2", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373462, "uuid": "514dd746-92b8-4ac0-9106-7221ffefe2f5", "comment": "Malware payload (AgentTesla)", "value": "fad23d27b7f68fd2dc07e70722d79ba255f7c418", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373462, "uuid": "1d6ef196-a100-4ba5-9e0d-6b719d5aacc6", "comment": "Malware payload (AgentTesla)", "value": "37b67ab2e4242853b34676bb8f89c9e12ca1eb9eb836fc460664e3fbc5eed5c1edab99ca711068b604908b8e076f2dd9", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373462, "uuid": "04575fc7-8ddf-49ca-9dd1-c5b1a0da32e7", "value": "T1E2A533E2948B2364B483D533FF8D35548CA16372A1B7858A34D8B785BE1A9FF1F74068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373462, "uuid": "2902aa05-e73e-40ce-9f0a-3054eca6d2e1", "value": "49152:QwG+9e/uen15ceSB1Z8zmam8COxG22haQ3J7uKC9bTCH79:BXaD15cvMZxG2CJy79fQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373462, "uuid": "5ac43579-e3a7-4b15-aca2-38e47b2b9a0a", "value": 2226624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373462, "uuid": "1710b36e-b510-4de2-a6af-6ba28c3344dc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373462, "uuid": "132cf2e6-1a3c-4db2-a4a7-bf39d8c3f505", "value": "IMPORT_PO2024-0961_ASTG_(1).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5049f0d-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373465, "uuid": "5d3d8c0e-6180-460f-a274-b070f5da916e", "comment": "Malware payload (StrelaStealer)", "value": "48bccac79ad215a293a0f6fc46dad718", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373465, "uuid": "5e5c92c7-f50c-4b82-ae63-ae97b49abb08", "comment": "Malware payload (StrelaStealer)", "value": "6f72a3a915d69e757c8a7114f42c28ad6f8fdc6e96b5ccffa078c39e4df6643a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373465, "uuid": "1be925ec-85e9-408f-b280-ea250ac64e7d", "comment": "Malware payload (StrelaStealer)", "value": "b55c94784845f560a4a530a95aae6a38febe76fa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373465, "uuid": "ae2260a3-59d3-403b-a444-ba3943fcf04d", "comment": "Malware payload (StrelaStealer)", "value": "b4d81b6b61dfd6014a7fe2b47a26ee43d4f07b8b66852d19b050d5cf4069c6612e8ce4b3ae7d3af80a7418530c870ac8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373465, "uuid": "0993f938-03e9-4a9e-9a32-c5febaffbe61", "value": "T13192CA61E38B2ED6D79B82F58847A130C3EE41B186553350E3314DB58DB7BC263D63AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373465, "uuid": "3f5c201a-18ac-46b8-afae-666ab22673a6", "value": "192:8UIPEifWlNrV2nHy62rHQ9QGwD6wDI6f6v6716F6H+6k6P16M6766w6OC6r6xDIk:8pAxGYQ9QHZ4l+fRlH8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373465, "uuid": "1c3e1c6e-5709-419a-a494-b9428c811775", "value": 20803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373465, "uuid": "8b949da2-8102-4844-a152-76e430b02ece", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373465, "uuid": "cf1d22aa-7b3d-4b94-900e-1c652ac698f9", "value": "6698101312154716856.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f2f7cd9-550a-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779363792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779363792, "uuid": "bb6c078c-b86a-4ece-8dd5-211afa250d6b", "comment": "Malware payload (CoinMiner)", "value": "7c220ef1ed6e4abfd5aaa60736d5af39", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779363792, "uuid": "070830ad-3f1b-4061-ad7c-c0782734b46a", "comment": "Malware payload (CoinMiner)", "value": "6fc6f8b1c1f62316088292908d81764321cbcf84cad433f3485c0d27b7d5c15b", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779363792, "uuid": "6a29debf-7ac1-49a9-9609-8b1dde9b492c", "comment": "Malware payload (CoinMiner)", "value": "843ed13a1f41c7dd585984fe34f08be9f215bd2c", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779363792, "uuid": "6a6a393c-b972-471e-ab98-caf071dd033c", "comment": "Malware payload (CoinMiner)", "value": "1e58cbe0fd73d6938297c0ad05c3752175915951031b53906a32baed93da17dfc3db52174706a178dbf2a873fcf16714", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779363792, "uuid": "66beefec-2be8-4d4f-9cd6-24e2c1543035", "value": "T135A5337FED3B6C49E57638F6366C6859A6127DC43206E01363FA40EB3601D5EEA1EB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779363792, "uuid": "c84ef353-6a7e-4e55-9d0d-5820a3499115", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779363792, "uuid": "93fbf88f-dfab-47b8-a1c6-3aa79b9cac1f", "value": "49152:5PO7m2PvNilHnspNDgo3mzqD5D5HyVIspO1jvyk:ImMilMDNOqDJtaO17y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779363792, "uuid": "02e5af8e-0359-4375-81a0-96f1a328fca2", "value": 2203648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779363792, "uuid": "df70e713-a8dd-4622-bc67-51563f5bde08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779363792, "uuid": "1ab2a596-a631-4dcc-9bd0-2dd23bafa35a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fafaa992-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1779370979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370979, "uuid": "b2a05e48-cc13-453d-8b55-27a13809a55f", "comment": "Malware payload (RedLineStealer)", "value": "d1054788877284f642c5d865684e1104", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370979, "uuid": "9ad4daaf-ddc3-4909-95d0-6c38340344d6", "comment": "Malware payload (RedLineStealer)", "value": "6fd9ef5dd0bf122a7c4154fc725dd86f16c4a070e2d2567f690d9ee614ca94f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370979, "uuid": "d052bfc1-54f8-4be2-aea9-ae6e7756cedc", "comment": "Malware payload (RedLineStealer)", "value": "f5ff744b7dff2fed3436e8648b8d20e9ce62e6bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370979, "uuid": "0ee4d9fe-bc0e-4278-9bda-3f65829ac907", "comment": "Malware payload (RedLineStealer)", "value": "155cc4ed370113367c4c3dc372c9c1213eb595876190a1ea2cf547840ab512489d24f914e3fd7f97dfe2120d8b2a9b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370979, "uuid": "995ce404-6797-40a9-8260-e4ee8e43ebdd", "value": "T1A585AC6D696A105FB0219B6C5AA1B5B5D0CEFFF637C658BE143331460233A0298FC77A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370979, "uuid": "8384cf21-77ba-4dd4-9425-31c1832976a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370979, "uuid": "b7f3d292-ee80-4cbe-80fe-71c2b72aae57", "value": "12288:HIGTgPye/NmdVXl6QGWMRN7NrMk0jlNfIEd:eZW8kNdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370979, "uuid": "37a77a8d-4e3b-4f73-840f-4d0aa489b663", "value": 1734656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370979, "uuid": "a5ad6c94-0e37-449f-b087-d7c5ae09ac49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370979, "uuid": "dc80112c-1954-4f54-9ebb-b5241e73e848", "value": "PO#-RK155-AM-MICRO-03)USB_AM_TO_MICRO_1_1.5FT_..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b04a80-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373471, "uuid": "e721b7db-8a99-40b3-b556-3f2a635c2f9d", "comment": "Malware payload (StrelaStealer)", "value": "632b8a40216def7621acae27d51b686b", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373471, "uuid": "bfacf060-fe49-46ca-be6c-86a26791409e", "comment": "Malware payload (StrelaStealer)", "value": "6fea3a2966996b2dd30b970df3555f34e56cbaa514da1c77b93b8ff440910c4c", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373471, "uuid": "b11fe99e-dfbd-41a9-94eb-4477abb25d7f", "comment": "Malware payload (StrelaStealer)", "value": "79f0753607ea784a37e7ecf59223932e1cd45b2d", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373471, "uuid": "6daecf37-9440-4b19-b0cf-db57a69b1dad", "comment": "Malware payload (StrelaStealer)", "value": "fbb0b1f7d8c4fcb6d8ecb5e4f58c6adf0012153ddf1c5dc49b11911d3f5e33b87038bf3699dd48146435376a04dab53e", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373471, "uuid": "53e5baa9-1318-4205-bbb1-b73dd4fb4f8a", "value": "T18211B95E5F879244F6821B72EC97817646469C44E073E6A173E726F01E420990FAE570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373471, "uuid": "e129b64e-61c6-4d9f-803c-978a04523419", "value": "24:9oyXmZ7QO3anV3fETSEuEUz0LGbOU3r50G2vKilY3hYljGl:9oyXi9KnVZCU6Kr50GcrShYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373471, "uuid": "fd58cf2c-90b4-4ef8-b22a-f4665bd4c814", "value": 1096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373471, "uuid": "9e223a11-856f-4c6e-ba9c-96c5002ec7c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373471, "uuid": "b242ed5c-84ab-4438-a5de-ea05df0c0f1c", "value": "Rechnung_03.07.2024_30001751422.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab2486c-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373475, "uuid": "e4e27ff0-d664-4491-ade0-ed0c1f8809cc", "comment": "Malware payload", "value": "f5633f586eddc7cc6b14cd47e979a3bb", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373475, "uuid": "cd5347b4-bd15-4a84-8f87-82e50564db15", "comment": "Malware payload", "value": "7015b1694b5feff81655907045868ddc76f85e4b453ade3b90858b419cbe9dae", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373475, "uuid": "8ecd3f11-8640-4d63-9659-4caa46a55a94", "comment": "Malware payload", "value": "32ee5c8624df73838c1533b7642085fc2786c529", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373475, "uuid": "eff6fdee-bd03-46b6-99de-a6c64dccbc39", "comment": "Malware payload", "value": "fca45684de9bc87154bb382ea5deb6ab049f48b400fb60d0e7b26d77e8684c15fd04a3dfcdb92adeb783caaadcee211f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373475, "uuid": "6f358f17-2069-4cac-8e30-95b824027934", "value": "T1296113EE6BA64B8E9C10776373FA1C444EC106E54FCAC07DF502924AD6722DC2212E3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373475, "uuid": "12cbff7f-2b13-41b3-bf95-60dc651595fd", "value": "48:gIK/LtLxfgxv6xWrG1H9u5kj4gXEgNPlUz+xz+xz+xukccw4wUz+xz+xz+xukccR:gJ8ZYWqXmEEEM4tEEEgThAu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373475, "uuid": "3149072a-d463-4d34-b367-aec7c6354c6c", "value": 3192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373475, "uuid": "8a9e4ac7-307c-4537-9401-3e60aed6208f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373475, "uuid": "dee756d9-76c9-4de5-a13a-6162440e7ae3", "value": "102313252271503541.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9948e4-551a-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370985, "uuid": "4ad8e477-3d3e-4e29-a53e-4f33c01e9443", "comment": "Malware payload (StrelaStealer)", "value": "cdf9e03f6dc341ae0799d18b385cd053", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370985, "uuid": "f67ce5fa-c384-4396-81c4-fcef81952e56", "comment": "Malware payload (StrelaStealer)", "value": "7031f46cab40207f621cea84e831e2aa1e400dc7e95d780f9e82668d65d4b376", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370985, "uuid": "1c47398d-4942-45ef-8f1e-171e6366058f", "comment": "Malware payload (StrelaStealer)", "value": "edaa9bdca3c5f4b8f88508256bc7a6a64802b33f", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370985, "uuid": "00a5b7db-c80b-4d07-81d4-843b10d0aa35", "comment": "Malware payload (StrelaStealer)", "value": "31b15de4ba0f96c0387cdc92d8fdf5f0d71f958cbd6c62de67dca5e921b70e8af4b92b646a25ede2287a617a92c80063", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370985, "uuid": "be22b76f-ff96-4c23-aa83-9cca2548f851", "value": "T1A562BFA461E8B04CE48176B352CFC694996DBE1D4B38F4ACCD7426CAE4F5D3A5F10D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370985, "uuid": "fd83ce2f-8836-4f77-9895-57054b4b7a1d", "value": "384:KXP6f11ZjL/XhuIPcLky/9NaWLZF//8MiG1D:KXP6f1T//XhFDylEc8TG1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370985, "uuid": "94c72ef0-b59a-4414-9bee-19a2424c6e9e", "value": 15408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370985, "uuid": "c3804082-3778-45a0-bba5-af1876482f78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370985, "uuid": "db41fe25-c9ce-4bf1-b670-7d50ee7b2e86", "value": "RechnungX5464XvomX27.11.2024XMandantXX23239.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3a3834-54f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779354925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354925, "uuid": "72eefeae-2910-4948-bd74-ad9dcdf76e53", "comment": "Malware payload", "value": "000846270cb4357e27f3d3d180669648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354925, "uuid": "011a96f9-0334-40a4-907e-65b071b28a84", "comment": "Malware payload", "value": "705b2478da743c9e8b37608bc4d8f27e8dc4fbabdf0fa2f8f2f332c36baf8a32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354925, "uuid": "6c3baade-de4d-435e-8dd7-ec780fdc9f8c", "comment": "Malware payload", "value": "64d491b5806239f8046b1814147809904e77d21d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779354925, "uuid": "a1a2fe46-e24d-43d9-800d-ff78542b48d5", "comment": "Malware payload", "value": "577d135a82e08ff0fd11d4407bc3c8e781f433cf0e685ca13219e1ace47081424a31183a721b52a71b860fd698ed3698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354925, "uuid": "0a95abab-2d85-4105-b6a2-8fb6e35abfb8", "value": "T12C568D03796541F8D1E1E239C9277263AF29B88993383BD31AE19D702F763C01EB9756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354925, "uuid": "bed4ec29-b6a0-464d-9c21-fab21dc22ca3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354925, "uuid": "96594a13-55ad-46bc-94cf-716220cca006", "value": "49152:i9WNK8w7tpmaNayoXbKZCn957z/NySf37xHImwst7eVY+c5:igKZpN1ZC95FyOHIXs9eK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779354925, "uuid": "b545bc11-3553-4dc2-aa8a-73b980959f7b", "value": 6450816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779354925, "uuid": "7923ad47-caa7-4401-8299-efda60589b36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779354925, "uuid": "b4460d72-23c1-463b-9e72-0fc3696f7939", "value": "000846270cb4357e27f3d3d180669648.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ad0840-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779370988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370988, "uuid": "8c7a27d0-bb3f-4b0c-9096-184b7d6de63e", "comment": "Malware payload (Formbook)", "value": "c0ae3ccc37cc1a43444617a4a97d80b8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370988, "uuid": "1dce6e92-4ff1-459e-a048-933fe76e9a38", "comment": "Malware payload (Formbook)", "value": "7081baf52611d77e9d7bb1686095caf0fb381e66cee1a2c829f009a507434469", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370988, "uuid": "e18a3c81-bb34-4035-bb47-54989b2ff7d9", "comment": "Malware payload (Formbook)", "value": "b11ef40a6097eb6c5bfba2fc778dc4319040a04e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370988, "uuid": "29c9cf6b-3e63-45fe-b47d-7a813b0fc2c6", "comment": "Malware payload (Formbook)", "value": "f6b5792fcc11a5bf5a386bc2afff506f726c4781e1ad8e982731e7eed99f0d5f7a85c08bcb28e94fb4cde97802117648", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370988, "uuid": "4d315128-72d3-4d65-b47b-62b6b1f26af6", "value": "T15CF43339A1C99F65AC4E90AF26678AFE463DCD93DBDC9CBF41AF5360C26E212315050C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370988, "uuid": "109fd6ba-1596-4576-af39-ac4fc37432a3", "value": "12288:O8utgNzwgWrD9by91uRR08Z5L75y1paoNCSVx4K41jEMX+a8Hq0zhLDx3:OPQwgWrQ9ALnLQAoN+KjMZz0zhp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370988, "uuid": "8fbc5a75-56d6-4c81-91a4-0c52b12da27c", "value": 792903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370988, "uuid": "263544d0-2093-4769-b58e-6dcb566208e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370988, "uuid": "5387baf4-a10f-4e09-8526-4a0d99cd78d8", "value": "PurchaseXOrderX#X4435-50.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce95b500-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373481, "uuid": "21aa2bf5-bc7f-43e6-b668-f13c47060667", "comment": "Malware payload (Formbook)", "value": "89955d931b10bf803dfb6617e9a0a994", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373481, "uuid": "8448b5ff-c138-425f-8828-43fbd8e569ba", "comment": "Malware payload (Formbook)", "value": "708485983114d04a0e498dac08fb74e0c7033a6af892d807f939d9801a59348f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373481, "uuid": "806c27b3-8f07-4bb5-8f80-1ea9b49a6ae4", "comment": "Malware payload (Formbook)", "value": "e9a707d4e2c0683f2f21a600cdd0d6ab2e74f075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373481, "uuid": "b4a8ad61-4ef6-4375-9f6f-bf29c633ea6f", "comment": "Malware payload (Formbook)", "value": "0f61d3cc205663a3694ebd1b98c784cf2af4aa77ba4b6b7a40914bf833844a5f487bbd5931a22431c359bb2dd6378254", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373481, "uuid": "546dd2ea-fe42-4231-908c-d0d3745f8827", "value": "T12855F122F5D68036C1B327B19E7EF769963D79360336D2D727C82E211EA05416B29B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373481, "uuid": "da60a57f-9358-42e5-9410-28aea2ebb4f1", "value": "a46a46b6741b96758ff5cf06d0c4c13c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373481, "uuid": "961699d2-4216-4ae4-889d-53b55622fcc3", "value": "24576:uRmJkcoQricOIQxiZY1iaCRMFXtu0SYQxwEYKuFzalDDEzx1c/c2e:7JZoQrbTFZY1iaCCFXErnxruhYU/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373481, "uuid": "12f94798-88e6-4c81-a54f-febf9341447a", "value": 1360189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373481, "uuid": "4fb3ca2a-92e6-411f-84de-c8980f603234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373481, "uuid": "4175fe16-7f97-4495-93a1-ccedc4e25538", "value": "Re_HAWB_no._#SHKGA0004506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a533bf-54e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779346495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346495, "uuid": "43d2d23b-878f-4ce7-bf65-d35cceccc73d", "comment": "Malware payload (Mirai)", "value": "853f34325743b6f97e11c418970e9f42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346495, "uuid": "c4192c8b-09d5-40f5-b835-f1290b5f615a", "comment": "Malware payload (Mirai)", "value": "70fcb486ae8841bd651ee731caa72774ac6f50256428419d3f506a3f30be55a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346495, "uuid": "b54d8547-0be8-4b2d-8341-d91add4c89b7", "comment": "Malware payload (Mirai)", "value": "5951360361fb641209a10012a4848693cc21baaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779346495, "uuid": "dc36b591-c71f-45f1-bc3d-8e31d592091f", "comment": "Malware payload (Mirai)", "value": "e13a76ba5dc28f6579c00fe9802c490b7a8dc3e54a8702811188ba511bb3f469f7bef71c6072da5f3c1b2f2e1200e2d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346495, "uuid": "d8b75af5-4b40-4d26-9f55-e6617357e81e", "value": "T14F13F130D7446F89CF1FAE7048F5968D04AD8C0716375009AFD4AA8AA446737E39E7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346495, "uuid": "9d5859ca-1574-438b-b8bf-2c8e2cbd4a1f", "value": "768:hJEoNYTGYoYXXfRLMabVT8murBS03jfENeUyfIjEZ6ZtnU2LJOg4azE:jExGcXXfdMaamsPoNedLZCTLkg4azE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779346495, "uuid": "7b6a7b34-5559-41e6-a6ec-89bda813ffbb", "value": 42588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779346495, "uuid": "6319aac2-d282-4e40-80fd-411677d399c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779346495, "uuid": "659b1643-c724-4e64-846e-f6819b8fe109", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ac444d-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370992, "uuid": "148302d2-8db8-4991-8533-6eb3d7fc0d97", "comment": "Malware payload (StrelaStealer)", "value": "4296b5036a6d0f5f9c9402138bfcf258", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370992, "uuid": "5a4d17ec-0de6-4933-988f-1b42887bba60", "comment": "Malware payload (StrelaStealer)", "value": "7126d0ebcfb9bbf640c972bc8e96fd2abd8c5a164df50abd45f3543587e2e603", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370992, "uuid": "232b5d45-016d-4ba9-965b-57fbab78d451", "comment": "Malware payload (StrelaStealer)", "value": "5c0037473d3c28a193b3dfd168c600a0e32bbcf8", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370992, "uuid": "c7f5a45c-7289-41e3-ae5f-a48c87f39496", "comment": "Malware payload (StrelaStealer)", "value": "9484581c8a46b0adc298e6684d726350371a027c29b2acb81a80ec2100a09371b16c4d682e0569c2cea9f42987e75635", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370992, "uuid": "2b6b2685-1005-401d-9f9f-9a3313fafaff", "value": "T188512CFA191B6832C5F7333210E84812B5D84726A5FFD3DB4924C2D9D15027A4E26467", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370992, "uuid": "1116d2df-79de-4ece-9869-bb11b316de5f", "value": "48:9rI826N/uE805Q0EsgoIyi+yu6GX2Xz7uKZun3Maj4MnJqwHOupEixemAuybe:lI82IuEH5QJsPApD83Ma3qYpEixe1uyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370992, "uuid": "53eda5e8-d3a5-4b18-8e32-817c248bbd26", "value": 2741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370992, "uuid": "a3377813-d7e8-49ea-b230-6172a8fd3859", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370992, "uuid": "bb03b427-7fab-4667-8983-24ff7d19a6b6", "value": "Vertrags-Nr._56182090__WERTGARANTIE_Beitragsrechnung.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a990c8-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779373485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373485, "uuid": "075830fc-1355-4cb3-8528-22c4112d3b78", "comment": "Malware payload (SnakeKeylogger)", "value": "191370df8874590d899021ffb4f3a197", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373485, "uuid": "d4e56782-e187-4c03-97e6-8b6517e27118", "comment": "Malware payload (SnakeKeylogger)", "value": "7142ae770c1e8a3e751417f20128f323d81aa5e6a1dfe7f695d4b58a094371b2", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373485, "uuid": "0726c916-21b1-443f-83e6-7730c5aca469", "comment": "Malware payload (SnakeKeylogger)", "value": "68bdb70c5189d50f3d4fe6bb55fd7e1a7fa7eaf1", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373485, "uuid": "269ef24a-727c-48cc-ac44-d949d1c92e61", "comment": "Malware payload (SnakeKeylogger)", "value": "5872b18e518bcd55ed0bab0a0c9d16ef82c618c40770f8f6c1f2872f637670b5bba2794dd02596a2e97f3e6fb98c954e", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373485, "uuid": "f1530325-9370-42f0-b05b-039132e7bf80", "value": "T12DE433D5C4B4752B662E50F64BBDCFB86F65ED10A43C2D1F8D8DAC48630AD420A6FB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373485, "uuid": "db1909ed-2786-4324-b1a4-16b69423f596", "value": "12288:3NT9025ds2r47NxXiX3iflgNl1f6EwIzLS1E+1zD3qs1YTyF6mvO:3D0m+W0N5s3idgNv5PuD3HOelO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373485, "uuid": "12e277bc-977a-4f1e-aefb-ff872397272b", "value": 686829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373485, "uuid": "149f118b-0240-41c3-bd35-522422ea866f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373485, "uuid": "3883c65b-51f9-4d47-a2b6-98fcb8079036", "value": "Scanned_Copy_Detailing_Customer_Remittance_and_Overdue_Statement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad4430a-554e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779393259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779393259, "uuid": "d8bac3a3-c544-409d-b6e3-3d5146aca6a9", "comment": "Malware payload", "value": "3b8285110fd3149e08c00c1ad704b741", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779393259, "uuid": "64e14dc6-61cc-4cb5-9e52-53cc5c62551a", "comment": "Malware payload", "value": "71900a7671e5d18c69a0185b2c91adbc5c5121582e4ab1115ca070040c8d18ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779393259, "uuid": "38107c30-d87a-4d78-9fb7-794785cfa962", "comment": "Malware payload", "value": "1023cf99e154d23952df42b54c1f9acb3ca627bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779393259, "uuid": "76e76c6d-88ae-4701-904b-6c01547cf803", "comment": "Malware payload", "value": "680775c38177e232487f4ace4d7b0d6dcc019f9b7c283e44a5e734f66716f7c3130bf88d2848e233db96ef61fd04c8ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779393259, "uuid": "1f6319a3-103a-4a8d-81b3-4af999a6cad5", "value": "T192762A97B8924952C4E43637BCBE81C432630EBA9BC7165B6D05EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779393259, "uuid": "1b5e445f-c14a-4957-a9c1-f2a7ff7e6e75", "value": "49152:wvQ3F8K4V6I9k6QE3Qd9hjxw513d0+q04BdcSVP4GFsbmyWkdup5Ev+:Kb6I9klEgd9hjxw51g4GFsKV/E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779393259, "uuid": "131ab444-f502-4d0d-9fb5-ceb240a25667", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779393259, "uuid": "df565e3f-07a2-4351-b6bf-9fd2348186fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779393259, "uuid": "7a41bebf-9c8e-467a-8ecf-76aa7ce11069", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46b16c4-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373491, "uuid": "ecb7fdd9-993d-4ba8-866f-a8c473e4a35e", "comment": "Malware payload", "value": "b39de4ebd956e1c453e047b327ede9b5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373491, "uuid": "a97391d3-8b7e-4d37-b83f-4d61de03e496", "comment": "Malware payload", "value": "7190a8457415c94c52d9aab5e10b32647db5d3165107a766288dc1a80154e5d8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373491, "uuid": "fde9e59d-3daa-42fb-a4e2-1b26a996ed1a", "comment": "Malware payload", "value": "c1e2ddb70c56dad7eda5beab5ffec5927832281c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373491, "uuid": "d4580f6a-b0ee-4b95-bd81-ad47ff73eb2e", "comment": "Malware payload", "value": "710fc25edfec4c43d5dd51ddddbbbe4ef0462669e02de8aa6a2dfdd36a5b354284b0a6caa48e6707c34c0e4141cd5346", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373491, "uuid": "e9cf2bc1-e215-465d-9d1b-c27097a9f8e8", "value": "T106012D0881CD0D42E051C9F0DC0B8A2DA2305D7B6024124E8E9EE0A23C7AF112A20E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373491, "uuid": "93f07ef0-862d-4caf-902a-3db06c01470b", "value": "12:5jCsFoEwNzU7zphCl2stO4sM6iu7VZoH2flNoX7edtw9F32wJ58a7ta1:994zg9El2osVZZX6G+9xMay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373491, "uuid": "740071f9-8a82-44f1-a6ff-5749634fadb2", "value": 659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373491, "uuid": "2327205e-0e8a-4eb7-b861-a3ead4656150", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373491, "uuid": "0a33d6e6-7850-4b8c-ad15-2fbf576a4409", "value": "RP24916095.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c86d125-555f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779400456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400456, "uuid": "acdf42eb-6580-4702-9fe6-5bb97396ddbe", "comment": "Malware payload", "value": "b6ed85fd62bc78cc7163aafede14ec5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400456, "uuid": "7567197e-cc80-495c-bc73-94f1e8e35042", "comment": "Malware payload", "value": "71b7fd817300bd1de8071bc3254c4015e00669ac69a29ba9cf6de1448eb3e948", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400456, "uuid": "89374297-c30a-4e98-a02c-19380acb7b1f", "comment": "Malware payload", "value": "99b5b1a8f1d5d97df2f1eda0b2b175c67aedcbe3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400456, "uuid": "5451c192-1fe3-4302-ac0e-8c735903a093", "comment": "Malware payload", "value": "c8b98c1993449efd4b70d86e5cfbea4ffae0bbef4eec1f4c5880ca737e782f15ad99b2cdbf38de1b8d7cbf98abc205a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400456, "uuid": "0aba0b82-247f-443a-95e6-5cf409492aa6", "value": "T13715CF66BC42AA52C4C035BAFA6E8188330353BCC3DE7605ED04CB3576EF99E4D39A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400456, "uuid": "feb2e27d-ef09-42a1-8873-6cab15d8b3d8", "value": "24576:m6KOZUhYDFrDTBpASyuAuuDmnIEsc6rVeaXZ3N/:eOBnz+u+DcII6rVeaXZ3N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779400456, "uuid": "69dfe198-fd47-4830-adbb-31de34035fea", "value": 882822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779400456, "uuid": "5031be3d-ca28-4a01-892f-0d00a30277cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400456, "uuid": "bbdd3fea-02b1-4207-95ef-d6b5094e2cef", "value": "wyszztw.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83b465f-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373498, "uuid": "a6f01098-fb11-4254-a8bf-fc555a68767b", "comment": "Malware payload (StrelaStealer)", "value": "03aa7b916cd89d9d3e0bc55bfd92baa3", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373498, "uuid": "ae3ac71b-56f7-430b-829c-5838b9cc34d0", "comment": "Malware payload (StrelaStealer)", "value": "723ad8db535483d07014ac0263f882144b4c6d2437b7ba83db312c648688d3e4", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373498, "uuid": "391412d2-2c9d-4d66-b21a-e2a8ec76556a", "comment": "Malware payload (StrelaStealer)", "value": "17bb0d436d5c344effaec6add9b2c6280d7184c4", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373498, "uuid": "e88a0ce4-8715-4594-8878-7f3dc479d6f7", "comment": "Malware payload (StrelaStealer)", "value": "f271bb57fc1a32c6c29c362afe72b92e6599974c1ab527df56752af7aaaa91bbe306e5c43155dbebf87408e3fd6235b1", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373498, "uuid": "f7c7658d-534c-4087-9875-e72453f3be5b", "value": "T14711DC8523F7C956D09FC3B510A60BCB92CA814F7174F5D78AC5375D8E290B5A412B0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373498, "uuid": "7837d500-51af-4948-a1e4-38ae1c46e670", "value": "24:9jqCKHxMNtaYIUyocYI9jsC44sgF3OnU0c/Ek36Up+w+BNIjz5o04MXYpIODI6DA:9GCwx6aYHyTb44s1nU0+slBNa9ofMXYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373498, "uuid": "64e6de2d-acd6-47ec-a9fc-e9861b87fba9", "value": 1081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373498, "uuid": "6d75fb75-0705-4132-8c10-eb99f67bc6f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373498, "uuid": "9a28e432-1c43-4d73-8050-46d575fbbf0a", "value": "Rechnung_40007129.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5b6346-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373501, "uuid": "ec4038b6-4788-44f2-9270-024d9a17c6d5", "comment": "Malware payload", "value": "db6567c6a341fa6307bf4e58a6e0daee", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373501, "uuid": "2b00e56c-fcba-4bae-b082-37fc41686149", "comment": "Malware payload", "value": "7246140d55e8fee1c610444e4d8dee55501f196f7d3dd30cc6b5a50da6234a75", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373501, "uuid": "e3e8c7c1-96c5-4eed-8bd0-632f52f3392c", "comment": "Malware payload", "value": "74a04cb1ed3a8086f438fe3650226b4c9e7273a4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373501, "uuid": "2e684a93-d0e1-40ab-89d6-b947ed3a7305", "comment": "Malware payload", "value": "91cc95c5a45bba29db2a45c01364cd1b3bc1025f2c972513af59c217b3939259c866ccbc6d50f016a3e8c442888157e3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373501, "uuid": "c25c1542-f5e3-4e93-91a2-5938c74208bd", "value": "T15ED18EE8BEA1CC68DA0C48F22A625805890ED89D944156DDF797C8C39F05773AE18D13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373501, "uuid": "ac49e9b0-8d3f-4712-9536-2017a938efc7", "value": "96:WCk/FnE/xLYv+5YaVoKLhTBVYbBNkYBHGRDRxJ49TDe8CxK80V4VRCDkq++jUUyL:4RE/x0jqfCbBNjQVJ49Xe8gkYRE1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373501, "uuid": "8802b6eb-025e-418e-a9fb-33225541e955", "value": 6183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373501, "uuid": "e9f26c5e-51f7-4201-b9a4-d48cc676e5f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373501, "uuid": "80d5d14a-d2c7-4765-a7b1-66d85a97a5ff", "value": "B2B_RECHNUNG_00002647_B00129688_RB00129697.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc766222-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373505, "uuid": "90f9aa1e-f1f7-4904-9e6a-fc4308e18673", "comment": "Malware payload", "value": "a37bde79f72661652afde3999e9aa6df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373505, "uuid": "756c8a51-8f8d-4d82-8d94-83d9b19ac87c", "comment": "Malware payload", "value": "724d94aa2eb7c09cdd8eca00e68017b430fe332c68a2201b5e308fe04715c545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373505, "uuid": "e42dac82-a563-49c3-90ce-1cdf1f05e4f2", "comment": "Malware payload", "value": "09709a8fa5da94c32b7cab1016aab4af7ff879f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373505, "uuid": "27daf3e2-6c2f-4a8c-bb22-93d5eb50137a", "comment": "Malware payload", "value": "9778ac135e7b425548e0bc70f501764ffebe102ceb663f05e894740a824925de212a9240ab678a3719d5d089529f919d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373505, "uuid": "b9179217-93ba-4ecc-b8f8-68912aff01db", "value": "T1FF052321BB649453CFB802B06275E1644379AE617CA3D2D83CDAB2CFC9F1B5152A0E4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373505, "uuid": "596d5dbf-b73b-4632-942c-4f5378d7222c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373505, "uuid": "5482edc0-defe-4f0f-a13c-ec27ab077637", "value": "12288:sU3929BC4rqhpSAY2CAV8dZDT+gLNuDeuDLaWkvkRtrKIkjL9yTMBF6pF7Ly/n0T:sU89BNuhQ/AYJLAD6NI49yamFiJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373505, "uuid": "407da906-770e-4959-acf7-d0a7e263e933", "value": 838664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373505, "uuid": "d7b0dd36-0f4a-42ea-83ae-e996709f16d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373505, "uuid": "01386835-195a-4e3b-8fa7-057e3ae50389", "value": "uZdFE99gyouWC1t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06486bb0-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779370998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370998, "uuid": "719add98-3d86-4bfa-86a3-79d84b1758fa", "comment": "Malware payload (StrelaStealer)", "value": "47608a4058bb4666b0004b69615ef21a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370998, "uuid": "e6d54966-26eb-4fe9-bd30-f97b8fa76f75", "comment": "Malware payload (StrelaStealer)", "value": "7288c193c4b1c43283ae500113c4483784f5a00fd4324130db52b93818699126", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370998, "uuid": "4f417990-1212-4a58-93cd-460cd55a44c7", "comment": "Malware payload (StrelaStealer)", "value": "10cf468e47860dcbc80a3edd8fbde3f3c1961910", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779370998, "uuid": "80fdb924-86a8-419d-817b-607c3ef54499", "comment": "Malware payload (StrelaStealer)", "value": "4905819c91dd01e1973f4a336e56ea89b0667536437348c3b2407f17be751e57a9689ccdc86ba371593a7d7f022fb14b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370998, "uuid": "b40c513e-dba9-4051-a19e-ad09c7c28b70", "value": "T1AB250A586C5AC3FECC0B77E95E703A79758C6923721085A967DBB9A1C37EC80BE06503", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370998, "uuid": "f50906a5-87f5-4901-9c4f-15014e4492ea", "value": "12288:piNZGeotyZ3w+mtlVUIvYe7bCpLIvYe7bCjp+vATIQ0z:pCZtAJ9UWBbCpLWBbCNgA+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779370998, "uuid": "f48ca7f8-1f12-425e-ab3a-f8bd68230e95", "value": 1042568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779370998, "uuid": "91beaab2-4339-4993-b8a2-63dab1d6f8a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779370998, "uuid": "d56ef2e3-be35-4bba-a6a8-f4de17a95382", "value": "538878958034386.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deab73be-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373508, "uuid": "c76522f7-5ff6-4ae3-8f3e-fb494ff572f8", "comment": "Malware payload (Formbook)", "value": "230ce8e14065423c2a85349c680702fc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373508, "uuid": "11fb4c19-9cbc-4413-8b8a-fe589c1d7971", "comment": "Malware payload (Formbook)", "value": "729274a4cec8c1dd1081d2d956de5c6f61b917674ad6dd2afc03c369e1ce4b69", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373508, "uuid": "39218f04-3012-4442-adcc-7ed8bf9713ba", "comment": "Malware payload (Formbook)", "value": "261153afab6e562fb87add8af57e25c14a852bb6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373508, "uuid": "d3e19de3-1f19-47de-af86-846425473959", "comment": "Malware payload (Formbook)", "value": "e7c22e6b89ebf90caa312472d3f81cbe334b287ed96ddaf0efb00e4a93d029630ef71d1ae990258f8007c78c0e1bc101", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373508, "uuid": "b89e3d27-2dd8-4e14-81d3-7a506d2e2a8c", "value": "T15A25330362D38E7F8716961FAB2DCDE0517C4091AEB512DEFE2CAF1A12D4241A7F548B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373508, "uuid": "7f5609b8-310e-4f88-8ea3-a078223de407", "value": "24576:YzaqtRE5KxftVLLHtuYFqdVu4emASUk7emYygNPJv1p5CcNeV:EDWKlBuYFOVdemASUk7emYrJtp5CcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373508, "uuid": "7a889a16-2e41-4b63-be78-d0f4762c7573", "value": 1035385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373508, "uuid": "64d733e8-5890-4573-a9bc-3ef98a949656", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373508, "uuid": "691e831c-fd0d-4a74-bd54-4c5c75a32171", "value": "notificacion_de_credito__PDF__.tgz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ccd18c-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373512, "uuid": "5c0bb118-02f0-4840-add5-7aadb18fa6a2", "comment": "Malware payload (AgentTesla)", "value": "1b865ef9d03bd862e8e3e39a28ae54c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373512, "uuid": "5495c283-7089-452a-bc98-cbe055273552", "comment": "Malware payload (AgentTesla)", "value": "72c4217f1a8af0b6fbaaaefb60783c78600019aab33c1f1ecae022fa995cff7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373512, "uuid": "91066e39-f7ad-4872-ab95-639a727726cd", "comment": "Malware payload (AgentTesla)", "value": "71459cfc0d07667aa1c508ce52154cdd9b425bbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373512, "uuid": "1ef510dd-dbf8-480c-ad6a-ec3879ab85f9", "comment": "Malware payload (AgentTesla)", "value": "8fc9340a0d230f38572c913d5a8547398bbee517193411d53e9ab2a68615cbe305b1e8b975147a6fef2a8d6f7ed7a673", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373512, "uuid": "c0168ef0-517f-4002-8ef3-36dd6e3b2ae7", "value": "T16AD423043AE0C3AFEEBB41B3457406958B39319590E6CA77DE8D23EE6D32B588C50767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373512, "uuid": "037bec43-5e0e-478b-abc5-faffb74d3e92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373512, "uuid": "67212ed6-64ba-400e-8208-dab3c4fdceb1", "value": "12288:kDHceFz39HKFI9cUabMkyyZjAtOE+eyP1W2mlxO/zDfYkfepfsMxa:AcE39HkgcUFdyr1oGepf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373512, "uuid": "9b042cf2-da54-4baa-b277-68e5567a970c", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373512, "uuid": "2470d8b0-676b-4096-8a51-7609dbc54dad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373512, "uuid": "93f1bbf5-4f9c-4710-a8eb-e3bb355d16e8", "value": "SSLOS2024070909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e304f8c3-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373516, "uuid": "3b3113f7-6217-48b2-bcd7-33880751e0da", "comment": "Malware payload (Formbook)", "value": "e2789206b5a7e85769bddb796da7bde7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373516, "uuid": "af1dc26c-07de-4703-bba1-5c8b5602b823", "comment": "Malware payload (Formbook)", "value": "72d8e3b25d5076a52640aca8d8e05fe629e8784d5fadbc533d4db50f0ae5aa70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373516, "uuid": "b455a641-e45d-40a9-9506-1102536d6e00", "comment": "Malware payload (Formbook)", "value": "1015d41043d32341041a0af5ce7e5f9c8cd3ec2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373516, "uuid": "e434b492-1816-4ef3-b937-a83271119bed", "comment": "Malware payload (Formbook)", "value": "aea74563627ff82e03ea541fbdd059f34ff98b43047422fa7b6d19bb4f25c948f599871ba2dffc0fe26a38ca6dbb29ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373516, "uuid": "3c8861f1-6b06-43bd-b42a-c52235eff345", "value": "T13AF423A14B0CA621EDFE5FF0A08484806BB563423E55D71D79CDA1EE09E27E00636B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373516, "uuid": "31b386a1-8170-4877-9e83-471f6d4342ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373516, "uuid": "440ab27a-c3cd-4fe4-a6d4-fd56c239300a", "value": "12288:FVVogM3/+UvU98XFurOXAaD8nS56MPU2LpEO+pxArtFhIH9GkR:Rof32kU98VuGtD8Somd2O/P0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373516, "uuid": "2aad396e-7349-4961-8cac-911dcef09ed8", "value": 735240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373516, "uuid": "06f72373-ebf6-4b15-8505-c5601052a874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373516, "uuid": "1ab34c76-bfb0-43bf-994a-1219733bae10", "value": "RE_GOVT_OF_SHARJAH__UNIVERSITY_OF_SHARJAH_-_Project_0238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f267c8-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373522, "uuid": "9272c3d7-6b1b-4d64-ad3c-5da48a542846", "comment": "Malware payload (Formbook)", "value": "896cb3252b28525f1ce30c03a8ba9fbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373522, "uuid": "4cf8f8f7-3950-46a6-ab2b-08d0564c6620", "comment": "Malware payload (Formbook)", "value": "7317e559dedfa31367816b499d90ababa664c47810ff0d21e6143aae0e03a80a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373522, "uuid": "02d33a4d-55db-4334-8cd5-89efc429ed84", "comment": "Malware payload (Formbook)", "value": "b5f82ce52d9341c769aaae0ccfefe4019da7a81d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373522, "uuid": "a20f6a2b-8656-4ef3-91d7-7f9013293041", "comment": "Malware payload (Formbook)", "value": "94052112fd76c1fdfa3074f749ab0da32523ac1fa09c241b186f2ee2383162c478a4e4ed5d84e0e7ec9850184b4f9e95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373522, "uuid": "38ffd29f-3e24-4dfc-9479-d00b4a62e8d3", "value": "T14045BD0273E2C036FFAB92739B6AB20556BD7D290133852F13982D79B9701B1277D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373522, "uuid": "57589aba-1f65-4a7a-a484-6b514b9aecba", "value": "649f6ed9a4d576c154bbc0357156a4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373522, "uuid": "be0a1dab-7efa-4acb-9264-f416d473f5d0", "value": "24576:SAHnh+eWsN3skA4RV1Hom2KXMmHarVZOlYt+r/r235:Vh+ZkldoPK8YarsYt+rra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373522, "uuid": "1439c7ab-b819-4a43-9583-93cecdb292a8", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373522, "uuid": "0017b67c-5a06-40c3-a1b6-f31abe7ba8b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373522, "uuid": "03d9e5ea-4ace-4eca-b5c5-d4d8cf386686", "value": "PURCHASE_ORDER_PO_#_2107-20454_24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e91c48-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779371004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371004, "uuid": "07d83411-b17b-4095-82a2-bcb372f2cb36", "comment": "Malware payload (AgentTesla)", "value": "e03588298a24d22894f1d37b6e4bcc00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371004, "uuid": "43bc3d2f-24e5-4303-b859-13147ab7f834", "comment": "Malware payload (AgentTesla)", "value": "731a601961a6d2f2137426a048045423822491af55e946d9b1c544eef6272358", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371004, "uuid": "2a4324dc-6735-4351-abfe-588a3a75cccd", "comment": "Malware payload (AgentTesla)", "value": "2f9ee4ea92d27d636d7f372c3cb81a4c64d436d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371004, "uuid": "0eb0062c-55cd-4400-8be7-142af5b0cfba", "comment": "Malware payload (AgentTesla)", "value": "d09ce5ec522cff65ecd30d14db39db20ff5c30f3ebe2bf2c67337ff0b3bdfc75768fcc4153b590b74ac4217dcc22e0bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371004, "uuid": "06ce8360-fd75-4260-b3c8-94e9ca250cc4", "value": "T189D4231686C6E57C3C694374F184D36758A6FF2EAD278E80EF460BCC2F9A517348B1A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371004, "uuid": "c9935a47-562b-4710-b93b-639ea2caa249", "value": "12288:1vB/Tm5LN/kDwFX15Hji1P7qWlo567JOuEmf1IH8zNHL1Sm0c7bCEA1:1vFTwFX1BGkWe67JOdSQ8zNr1tnJA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371004, "uuid": "3a7f5c72-afb3-4a0b-89a2-1ee2221c1daf", "value": 645051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371004, "uuid": "38230a00-b1fb-4d28-9dd5-443526d3dd3c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371004, "uuid": "b43fe438-eb3a-4cbe-bb8c-46839346e309", "value": "Certificado_De_Origen.lzh.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0c2a2a-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371007, "uuid": "1ac49c7b-3015-4cd6-9a11-570dcc46a13a", "comment": "Malware payload (StrelaStealer)", "value": "4cf101318a38ad1655d329dfd56ecab2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371007, "uuid": "ec4feec3-6300-43d8-a0ff-36da3c8c425e", "comment": "Malware payload (StrelaStealer)", "value": "7323f89a109abb4213cb201e3e93b5d46881ff81430545ebd8cba018353e3a09", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371007, "uuid": "e493a6c6-4b61-40cd-b660-e7f47e2d94dc", "comment": "Malware payload (StrelaStealer)", "value": "59ee56da9ecf4a0089cc75798006b795cef8277d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371007, "uuid": "38e563fa-97c2-45e1-a52e-9fa7c434372d", "comment": "Malware payload (StrelaStealer)", "value": "9fe7aa82cee1ea4c11e7039f56996a6751596a18b97e97134dd9cec47904ac17a4afc2489f30a9640899e20304ee4d41", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371007, "uuid": "b3cf2548-5601-4396-a5fd-96d2cb1c4196", "value": "T11C957BD05EDA3347AC446CED4BA2ADC58D698E327F217058189D304EDE25AD9AF423F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371007, "uuid": "41d53267-ae1c-49ec-819a-6e1cc12e507e", "value": "12288:NSPjKuIvs9DgyTwISqfE7LTYyd9XDJDK2DgyTge9yJdTBuLa4JCyDlDsWJE:0PjRaaPiTYCCanoJlYL3aWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371007, "uuid": "29313c3a-817c-4369-8ace-83ccaf1ba8eb", "value": 1948190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371007, "uuid": "28a75cd5-7f81-40c0-bc4e-e568711c96c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371007, "uuid": "3b4fcbcd-48c6-4a7b-9160-a2714d21a954", "value": "809027049320371513.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9b0f0b-551b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779371012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371012, "uuid": "5c691351-ce6c-4ff3-9e45-caac9c0a4b39", "comment": "Malware payload", "value": "c4f4f3a9833af13c1f33f387fa0bdef8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371012, "uuid": "53be0d55-9b83-455d-b6c5-d555d584f3ad", "comment": "Malware payload", "value": "7325bf69d8982fe8e6fc80a145d2e299b1ed4510699865523e23f790ea6615fd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371012, "uuid": "78509fcb-b2b5-4337-9613-fc7a8577e068", "comment": "Malware payload", "value": "a1f05e95f6a0054cf86782f03ea6420153b29239", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371012, "uuid": "676c3a7c-3a49-4d06-a724-4fc6a83d3c25", "comment": "Malware payload", "value": "bd158d5cf25c060a932416a4df81eddffbcc633258800dd0da81bd6a941a5e7eaeee5bd91e2fc98b016ae74fd2147f15", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371012, "uuid": "33ce6f1d-832f-4b83-afb2-e74addb12c55", "value": "T1DAD633FA81078855FC6AAE7193EEB6316E76310F0CD394077AF4821B0F52996E1D25BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371012, "uuid": "a2ec73fc-e903-40b6-aa33-cbf7bb9c4483", "value": "393216:dEbOiQeMWTiAdhjainU3mXwfGM974e/Mr7:dzeMWThHj3kJeJr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371012, "uuid": "99f1abf5-80b4-4fd5-8b97-ce0f716d5765", "value": 13073370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371012, "uuid": "2e1377dd-2f13-4ec3-bffa-7f6217d27c56", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371012, "uuid": "3bbaebcd-7034-441e-ae48-1dabf1d6dea2", "value": "memdumps-25c1398f1e917b8e619c337864aed21e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310899b8-5531-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779380518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779380518, "uuid": "cf79e17f-b5b7-4705-ab82-4d86a347408d", "comment": "Malware payload", "value": "e7efbb9ea8b6ae9e52157be524444fbf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779380518, "uuid": "778aaa02-5511-4b21-bbb8-8ca797783a30", "comment": "Malware payload", "value": "7355791b56dc45ef5ee021d9bda726cd1f5e9fefc6c9529748e5141a1a3fc972", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779380518, "uuid": "69c9432f-1589-4fc9-bb0c-a8bb92f217ea", "comment": "Malware payload", "value": "7e1030ab626fcaec6eba40733ffaf77545852425", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779380518, "uuid": "c854468c-581f-48aa-a069-9610f0bd115f", "comment": "Malware payload", "value": "a9f9e093a9f5cff30342b4b04669c40f4360b2ae543d88657b66527e207075fe9b70e67353a21e6173a908e8a75d539c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779380518, "uuid": "3238d78f-0fd9-49c2-a80f-3e40864ccf2f", "value": "T172137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779380518, "uuid": "69dd7b30-3fb7-4b1b-8e17-32487388253d", "value": "768:m+59GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:m+Sco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779380518, "uuid": "a9b73f88-3e64-4412-8d28-470f9174c331", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779380518, "uuid": "6fc01748-3baa-4857-a5f7-3d5b7044c6e1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779380518, "uuid": "4adef64c-9c14-43bb-99ae-a4ba2eab9850", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109103cc-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371015, "uuid": "516b991b-cb59-41f2-88db-2838ea9897d6", "comment": "Malware payload (StrelaStealer)", "value": "916c29d77cad090378f1aaf6e9f62368", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371015, "uuid": "287c3eda-2dba-4c85-babd-86cbefbbb1c0", "comment": "Malware payload (StrelaStealer)", "value": "7356c53ae0e3d07fcb147c6b534a914fe3dd79a5dd53e771b82f28b96dd8ed23", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371015, "uuid": "143d8b5d-aedb-4253-b0a0-248bd5fe696e", "comment": "Malware payload (StrelaStealer)", "value": "0ae03d6dabc2f89a2bddb36585c5457750892831", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371015, "uuid": "bceba25c-eacd-4fe6-8eb8-ef5ffa9cb8a0", "comment": "Malware payload (StrelaStealer)", "value": "9d418a09345b792424c36a41ef78393071c243d6715e11186ff2fc123da98a94cd2ce5dfe1fbf1fb8045a8e4bed4b92a", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371015, "uuid": "75b5619c-2598-4691-8e12-54e092b5277d", "value": "T10D714D015ADBD50EF3329DB0B92677536AC051377EB2FCACA0402A70157DD460E6E5EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371015, "uuid": "aeebff3e-ef4f-43ec-91dd-acbd09c4b5c3", "value": "96:TOvu86wwib+YOrNfRZdWTXycGiorQTHdNax:TwPbUrPWj7Nax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371015, "uuid": "3f839bb2-998a-41a6-acc3-133414fffb50", "value": 3571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371015, "uuid": "77f3bd45-f6d0-42fc-b85c-ba511806cca5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371015, "uuid": "99bb2e57-18c3-4a2e-8a48-fe87648ae4b5", "value": "24-11-22X-XGERDTSX-RE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e919a48d-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373526, "uuid": "8b30874f-99e5-4562-8033-e25f1d163605", "comment": "Malware payload (StrelaStealer)", "value": "f37ae082f9a25e6f3def99c7212fba49", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373526, "uuid": "b1d11f2c-c120-41e9-b638-fb7002469399", "comment": "Malware payload (StrelaStealer)", "value": "73a5a3c296c428eeefd874f98de36761be6b71e3c02a7b392f24656a5c77abe6", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373526, "uuid": "03c44bfc-318c-429c-ae5c-8f199aa809af", "comment": "Malware payload (StrelaStealer)", "value": "f9f208338ba65a96245a30a54bf665ca18b0d40c", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373526, "uuid": "5f8e9a2a-daf6-4d49-a06f-986c7b838de0", "comment": "Malware payload (StrelaStealer)", "value": "e54d72c073cbfe2671f1afcbbdc11adadf813ae08fce118213df865c04a35c2e5a81b8df6a1fb4872b0f37acce6b9da4", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373526, "uuid": "711c00b6-915a-4542-a583-53af1b58b7da", "value": "T1383109C0E07517DECB295378AAE27601DFE4CE990022271A0A82A6F414D29CFDD410AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373526, "uuid": "bae719be-1bf1-42f1-93ed-2e34a02ffadd", "value": "48:9kV+tNLTThxscwc712Q9vgAgva2t2XOSC:C2NLfhTB712gvZsT2XOSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373526, "uuid": "530251db-fa70-4b94-a466-10fda297cd9c", "value": 1796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373526, "uuid": "2bc33846-7b0c-4df0-b55a-b54a581427d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373526, "uuid": "0d501fe4-657b-4d56-b51b-a200d1ab6f4a", "value": "Rechnung7208303.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9a0355-5512-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779367520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367520, "uuid": "6274a94e-9a31-4b6f-8b10-aeaa11c6d377", "comment": "Malware payload (AgentTesla)", "value": "aed24c515963e3cf0732d2b321f7b4e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367520, "uuid": "194b549a-430a-4406-a16b-17c39b9a15cd", "comment": "Malware payload (AgentTesla)", "value": "73be73018f50e8c36b8005fb6d8c6ecfa94c793e6dda534097b4ba4fa14c1dd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367520, "uuid": "d93420a8-e525-49f9-9137-950524621d59", "comment": "Malware payload (AgentTesla)", "value": "9b3705496f6afadef4b845d6159335704af8ea6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779367520, "uuid": "8bb7f525-1a95-4aac-a8dc-2817812e46f9", "comment": "Malware payload (AgentTesla)", "value": "8036f511cbcee3f39d1c1e6f636a9e48133c9a53c320ba627b21a105bbf46cfaf9a52bd56c67a726e48ddbf2840d8684", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367520, "uuid": "55a459db-e5e0-47b9-8059-f9237e4c1202", "value": "T16F8302136E3B5502949EB3F259CC2F2963BA223DC463484E5A1C1B1AFDA6CE5143774F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367520, "uuid": "674159a0-ac03-46ca-a0f3-c4f15b53069f", "value": "1536:vZXO54b5n10Uw89T6RDX4odQFCyPsXHWgJUnXOXgQReFnqL7HrVmakZAmD1vAYOw:xdb5SN9RzWHPs3fUX4TA4Hr8akZAmFbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779367520, "uuid": "27c8109d-1f1f-4165-b911-bc6811606112", "value": 87657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779367520, "uuid": "0d56c647-afac-432b-9f8b-ffa6aa3bce42", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779367520, "uuid": "c7e056a5-b85c-40be-8e88-f8fe960206eb", "value": "73be73018f50e8c36b8005fb6d8c6ecfa94c793e6dda534097b4ba4fa14c1dd0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccb7647-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373532, "uuid": "3f4531cc-17a8-4d2d-a235-2c670644ceb8", "comment": "Malware payload", "value": "4f96feb2da995847205dfaaba4b37834", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373532, "uuid": "b71cf7dc-82b7-41c2-9964-cc39f49ee41d", "comment": "Malware payload", "value": "73d7c8e50ff4a34450c12fd28347b064d2d8147a92602c0ae101f5d9cbba639b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373532, "uuid": "bcc67b78-df4c-4e43-8b29-68449bc988c2", "comment": "Malware payload", "value": "7a92f14152332d161b0efdd23f52d3419b7634d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373532, "uuid": "9bfdf669-ccf3-40e7-8953-7dcc0693dc91", "comment": "Malware payload", "value": "f54a2aa61d0bbc93d177adbfac0edff24150c0f16231f09ab4967af5e97e088517775012731a7b6bfe1e14c9f82931e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373532, "uuid": "635aa092-3635-4422-8a7f-2e94435355d5", "value": "T1FB25B022B3B04433C5530970681DB1E8D61EBC352AA5EEA77EDE7D9C2AF87127E15183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373532, "uuid": "7a064e99-44fe-42f3-99f0-4c2ef9027c4a", "value": "eb377d36d1ddaf81e4325d08a2ce1059", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373532, "uuid": "1d1b7f8b-db56-4e1d-b035-323788318a7b", "value": "24576:QoDIHCBqqUZk2LWE4avXEIugZncPCi4LAP0i03W7Cq:Q2Qf4avEIugZQp4LAP0i03W7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373532, "uuid": "fb83f3d5-d36f-4df9-9f8e-0457c6534106", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373532, "uuid": "ccc82e1e-69ca-4bd6-94ff-9dbb4df3bec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373532, "uuid": "62c0373d-b1ca-41d3-9bd6-9f5f1496d1d9", "value": "PO-0028201.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d31005-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371019, "uuid": "8c235a91-0956-430e-953b-25f090de2071", "comment": "Malware payload (StrelaStealer)", "value": "7eb3ac6fa1f4496e69fc236569c9bab5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371019, "uuid": "f32e0bb4-78b9-4e54-9429-77d574591f0e", "comment": "Malware payload (StrelaStealer)", "value": "73e0f09f0f3ef41b9832cb7bdf669dae3b750620bd82e25b276274852b6d89b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371019, "uuid": "86ffa4fb-1b67-4809-ba80-f566d7682468", "comment": "Malware payload (StrelaStealer)", "value": "4395c9d9f4b248f107d2e4dc358abb8eef2e00db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371019, "uuid": "ee6566e4-190a-451f-bcc3-4842c4605bf2", "comment": "Malware payload (StrelaStealer)", "value": "a733ee5d20d21a9c24d64b139f4c2871e38728649606279529dd243bceee3177223f01868a4d4b8e8b0d0180a9609532", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371019, "uuid": "29b6b0cb-b7df-4ea6-8586-7439480c1181", "value": "T17955AE544F179FAD1A88CCC40A79E62F4C44573B2C530CE82E4E3E5E4976A69DDB3A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371019, "uuid": "c3f3d2eb-dc62-48e7-afff-d77d5b372a9f", "value": "12288:dXpOewuVsd6rdFCf48h4gPa55e4kDZZZmTEsSR4M4kDZZZmTEs7F4:fXdFCfHeWEcCyRJCZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371019, "uuid": "b096a4fd-748d-42ef-94c2-cdd757e6c237", "value": 1290936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371019, "uuid": "4ea1a70a-daa3-42b0-b3ff-4f969d5b40f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371019, "uuid": "04a05bea-2f28-4707-b2bb-eec8073d29cd", "value": "2476923933912221781.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2843ae-5554-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779395838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395838, "uuid": "e5dd3378-9637-4c51-aaaf-788b48e0b374", "comment": "Malware payload", "value": "501ec2da3039ebe4ca379f663232176a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395838, "uuid": "bfdab4f1-bb14-4aaa-82e8-c8b3a2aec4b8", "comment": "Malware payload", "value": "7420e819e6cf6d7608e475468ae0160185fe7eed0b5b4129aad3e8dabc776e30", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395838, "uuid": "60561f53-600e-474f-9963-36dbdcc9504d", "comment": "Malware payload", "value": "c91a51e4392a7cb5d3279f369ecaab670af6b543", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779395838, "uuid": "e45f2eec-b55e-4dd8-921f-fc57f9859161", "comment": "Malware payload", "value": "33d6ba98ff6b1753c87e9254142d14a0d316d5ce61b71aff31e96374bfc31bab592f5532816f07860992e644d9019d56", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779395838, "uuid": "4df27f3e-f3e5-4213-80d1-3c8a6c1ff5b4", "value": "T1C4F2349DE070DCB13C64CC51DD923318A4AEE09FC5B3BA88BE1D393C67A4149F9A016E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779395838, "uuid": "5eb1df0e-670c-4321-bfb3-a15388fce321", "value": "768:vxlT2wDuWvWi78DcFHcbSRlIniRULz/Ql/+9l:wZDEcbSciI19l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779395838, "uuid": "ee30a988-2ea2-4067-8643-0d0c7f8a3228", "value": 36261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779395838, "uuid": "cd1561b6-a71f-44b0-8184-8f96a0ca1688", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779395838, "uuid": "bf4eb6ec-97d2-4182-b5c3-b3b074afca15", "value": "7420e819e6cf6d7608e475468ae0160185fe7eed0b5b4129aad3e8dabc776e30.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14db2594-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371022, "uuid": "d37297f6-f78c-4910-8090-77ea0a6a8721", "comment": "Malware payload (StrelaStealer)", "value": "bd0ff4def693ac2d3f2e5b6c3b0bbc2c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371022, "uuid": "293b823e-f0cb-4dfa-bf61-8ae8b837dc93", "comment": "Malware payload (StrelaStealer)", "value": "74292a93fdfd16853015b8aefa42fe650d0e2ddade3be92b78b185daa5c4aaf0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371022, "uuid": "12f95d93-93ed-4d0b-af49-68181e4d1823", "comment": "Malware payload (StrelaStealer)", "value": "ef713823edb8d22c7033ce7f5514363c8e54c7ff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371022, "uuid": "dedce2e6-3a2a-4845-9bdd-ef22a15f765f", "comment": "Malware payload (StrelaStealer)", "value": "be7f7fdaaf880c385c32e2acfa6c63c2c627745cd164c8a4e989989487ff01030ed96beca46e9eaa6107c4340f218768", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371022, "uuid": "295f43e9-436a-458b-aa33-eede758e8526", "value": "T1EB94C202B33E85F16F7224D867C8DA4B7B2BD59071DE429F7C856C838610A06E6BBD74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371022, "uuid": "7b5c1c87-d096-4fff-a687-2b1d0336b8e9", "value": "384:UN1ogQUWAubE4bQo/HurMb3s0utvWkuwxCiNz9nqCVVVNs4w7bCiNz9nqCVVVNsN:UNmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371022, "uuid": "a5871da2-ffb6-40e9-96a3-29caf30c39fc", "value": 411245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371022, "uuid": "d155a56e-ebcd-4e44-a7ad-3cd575e3e01f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371022, "uuid": "d3a93323-975f-4c73-a658-7f61994947e8", "value": "2057228374843921338.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefaf43f-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373536, "uuid": "6edd3aa8-ac31-4499-8ab6-52d959acbac6", "comment": "Malware payload (StrelaStealer)", "value": "7b31902b8c5983741128d5d10bda38f7", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373536, "uuid": "29f487fe-aaa2-40d6-a20e-beb8ea81f1ee", "comment": "Malware payload (StrelaStealer)", "value": "742b3a1c25a8a498f77ecf3798660e1dda31bfe7c3d2631777a44f0081bd6788", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373536, "uuid": "03d2899f-598e-444e-a32f-60d31a6b0850", "comment": "Malware payload (StrelaStealer)", "value": "dd2d1e3e2bb4a927224a59da252b0d9aa770d9ab", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373536, "uuid": "38840560-cece-4cc6-aded-4e199b0288b9", "comment": "Malware payload (StrelaStealer)", "value": "4665f159ff7b2835ef0f0961613cdb656b395b5816200244ed21a87e032905493f525e7dd447dd2fca7059b6f5e87083", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373536, "uuid": "f4d6eec1-7157-4acd-83d3-12169ea17132", "value": "T1FE41F9341282F757CED856BFD48213E95F1DA6AD2461710213AB1B919A0FBD282CD75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373536, "uuid": "05e83d77-e257-4b9b-87da-395d5608a3e9", "value": "48:9cVzVXAsdBhYn2Hr5vPN6hG4YjpiLAmn5X6GHHVF1R0O39xzi:2VzV5DI2HtMh9oiL7n5XxH1F1mO39xzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373536, "uuid": "68a05a69-6f3a-428c-b1d3-504877e1af52", "value": 1903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373536, "uuid": "d8b080ef-7247-4677-8e4b-d8f86fba7442", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373536, "uuid": "ef6ea345-e073-43b0-9d40-df26a26e23a0", "value": "20240628_RERG202498519.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d8652b-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371026, "uuid": "9d6093b6-8225-46c0-a7b1-d56e36dffbe6", "comment": "Malware payload (StrelaStealer)", "value": "c239a3cf5f5f0e97eabe47b2437ebe17", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371026, "uuid": "aa1b1223-af97-45ca-a90a-c965b791dd11", "comment": "Malware payload (StrelaStealer)", "value": "7468f05e9c69c4150c898137cb7b401a249b3f53bf3290a64c775a067360f22f", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371026, "uuid": "05a5a023-3e24-4289-8fe8-5676de8863eb", "comment": "Malware payload (StrelaStealer)", "value": "df471a8c95c327b3d50d7affebc93efa9d02f6c6", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371026, "uuid": "adc2fa5d-5344-4f91-99aa-908fb0216e88", "comment": "Malware payload (StrelaStealer)", "value": "b4aed910690b912c53c558e87777bb03f4e903153339ea35595a21c0d231975a98d9d4543e523214d4c5543e70d07f8c", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371026, "uuid": "272f20e2-788c-40a3-9412-e809e18942c7", "value": "T1AA714C0B170A830CCD9A1AF880D60C66B167B0BF4CD370AD96CF98165857E79BC087DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371026, "uuid": "14c1c886-30c1-4cca-8af0-64437b45f896", "value": "48:96hseJef0ZpzRQzfAgaN54pl+b6oQ9J/5YQo4sfdTbt1MmCswa4bJBZaZKLWQXPp:I4cPzRQzK5w7XRjoJRA/xvwZKlPAzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371026, "uuid": "13f32ca6-d904-43da-95c0-5b3491bb08cf", "value": 3608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371026, "uuid": "f68c169f-ff54-496c-8dc6-33411b88f65b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371026, "uuid": "be41cee0-d340-4541-8695-d5f637cb8dfc", "value": "Plock_Rechnung_PDF_deutsch_hp_22_11_2024_15_44_13_865.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5d7ad6-5502-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779360542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779360542, "uuid": "1a431b17-88a4-41f9-b3fa-f75c7a443466", "comment": "Malware payload (RemcosRAT)", "value": "36f94328ec265f39ab72f263489781e4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779360542, "uuid": "e0287598-9254-42f4-b0dc-74cf63a40dc1", "comment": "Malware payload (RemcosRAT)", "value": "74725df0bbad7d1a41c4dc4660bd63a3ba816aa0aad76f6c16a828f017b2a0ed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779360542, "uuid": "bf048ef1-8e4f-483b-b7a7-a76edc21fa5c", "comment": "Malware payload (RemcosRAT)", "value": "fb54186ddfb0b44156771166868ff57b1630e723", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779360542, "uuid": "450a9832-72c1-4569-a2a4-0e16cd19d707", "comment": "Malware payload (RemcosRAT)", "value": "97112083ea90023eb05f8f8768789243c8793dddea9652a70ec398be4354e34a751f963a09730b081aed15e8fd18e63a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779360542, "uuid": "1f849dd6-c049-4461-befd-1997f34d3591", "value": "T1CBA5031356E1477BE03E6C1C4461DA232DF8B44E1E9B7839077A34F2AD69B68A4F097C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779360542, "uuid": "40a2af46-8883-48c5-a73e-067acaaa589f", "value": "192:r/IgxatNXZiZ931PGqAWSzkB3LwXZDGaTHUNGd3pl7xME567VvZ/CcVI2HbdTqBa:1+M5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779360542, "uuid": "abcf9767-d101-4a3e-8482-b544e1c7c395", "value": 2154720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779360542, "uuid": "91bcb7eb-052c-4299-a953-67b0355fc4a0", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779360542, "uuid": "26345385-f7e0-4693-86fa-6cea1c914e1b", "value": "RFQ_05_21_2026_IE168283721673.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a279e3-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373542, "uuid": "7085f739-6d63-4b51-8b72-33a1b2c4ed6f", "comment": "Malware payload", "value": "4a52b0d3855abff26174c4ec9ac64697", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373542, "uuid": "200f2839-b330-4d95-bebc-441f296c26d8", "comment": "Malware payload", "value": "74e23399d3233bd8ee05462a40165f8f07c4e45d1cf61decb6c7f1bae187b996", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373542, "uuid": "87063698-0b65-43a0-b76d-8a2f11904bd3", "comment": "Malware payload", "value": "50984d42af829a28073b685004b366a121d746a4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373542, "uuid": "a7804478-648b-4550-9932-cd86f2c231a9", "comment": "Malware payload", "value": "7b0b5679dd626f27354b13d269c757c58e0f2ad247a625663f0d8e58ba3329817706f6d2bd538bff84d159bf6dc6723c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373542, "uuid": "ca817ff4-2385-41ec-b6cd-60026af4058f", "value": "T1E92533954584B2CACADD1B8F5E300ED3FBC910165E6DD0818FECA8FE7A415F5760E826", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373542, "uuid": "9effd97e-c3b9-49b4-89a3-063b2a012519", "value": "24576:25O1Me7bXBAmdVoVKhzX9ovcFXFdB+FHnfX/Uw:25OyGlvoVUxovEXFP8nvsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373542, "uuid": "ad45f6c5-933a-4c93-8543-6a352046bf8c", "value": 971374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373542, "uuid": "f2bcaafa-7055-4f20-be54-8ac900c2f4f0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373542, "uuid": "c526edf8-1531-4e62-ac94-9b393209f2fc", "value": "Custom_brief_declaration_notification_for_DHL_2024sept.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8696b0-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371032, "uuid": "87e3bcb1-4a06-4ab4-8fd3-37e5bb9b2f6d", "comment": "Malware payload (StrelaStealer)", "value": "f72d3d3443b3b856bb5fabfa8e215674", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371032, "uuid": "e95b52ab-bfb3-4ed3-bbcf-3705254558bc", "comment": "Malware payload (StrelaStealer)", "value": "7516a1b4c30289614ad05aeb4df37fbbbef8cafaea1d39ab36cf7a35bd9c4f6c", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371032, "uuid": "44d43530-be1f-49de-9fe0-764518291810", "comment": "Malware payload (StrelaStealer)", "value": "f03b1f87203e4bf73177be70f7ac083c7ce9e320", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371032, "uuid": "f3a90fae-1502-4eba-924d-abffad85094b", "comment": "Malware payload (StrelaStealer)", "value": "1594dadcd827945dd22c83cafd39105e74c7077cf623d30ccbec8cd8cc7dc523e4442940579a230f6da7ac80a1251211", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371032, "uuid": "47ce02e0-3e6f-43a7-a5bc-9f802af3c6f2", "value": "T1EA72D083B043940A98E4C7F781E01FA4D37E7683072642CF0470226BA9DE466FD58EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371032, "uuid": "c115a918-90e7-454d-83aa-21424bc3ed7b", "value": "384:rrS/j1iTyx5CCXholmtkobjVYUInfY91+Maaa/nH9vaGiIjmpqIP:rrS/jV1XM8JjV4nQ9EMZa/nHdypq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371032, "uuid": "dd77dcb5-3934-4112-ab1a-969f2856f184", "value": 16089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371032, "uuid": "2ea30855-2e7b-4d61-b188-f2afe0f554e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371032, "uuid": "e4c4912d-89b5-47e7-aa29-1157bf799850", "value": "Rechnung_321661_2024-09-25_1233_48_529.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e751ae-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779373551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373551, "uuid": "6fdea115-62fe-4aac-8e95-5049c2aab49f", "comment": "Malware payload (SnakeKeylogger)", "value": "bf0d8f530b8ead7bef92edfa82bdeb70", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373551, "uuid": "7cf62915-5d2d-4725-b7e9-b910f33eba66", "comment": "Malware payload (SnakeKeylogger)", "value": "75a1fe5ef491cb0cbeaff12cb2677c833e768ac0d429e9946f342b7cf2f5e800", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373551, "uuid": "939ebb9c-2924-48ac-919f-1e3151920439", "comment": "Malware payload (SnakeKeylogger)", "value": "e3abf55aa72068d5e283858105622105a04727b5", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373551, "uuid": "acf7a712-d69d-474d-8ee5-40390405ea40", "comment": "Malware payload (SnakeKeylogger)", "value": "24204af6da266ca6767711cf9010aa3bf450b4eec727ecb94d4d74c75c5ff2ec9a224395c5d268402412f170a8240d63", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373551, "uuid": "cdf4c1c2-c5d2-4fb0-8dab-ec22121940ec", "value": "T134C4237F56F6E692286155BAD187C326C80EC59B7A50D2C638F3330BA533D3A476E02C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373551, "uuid": "855038ef-3592-47a2-a825-d53b73a6130a", "value": "12288:bb8AGOZq2ue0Wo5Okb8Ebo9SGunAmIk2WSyoHM6WSpdby:/87OZq2u/WEbLKSxnAvF9HxWSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373551, "uuid": "a2b023e7-53b9-4679-97c3-d0f9ed29d0c4", "value": 570939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373551, "uuid": "cb14029c-a883-4443-a740-46794b21977e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373551, "uuid": "d879b78d-c592-4f4a-8230-9bddd7f8284f", "value": "RequestXforXQuotationX#P01042.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea576f2-5517-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779369321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779369321, "uuid": "f6c59c23-27c7-41a5-8e01-8b55642e87cf", "comment": "Malware payload (WannaCry)", "value": "c282a4695a56d6bd1314d4c57fc21f6e", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779369321, "uuid": "d0cdd0cf-280d-4c3e-b9e8-35b9865099ce", "comment": "Malware payload (WannaCry)", "value": "75a5fb51e76d9f1a69a7c3301922cb84a08b53c0d29b23d4adaab60db414dce9", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779369321, "uuid": "274392d1-548d-4158-b2e9-4a205a613f5d", "comment": "Malware payload (WannaCry)", "value": "11f99a1c83c5eca416ed95136dcf654323f73097", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779369321, "uuid": "c3b6120e-3b36-43a2-8a48-eb2047f2daae", "comment": "Malware payload (WannaCry)", "value": "768ff86272cda7ab527cc99f47cb8b7be97bd2b47c387bc5bb415bfba59836f9d8c2c503f0dbcffb0302c5fd2429e412", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779369321, "uuid": "aab32c7f-defd-4dbf-9e6c-15cd74f2ce75", "value": "T1CC3633587268D6BCE00619B444B3CE26E3733C5157BE5A0F87504EA73E13B9BBB90B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779369321, "uuid": "cd425304-e660-4d1f-a431-4dcb21164af0", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779369321, "uuid": "f546ce2b-6e3b-4516-940a-4be84829ef2d", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P593:DXDqPe1Cxcxk3ZAEUadz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779369321, "uuid": "7e2d4395-d19d-4bbd-9848-91e61a803bdd", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779369321, "uuid": "baf38346-d0c1-41ea-9509-a3aae1e3cfcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779369321, "uuid": "563a2e08-41b4-4ecd-ac3e-8137ec509b58", "value": "75a5fb51e76d9f1a69a7c3301922cb84a08b53c0d29b23d4adaab60db414dce9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cabccb3-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371035, "uuid": "de518c2c-6fe5-465f-92b4-7194c35ace1c", "comment": "Malware payload (StrelaStealer)", "value": "8afc66cf5c713883a69071ecdc6c0f35", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371035, "uuid": "8ae3867e-6605-4921-acae-9b7b2b0c5446", "comment": "Malware payload (StrelaStealer)", "value": "75b2d243ae87a2a02c3f37749e637d09dda029084f15d9e13f6062be10e722ea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371035, "uuid": "9717b05c-25d9-43bb-884e-da42b33ae521", "comment": "Malware payload (StrelaStealer)", "value": "df391b0f518d9b738fc6e07b85e60ade87811566", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371035, "uuid": "0d98a484-8a9b-447d-aeb6-290a6f5ccbbe", "comment": "Malware payload (StrelaStealer)", "value": "962b719b1e8d1983d2bd9bbad9378aefa485a33538931c2c5d96269297c0a98e6d6e4748e3a54eef9f5a1838eb1b7d57", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371035, "uuid": "6ec9ad01-cb44-40d9-afcd-406a7674525b", "value": "T15225AFA782F52659FE18048C49A796FBCFCA2D392410D080ABDF1687942D5ED43D7E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371035, "uuid": "21c04d1b-053d-429d-bb65-b2b91c108e21", "value": "12288:WV1KUYxp/FcmLmY67CsHD7cc2mNojCTkPgV/P1OgVW1Y/YwWTboflro9ne66kSC6:W0RKu67Ck8Dxmg6nhA3TkwJzAXwS6sA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371035, "uuid": "e31dcf9a-f3dd-4211-96a4-ee66afc5775e", "value": 1030677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371035, "uuid": "b9fbbcad-1fb8-4ed1-ad6d-672ed739fa0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371035, "uuid": "4f31c8f4-581c-4a68-a710-d2584e2ab2cb", "value": "1496532236283853618.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b8e0ad-54f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779353740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353740, "uuid": "af9de83b-1ae7-4dab-85c6-246ea97dd48f", "comment": "Malware payload", "value": "ec5dfee13abf94e08d0f94e90b527db0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353740, "uuid": "b30a7063-c663-4199-a4fa-788d2e599e2e", "comment": "Malware payload", "value": "75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353740, "uuid": "96952fbe-f4a7-4c2d-9233-c8ec349da75b", "comment": "Malware payload", "value": "e34a48a74095e9f922b6b99de317150229e1ca45", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779353740, "uuid": "966a507d-55f5-4d94-a1b7-a9da7ca31d6d", "comment": "Malware payload", "value": "6a8d9f875af9c96b61c37c499afe3e3e3c9c080f2c1f22fb9962597415c6aeaccc8f210bc8de7fca6543a532cda075ce", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "web-telegram-ug", "colour": "#E60619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353740, "uuid": "8347dacb-e397-4883-9acd-37c91aef5a0f", "value": "T10374838620C4DC6783E2277085AF96C9773E40D39427A1DEF249C3407596A6CB7BDCDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353740, "uuid": "797ff714-bdfa-4c2d-be27-c3b26f49fead", "value": "3072:HkfJVLGWV7uG+e3m5Y+Xs1XZWN8vRbPoE74VPrPzILBZiTfsCZlMu+l5:oJVL/ui3m9XspoE7krPzI4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779353740, "uuid": "7adb8d47-b479-46d1-a688-19d17cbcbf94", "value": 368814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779353740, "uuid": "cd9b47be-80f0-4196-92ba-2d2f635d3c9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779353740, "uuid": "8891fc56-5a74-4330-96bc-c0ca9707a9d5", "value": "75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb80fe92-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373557, "uuid": "c0f3fb83-fffa-473e-884a-be61138919fc", "comment": "Malware payload (AgentTesla)", "value": "00635bd8a75c3038385dc8ac5c33f67c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373557, "uuid": "61074fc0-ec25-4ba0-b77a-1a32a4d03e5a", "comment": "Malware payload (AgentTesla)", "value": "75f2635f0f3eb36ae1dddd6853ce5000413857012d1d2ff44fba401d614a17b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373557, "uuid": "04584eed-2c08-4ef8-b953-67b7b073fa68", "comment": "Malware payload (AgentTesla)", "value": "3c590b38384ea299af9647c2f96c0bfa576b9fd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373557, "uuid": "a656fc5c-8cd7-4954-9e86-fabfd7e9e440", "comment": "Malware payload (AgentTesla)", "value": "570fc0f8e354dc5e97f1f6010eeee27fcfdb47010f19681e9045816623736104c03d052c58adf565d7713f69192fea89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373557, "uuid": "d7aa5ca2-1e9f-4d83-ab4d-6a9e06b6d117", "value": "T1CEE433A0DFCD04CA2338F8CB948B6AD523341764A6E19CEA1317630D6EC9D87A194F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373557, "uuid": "c33ce2da-a3c5-4b10-8ad1-ba7be8cdee30", "value": "12288:nYQN+73LeZEj56s7LTlQ5K7kGAji3cWZ5PS/j8pjAnhUeGA+uuCadVsdU:942ZZs/TlQ5aki3cY564YGeGA+XbqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373557, "uuid": "0359dc27-6e73-496d-896f-fbbbac800cd0", "value": 703472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373557, "uuid": "dfbbd4d2-c246-4656-8323-2bb7d150f9e9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373557, "uuid": "a3570323-048d-4a48-b6e9-a543d0d3b75e", "value": "DH_BL_DRAFT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7a3288-5520-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373560, "uuid": "25c8659b-4800-4b00-b7ee-873dfb6ff2bb", "comment": "Malware payload", "value": "cf72837e0c4404145274a5b559440fda", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373560, "uuid": "b76b6e4b-5cc2-4f5a-8ac7-b8a89293bb7a", "comment": "Malware payload", "value": "75f9e52ca226fef77233706853caa4f3c95b4d1ef0ae74115071568dfa3a01be", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373560, "uuid": "99df3e76-90de-45d8-a538-90ee708d7136", "comment": "Malware payload", "value": "4b202b604454d6519e1b34cc3428c0b8ed041fa6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373560, "uuid": "b64e57ed-fc53-40c6-aa0b-2b6d946d40d2", "comment": "Malware payload", "value": "56fd9a42cebce55ac7b9abdb9fd93584892553be9cd7a562b153cfd3ceb1fa779b8b6ad66f44a72b7f7f036a37a00237", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373560, "uuid": "14dcd2b0-08fd-4af5-9dab-842a912b0dbe", "value": "T155C301D14A506AABCF9B3FF5AC005238FE370467598834AB390FD99F28890FF4597586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373560, "uuid": "c64e7e98-24eb-4039-a956-f7f8c2dff686", "value": "3072:EkOUrzaTxJgBPLMUHFvS3sXfEzhiprYCTkxa3hWR:eUrGTxKT1lvusXsskxaMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373560, "uuid": "d215ada5-6de0-48e6-bf19-1b60c53a2754", "value": 129872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373560, "uuid": "734bc1a7-71ea-473e-af6a-3d210e10e132", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373560, "uuid": "f6ec90b3-2d13-4b83-93dd-d1b078981645", "value": "AWBXNumberXX7348255141.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff971de1-5520-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373564, "uuid": "2de5fdfa-ff62-4663-aa80-dac1452a87e2", "comment": "Malware payload (Formbook)", "value": "4b833755727b3ebab25a1dd0d9585984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373564, "uuid": "c0d465e3-72ca-43bc-ab79-7133d9abb6c8", "comment": "Malware payload (Formbook)", "value": "763ae850f760ba69722a94ca74a6b88e2bb1a2185364ab358a360df2945bb5a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373564, "uuid": "0c93f79c-724d-48c9-930e-6cf35994b3df", "comment": "Malware payload (Formbook)", "value": "341341da52b79f9b6e708d7f6ec610db1e127e84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373564, "uuid": "ccf66055-b820-4959-91b0-6b869b2e688a", "comment": "Malware payload (Formbook)", "value": "1e97dfe50adc1a78894c0d444a1638dd1896709b441aa8ed434cb877be0d470e23de40f60b47f06920287a7a23d1d34c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373564, "uuid": "4fe9b0ce-bf22-4383-ac9e-530b69796cc8", "value": "T17835AD0273D1C036FFABA2739B6AF24156BD79254123852F13981DB9BC701B2267E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373564, "uuid": "184dfa32-fc16-41e0-b18d-63617decee8d", "value": "649f6ed9a4d576c154bbc0357156a4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373564, "uuid": "047b4863-c19f-4157-ab81-3330fd956e71", "value": "24576:nAHnh+eWsN3skA4RV1Hom2KXMmHa5evhG+ed1QtgQ5:ah+ZkldoPK8Ya5Ke/mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373564, "uuid": "bb13c3a6-3a41-4e50-ac67-a0581f5e4535", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373564, "uuid": "c7829a0e-ef38-40cc-9619-4607e727cb22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373564, "uuid": "38a06d5d-3560-4d37-a79a-8fce60d72026", "value": "RFQ_PROCUREMENT2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031e2a21-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373569, "uuid": "b2e65472-1418-4d5a-bd0c-52f2ad32e15a", "comment": "Malware payload (Formbook)", "value": "651a5fec455be57e5af9dd8fd1239c7c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373569, "uuid": "fa574073-cb80-4151-a817-4425ce0053ca", "comment": "Malware payload (Formbook)", "value": "768df3640de536b1922ba588428bd9c06728f3d1956bc2b73fd28910b9f0b9ef", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373569, "uuid": "40f1e0c0-8f8b-487f-9b40-ca4a1fae7b56", "comment": "Malware payload (Formbook)", "value": "b78558350cc9aa03c0822f49038e43db7f071539", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373569, "uuid": "510e7ed4-92df-4700-95da-871446a0f0ee", "comment": "Malware payload (Formbook)", "value": "9a0f253956da550fbef53a413c2e10118cdf045ee93badf07c1ecd1c8f5306f88577ea682ee15aa872144fb7384babb6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373569, "uuid": "bd66bb64-3a3f-4792-a4fd-d64ff89593a2", "value": "T19602AFC5BBC916296D9785B0E0E4C797C12F5B878F0DC90AB37279085A8E26E385E9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373569, "uuid": "a1433d3e-61b5-4ea9-973e-d69f358e21d1", "value": "192:RgUdw5oi11ySvR14i9u9psWmQaLuHQRUHtiuEngXF+1Zxmw1z/hQ:il1Am4i9uIWdag0UNz1G71r2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373569, "uuid": "5ca78ed6-6928-4709-8a8d-692d9892c8bb", "value": 8253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373569, "uuid": "da4262c3-b7e3-45a7-b548-5707532bf338", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373569, "uuid": "9387fcf6-6442-431d-ae1f-867d04b1d4e5", "value": "NEWXPOX10-07-24X0-999HLD.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054ee523-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1779373573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373573, "uuid": "dffb4ec7-90a0-45fb-8eca-00d29f9e43c0", "comment": "Malware payload (PureCrypter)", "value": "cf953c821c4d4e0181dfbcac03c43343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373573, "uuid": "bbf811af-b38e-455c-bbf6-2ed29ae4b6a2", "comment": "Malware payload (PureCrypter)", "value": "771c7952a6fd5a3c5678722f96a13a42e857bb10f53f675f1dd14c5fd3dbd3db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373573, "uuid": "90ea65ba-35bd-4dba-a829-cdcc21198205", "comment": "Malware payload (PureCrypter)", "value": "1a0de2c4e6213b26e933e0ef800b10e9d9f303cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373573, "uuid": "bcf9a87b-e79e-4de4-8f25-b7d22a7084ae", "comment": "Malware payload (PureCrypter)", "value": "a61e475c7e4634391b6edda27bf062db6c793cc7443703e98388a670261072144ee4ab83fbfaf173245b171189f29be9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373573, "uuid": "9b62ba62-cc54-463b-9d87-444a05a40b51", "value": "T1BDA34BE3AA7A81A2CEB94FB1DFCE511013F0D78DA492D20E789E22051E533D1564E79F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373573, "uuid": "3621eeaa-22a1-4a1d-8373-c7004265459a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373573, "uuid": "62223f2d-15af-490a-b917-564791ceac11", "value": "1536:mw9CLvSBfrvSiEZEbWcKEZ6/G8YRlVcCOYqlbGpCVz:yervSiqEmE7qCOYqlbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373573, "uuid": "bc54a005-8f67-42ef-a9cf-be50c7cae490", "value": 101816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373573, "uuid": "9139f3b8-bd86-407b-8cb9-9e96577f9f9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373573, "uuid": "09ec1280-e918-46b6-b7a6-b7964f601cdd", "value": "TR-31Payment091-H462-J828-N3091-B5740-UHA910-786F-CN87402-M8198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236b511d-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371047, "uuid": "4f3965b5-c54a-4bde-86ed-b0a3ca9b0373", "comment": "Malware payload (StrelaStealer)", "value": "3344732945dfec2d2b23ef037c06c0b3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371047, "uuid": "81d0b8f7-7bf5-428e-bb37-1ac43a5bc3c4", "comment": "Malware payload (StrelaStealer)", "value": "771c875207b6a0094f83d53e923fbc56b4577c99cc7caf92ac675455ffd15e8d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371047, "uuid": "d434175f-2019-4c84-b938-dbe600c5a029", "comment": "Malware payload (StrelaStealer)", "value": "a2218f921ad01d8dc5aa29fa02ad62277cff83f8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371047, "uuid": "525c5168-5674-498f-b5d0-4657a35023ae", "comment": "Malware payload (StrelaStealer)", "value": "58531eecb01e26c21c8086beb410ac4ccfadbafc30cf5db610b21d1902f2f9ab2036fdd51c505fbc893c1fe0ff260b7a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371047, "uuid": "9d727b9d-410c-477c-9725-f185da3f9080", "value": "T17783BB4AE7B2935E2D9C824B11DF360B36E35F0194B181CECE169167961C0FB9F1B93A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371047, "uuid": "16915c72-da89-4407-91f1-3fc9511f094d", "value": "1536:NkGvP/R0whLKSJLR1HlBXbjvPNPdUOy/1B8R1HlB1fAnwhX9ezu4JwhO1vgyTbj1:NkGvP/R0whLKSJLR1HlBXbjvPNPdUOyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371047, "uuid": "94ec7990-bd30-415c-8458-7c4b087dc17c", "value": 80969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371047, "uuid": "454d7384-8785-4946-a61f-de5f2e40a91e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371047, "uuid": "4bf5addd-bc91-4ce7-a772-ec69aadf8eab", "value": "6036279561681622040.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f40a839-555f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779400460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400460, "uuid": "9e48843d-80fe-4ce4-8163-3d6fbb0691e8", "comment": "Malware payload", "value": "ca4ff6558fe45716f7753f3c43977128", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400460, "uuid": "d2c426de-6cb2-4842-b6f6-aa378311991d", "comment": "Malware payload", "value": "773d7089e4d5ba2d3d2221f692b22f0a8d291f952b872b5ef5d73109e5cb24e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400460, "uuid": "ca895cf2-85d3-46bf-92c9-0c29dc5ac49d", "comment": "Malware payload", "value": "db414523fd2b9b75dbc1afc4eb2b9ac8e14a363f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779400460, "uuid": "f99966c3-5ac7-4c62-bcc7-bc1801f336a7", "comment": "Malware payload", "value": "d5b6a51e949ee8f1622135704dcd26eded730759ccc755becfc282ab393f46a8aefc33b2e3594d12ef6b1e133bf50522", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400460, "uuid": "480c6f9e-848b-48d0-8a83-ccbdc4c309fd", "value": "T19A35D003F574CFADE555217829B249A1A7B214970BE70357C324EA31AFB021D4E2FBE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400460, "uuid": "c43889ce-fa67-4e3d-ba61-c37aa5316e1a", "value": "12288:W059A4dI8LoeU8GuWAgIToiXzvZQXRkKtcmndIZFYG51Uk1qe5wiBaK/7+wZChua:r5g2zIIHjiBkKtriSo1fs+p0KT+pQdoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779400460, "uuid": "bf9a22ad-e84e-49ac-917a-29ce48c444c8", "value": 1070199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779400460, "uuid": "29bf26f1-cd50-4425-8561-c073a1728785", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779400460, "uuid": "4e7abd7c-b202-45d9-97c0-cd344f1afa3a", "value": "nbhpcpg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076e891a-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373577, "uuid": "b854ecfe-d101-4603-8e97-342c8407308a", "comment": "Malware payload (AgentTesla)", "value": "05997ef5b3cd9c79276c0f7a751695a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373577, "uuid": "e9774154-6944-4a1b-b7db-93152dc9d8e9", "comment": "Malware payload (AgentTesla)", "value": "77493c7ae3766b67427a8b2833a78a9864304022c15ff5dcc633a5996ce09dad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373577, "uuid": "50228151-937d-4cf1-a9b6-dfd80edbab66", "comment": "Malware payload (AgentTesla)", "value": "00815ba22b4e61d9b3fd7567a6dc8618f47f77e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373577, "uuid": "6e130719-1d26-4b76-9161-8df31e8ccc8d", "comment": "Malware payload (AgentTesla)", "value": "609857bf1901c7e74fc13c63b00ecf34be05d7a41296329278fff84b12a141aa2590a67080d90e52e7a5efac6f11bc73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373577, "uuid": "b5606f76-5648-4850-a552-cbef6f222286", "value": "T15DC42310635342E033D931AA8CD85A420A87CE0BD8D44DF636E9CB3F4A778EAD4B671D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373577, "uuid": "fa007fbc-6675-425a-9665-71219176db04", "value": "12288:Cx0MUNVDi1S/2mPrB/ybU6ovrYaQc+Mcdd02vh4BsiPkqnYuu3iH:Cx/UrYC2arFGU6kEc+3G2OkqnFu3iH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373577, "uuid": "3b8e151a-13e9-49ca-8535-d5fcdc464a04", "value": 547821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373577, "uuid": "a3f80eee-a957-4bbc-a2a1-8cd3bcdf3a08", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373577, "uuid": "d323dc37-6cbf-44a8-b6fa-9fadc196652e", "value": "BANK_DETAILS_RO83728274746272627362.lzh.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0981bd52-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1779373580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373580, "uuid": "508a6dca-5b34-49a9-8aaa-2b27d432a711", "comment": "Malware payload (VIPKeylogger)", "value": "d23adf4b0872f53a5611c6e7e60f55b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373580, "uuid": "5076ad15-11d3-4c6b-b3ae-f823fd56851f", "comment": "Malware payload (VIPKeylogger)", "value": "7768873f4b7e6b6c594bdb182bcdde73d9f8ab3b13b19fe87b5fb32bc159dd01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373580, "uuid": "98c4682a-46af-4628-a5c4-acb057a3559f", "comment": "Malware payload (VIPKeylogger)", "value": "98ee22b2f6fbc47d73048569069a0962c2ea5f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373580, "uuid": "1162a48b-5aa7-4373-a05f-529a93ceeadb", "comment": "Malware payload (VIPKeylogger)", "value": "570658f670c7416b0d07375414a1544924698c09e29fd104c0a4b988355d46b218de06703e38a14db1375252f417f028", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373580, "uuid": "4658f187-817a-41c5-9ec7-c9287afb675b", "value": "T15355D021A5D240E5D1E22EB19D7AF355BA7A6D250322818FE3C439F10E73381E7296F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373580, "uuid": "03a92ffb-7bca-4b13-ae8a-c779f19bb203", "value": "a46a46b6741b96758ff5cf06d0c4c13c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373580, "uuid": "0515b677-f367-4d26-9704-028de497764c", "value": "24576:pRmJkcoQricOIQxiZY1iaJM8CsFY7cdtbRWD4P1kkbp:mJZoQrbTFZY1iaJMvxENXP1kk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373580, "uuid": "f59df605-1eb6-4800-b2fe-99f8939ed38b", "value": 1298921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373580, "uuid": "aed95b66-2f35-4286-bdeb-3047d38a5daa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373580, "uuid": "a2ae159b-8323-4464-a85f-2652346edc66", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257004bb-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371050, "uuid": "856efb11-9c8e-403f-bfaa-b3de1b4d674e", "comment": "Malware payload (StrelaStealer)", "value": "ae6575c601792b65c4991405c64d67f2", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371050, "uuid": "2e51206d-23cb-4fa7-84a5-d4bcbc1094ae", "comment": "Malware payload (StrelaStealer)", "value": "779561986accdf9460924b691cad5bcfaa1553c29165024b6c3e6e34af5437f9", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371050, "uuid": "74e68907-934d-47c5-9322-bf35f5aac2d9", "comment": "Malware payload (StrelaStealer)", "value": "8509896d924372f4f0b824b70a2d8e90b4f08f21", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371050, "uuid": "a3ac7f66-5162-4367-b1fb-535565642ffe", "comment": "Malware payload (StrelaStealer)", "value": "1a5d0567b3e53b09adf52da3bba9840eb7715abb13a9e01d9d72f648cecea4686914676f0294c33c034c5fb313803a6f", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371050, "uuid": "43eff083-f39d-485c-af8f-4180973d9bac", "value": "T1CA713C37E02792C1F4A0AC323BF0F1AE10B8C25D65D2C6879AD9E6483C631789F90363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371050, "uuid": "bb31f473-be3f-4496-9dc1-b3e41369eef6", "value": "96:VbSWI3KfT2wOSA87HIch9rYbbpP6xoRFpEFNSCqCtv0zesFzANbSY:ZI2eSA87HI8rYbbpPbFpEu3C6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371050, "uuid": "3d6ea9cc-94ef-4815-86ec-9ff1826f0c6a", "value": 3720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371050, "uuid": "202457e7-15d3-4bde-bb08-a35c8798a305", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371050, "uuid": "f63e87c4-7308-43be-8f2b-5cd782c3b58d", "value": "RE-071-112024-2024-11-05-Oliver_Tempel_-_IT_auf_den_Punkt_gebracht.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2793fadd-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371054, "uuid": "c9f44845-313c-49dd-bcd1-f0a40b548896", "comment": "Malware payload (StrelaStealer)", "value": "4a4d63b097008c78bb5893c5649d3a2b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371054, "uuid": "ec681fb9-5a85-40a9-a805-8003edaaa6b0", "comment": "Malware payload (StrelaStealer)", "value": "77aff542f6bde5a77bfd404ca560429a9474371fd2ad6cb619896b0a403cb0f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371054, "uuid": "c97ad809-7953-471d-a540-910fb4398463", "comment": "Malware payload (StrelaStealer)", "value": "4133bdd8eab4d410e9451e9d76167ca2ac93b6d2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371054, "uuid": "e803032e-420c-4d29-a637-81eec1c5d459", "comment": "Malware payload (StrelaStealer)", "value": "970799ac7a242446db54392be68710905f1a87d128a040c8024736dc1f13e4e1a0da25eb8b913e1bcfb9db2a2ad20d96", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371054, "uuid": "0d9ddbae-2ac7-4a3e-aba7-ef855c9f595a", "value": "T13045BF61DF670ECBFA6557DCA41C9D4D8E84CCA52E2281F15BFC214B412CBE6B9B3029", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371054, "uuid": "d2203b84-7a2e-4868-93da-aca9ebdde960", "value": "12288:+uwBc/EAuP6Tn+1k3VAycuN0uB5mjed6rq9BhFBCOpcH4K4HdSDMc84HdSDMFSzT:+bFP6I6VAOie5lkQ9SzJ9S2SzQ//u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371054, "uuid": "d26b460f-65de-44ce-abbd-6f32de738d34", "value": 1192005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371054, "uuid": "a9787b40-cb75-4c22-b241-0063fdb7d897", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371054, "uuid": "c9d82c3d-2e06-4583-bea3-6c500faeee1b", "value": "2013331662285159480.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9b7371-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373584, "uuid": "60a20e95-522a-462d-bbca-24f9c5770e32", "comment": "Malware payload (AgentTesla)", "value": "8de3b1ea44239e8d02b0d85fb56ba601", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373584, "uuid": "d37e8c88-f44a-412f-84a8-70bd04071e8e", "comment": "Malware payload (AgentTesla)", "value": "77b52223e6af1351fbe04b105a9eee1df8624df07842ca40b711a8e6e7d86b1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373584, "uuid": "a64ddf21-3c35-4af4-a144-2a7875492d6a", "comment": "Malware payload (AgentTesla)", "value": "aa6d438ee9166166e2cd67f514a85579bd1e2b80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373584, "uuid": "a9fe662d-e9a3-444e-9bcd-76dec623dd34", "comment": "Malware payload (AgentTesla)", "value": "dccc300dd6d10157d8fadb78e34c8a9ff46873f34e94d7d9be42cabd8fd397a26a036da392bdbc7469eae283ef1f41db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373584, "uuid": "ab759834-8945-4e4b-b97b-84facc38fe95", "value": "T1B8D42338BB2D59398F7B43643D6B9F205B16FB21AA6773640AB41F74C29800844B7FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373584, "uuid": "3b5c1421-6109-4050-ab79-0991915ca162", "value": "12288:kmG2Ma/NA6KrJ3+HN49u7+nf+3fcGdnC+dDiIJwwgL:9tA6A3UqQyf+3B5lrgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373584, "uuid": "d5323ca3-a59d-4a59-a509-317aad9d6df6", "value": 620241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373584, "uuid": "58e63a55-3d5a-497b-95ba-75adf0958e00", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373584, "uuid": "5770b586-950f-46d4-aa33-66dffb222757", "value": "PURCHASE_ORDER-6350.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f36b428-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779373590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373590, "uuid": "d05d1413-4f6b-4161-83d4-f5eab1026be8", "comment": "Malware payload (StrelaStealer)", "value": "df39af6ba90f998bda12205a97f5889f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373590, "uuid": "a582cd81-0bc1-4552-8d85-dbf095fd3343", "comment": "Malware payload (StrelaStealer)", "value": "77cbe0c420520b5880eaef18456cb2bc7d98612e9534ed936ab6d8d4796a2668", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373590, "uuid": "e6e2dc99-bb07-439a-bb1d-68c4aa61aa7a", "comment": "Malware payload (StrelaStealer)", "value": "e891c86f44ee938c255abc2b099e3718fdf57a4a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373590, "uuid": "45ada5d4-c196-4c99-ba38-e4992dc93da0", "comment": "Malware payload (StrelaStealer)", "value": "93cff3582ad133e5d47f0c54fadaa13dcc455e4b835b335355b8b2f88f795468c6b4a798fde706dea66d227d30710812", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373590, "uuid": "212d9507-3341-4464-863b-d7621d080710", "value": "T10832450DADFB5E6B1F6B118DFBCC1B040D6C6EC093AC552B5337A02269FAB01C428A17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373590, "uuid": "c8db115a-2e75-4cc3-a22d-9ad675ce8f06", "value": "192:utKhoe2PJEd/xJ35WqaRxJWvJQxJEZdETceXERVaRxJWvv5EPYJ/6oiwExJe5EPI:ut+kEd/b35WqaRbWvGbEZdET1XERVaRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373590, "uuid": "cb57f937-67b6-4ad0-b7b2-b8ba1bef2bb0", "value": 11679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373590, "uuid": "5df9f79d-066c-4fed-a462-8a969bb87e80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373590, "uuid": "13d6c697-d7de-49c5-a06a-fc6a97de4c0a", "value": "14076806233354189.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1149468d-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373593, "uuid": "866ca5df-f216-440b-992f-ed65313a17e0", "comment": "Malware payload (AgentTesla)", "value": "c559e4648c8e6b8da033d8ef436bd676", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373593, "uuid": "e745a728-055d-416e-ba7f-5485ffb31028", "comment": "Malware payload (AgentTesla)", "value": "77e0b53e543d55a864234f52183101b1b98c1cd41b69f85bc2c4251ab4765d0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373593, "uuid": "38813b73-8857-4cb0-92ae-c6ba5c7dfb35", "comment": "Malware payload (AgentTesla)", "value": "c57d25ac1b59103b4797aa9d5f811c5e0832a013", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373593, "uuid": "40ef8667-9911-43aa-b5fd-c08fa504ddc8", "comment": "Malware payload (AgentTesla)", "value": "d42b5a8d274602de887c3f8dd0cfcffcdcd9aff0ad6e5411577758a602f46da97eae6243c1f62627445d8873778032e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373593, "uuid": "e1150256-438a-4dc6-987b-c4ba6d09bec2", "value": "T1D5D423D5A6347BEB587E16807F55484F306A948EF57DB82B6E0722C993018F30BE4F29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373593, "uuid": "45a2df40-697e-46e9-beda-4db557a49225", "value": "12288:RaK4Zs25dF7dWqzxRnmYEgWgZA+gCdMOE3EFeg0Xre43UIXNo6vq:QK4ZsmvhWSr/EB8xdM8Feg+qUNXNfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373593, "uuid": "08d848ce-a353-48a0-b327-d52f2438726d", "value": 623621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373593, "uuid": "be9bf754-6a9a-4b93-b8e3-e04aa6f93728", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373593, "uuid": "5000f7b6-4e95-4e97-90a4-1956468862df", "value": "Employee_Salary_Scale.arj.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a06fb6-5517-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779369299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779369299, "uuid": "1cbd78d5-b6f6-4433-af5e-2aa5daf30421", "comment": "Malware payload (Mirai)", "value": "a4b11d787408f0da7a11c44403f62cbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779369299, "uuid": "64d98150-39f4-4ea4-afab-08f593099ec3", "comment": "Malware payload (Mirai)", "value": "77e73b1d8f6530cf1f1901d983021c6e9a24a285d90cf2c4b09cc0ad92029e31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779369299, "uuid": "557a32f6-016d-446a-b10f-1099bb855d0b", "comment": "Malware payload (Mirai)", "value": "bf0d9e97b6b5914a5a14441327ac4a5704a6a74c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779369299, "uuid": "7a1cbbf1-bedb-4b9e-814d-997fd3fce826", "comment": "Malware payload (Mirai)", "value": "1c3cd427b4e031863b5817ae11a94eb64d2e7fc450afa9f46c951cb9b1814bfee344d2679e6a6f979ede4220263821e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779369299, "uuid": "a6d40641-9c8f-482b-a873-d9da2676a04a", "value": "T144B3F90E6E159FBDF768873407B38E36A39C238736D1D582D1ADD6101E5428E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779369299, "uuid": "82400531-478f-4851-b8b0-4c9376d7803c", "value": "1536:GTrADpT8T8S8uzb/ZVuvJ2na/hu0YlJmD9m8MdeAZ4ehx:GvADrzuztVuB2nyhu0YjmD9m8MYehx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779369299, "uuid": "b88fab7d-6c22-4ac5-9925-2f072215ad23", "value": 114404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779369299, "uuid": "c186fd37-ecae-4527-b7e7-1f16514a9259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779369299, "uuid": "dfc7d27a-106d-4514-a516-9a1eeafba4d3", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299d6322-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371057, "uuid": "440c7552-9875-4896-a6fe-f8375f635a13", "comment": "Malware payload (StrelaStealer)", "value": "9a17686b4293912ec9a9c52f427cf29f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371057, "uuid": "f98dcca0-e2d0-4507-bfbd-4846be7e98bb", "comment": "Malware payload (StrelaStealer)", "value": "77e8e3b2a90c59ad8f792c9d306ebfc97036eab9b56b8297d96de44432d5a1a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371057, "uuid": "6819d163-71b9-4aee-875b-93b5be32838c", "comment": "Malware payload (StrelaStealer)", "value": "36bb9cf1c1129a161faf74e5c9facc127f86abdc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371057, "uuid": "7fae1b62-b0b3-41ee-96bf-a18686b1b30c", "comment": "Malware payload (StrelaStealer)", "value": "dead82e706f67bf10c40829614113b9f2f391a3118ee46f8deceabd7e7e054a9019165526748530ca84e26c3a817f67f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371057, "uuid": "8d299e38-8acc-4c34-a4c0-8726c919bfe7", "value": "T144B3461457723B030C7DC82B4E21D9AB60C5CDD64A299BD128B62BDBA60CD9DDFE8770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371057, "uuid": "d3a6d2e1-377f-4e78-85f4-c497547ac661", "value": "3072:UydXioRwl4CIN7zthya0fphLC8mhu69bMbQZpG42lImb8Z4yXlKD02jxUBgrNKBh:z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371057, "uuid": "4c205f7b-2080-416b-9dcb-09e192f09edf", "value": 110551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371057, "uuid": "21d18fd2-7647-40ee-b0fb-4bb92a510f31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371057, "uuid": "2a7e0b34-f11d-4c1e-8f78-d514fbe2d766", "value": "2549924775187607274.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1348787a-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779373597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373597, "uuid": "b68c3c5f-4de0-42c2-8327-de10fb927f74", "comment": "Malware payload (SnakeKeylogger)", "value": "398447b5a1e805544830efb700001872", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373597, "uuid": "314427a6-b747-45c6-b355-55ce20e04959", "comment": "Malware payload (SnakeKeylogger)", "value": "789266b778b49343587bb91406b35c1f488ff3e454dd2365f3397ed5824e06f2", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373597, "uuid": "4838842f-83dd-44f3-b149-49b5409ed1b6", "comment": "Malware payload (SnakeKeylogger)", "value": "ffb8928d184aa5d4ac95db42b4c504ee73b59afd", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373597, "uuid": "e160db8c-fa7e-4b30-b7bf-611bd8a77aeb", "comment": "Malware payload (SnakeKeylogger)", "value": "a1d84a1bc4527534cbe2bf7edd250e0965d5c0fa334b262264ebc8984827a7d012d98ab58c37ec8d7bd010fba1af4a6a", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373597, "uuid": "9392abf9-88f3-48d9-aec1-7b9d4f380f15", "value": "T1A5E4237CA1D64782F2FBC94A8247C9E3DDFAFD0019DB4107AC655704B2A32C16E66D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373597, "uuid": "c36f2205-f726-4755-a6f9-876ee65538f6", "value": "12288:VWZqMo1QQ97fOd15STEY8gi5tOsiE7pJw5GiPyHTOLaDmhW:VHMo1bVKY/iTiG2rCaLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373597, "uuid": "2b67191f-efc9-497e-8508-b8d67c172964", "value": 667424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373597, "uuid": "5819a026-6f71-4188-9908-0c5c9cb962c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373597, "uuid": "65d9e3bc-5440-4437-bff1-e42e8f47950d", "value": "RFQXForXTenderX8-14-2024.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155f72d5-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373600, "uuid": "cb469bea-f75c-413a-a190-6369ef740445", "comment": "Malware payload (Formbook)", "value": "ad2ec4ed49e2dbaf0ccafd8a8a6b23b4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373600, "uuid": "0f782ea5-8e72-4c2f-a065-6b85e5a86ddb", "comment": "Malware payload (Formbook)", "value": "78993bdc1865625712448165aee9f3fa40828d0030a508c824a01dfea97393ae", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373600, "uuid": "a459cf54-d375-4e13-8e06-433c0a24befc", "comment": "Malware payload (Formbook)", "value": "acc7cc8cc8725311940c6a48cd29e289872655d1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373600, "uuid": "5d40a5c4-5527-4d51-b9e1-d2b798848663", "comment": "Malware payload (Formbook)", "value": "7909d395070f9ff396ae1502169762e174169ca9bf960c356349b4545bbfdfb31c5e1e2a8489db3d9c7397a4f4806e5c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373600, "uuid": "2818d516-2fe6-4093-be25-f47ce1cd5d64", "value": "T17EE4238FEAC69B0B95464C51A7FE7297C7C3A534280D3E7F570E13B0146086AB2963DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373600, "uuid": "ad3aab73-68d2-4244-ab9f-1e648a661188", "value": "12288:vFHRn+xh9eiZ9X8IGP1+QfizCeULSm7G2hkkrzyr5Y7iz6DwYA941ZHumi68E:F0XnLXABGC9V7Z6kGt6VJ1N9ilE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373600, "uuid": "e4e2a461-cd9e-4797-bbed-0cc4fbfe33b1", "value": 658097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373600, "uuid": "21150734-e320-4be6-b805-bc2346f13dbe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373600, "uuid": "affcbe8e-c5bd-4bd0-9da1-523d2d2f11f8", "value": "KopijaXbankovnogXplacanja.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2baedcf9-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779371061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371061, "uuid": "5a01dabe-3324-41dc-9acf-fad3a6e69ebd", "comment": "Malware payload (MassLogger)", "value": "b7d6608a6c2ab859e6f33b9e32417296", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371061, "uuid": "23dfa247-73f9-4fa3-b7aa-b91456b883cc", "comment": "Malware payload (MassLogger)", "value": "789a6cc85b47c7033e0ca6d8f48637d439c3462323ad231560782edad21eb023", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371061, "uuid": "c15e65d0-0c68-4dca-a832-ae503b2be3b0", "comment": "Malware payload (MassLogger)", "value": "b9a066ea0ff4cf57507789868611ebd6867dfa8e", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371061, "uuid": "0de66371-038c-4c10-b0b5-6760bd4d5a60", "comment": "Malware payload (MassLogger)", "value": "d2bd0bc15af1d67500c10f23148ea2f3e2e7e25a60ab7f26a11476eec8c65a4ab3d1ac368163b616c0a2d64c5a3a59a0", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371061, "uuid": "b2547be3-07c0-44b8-9654-2e85eeb0ed55", "value": "T168B4232EEFB81A6FF7CC1D9ED475854C37C3576448288A9835F48C5C9EA0C822A7278D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371061, "uuid": "24b4204e-7a8b-4cb7-9913-4e28bad1c01d", "value": "12288:o8KC1qboX5Dnx0DN7srf7XglTTm7UcMS2ZK/q33:ot4rXhx0DN+zQl/mpqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371061, "uuid": "1ce2dd55-68f5-448b-891d-21b92d2fe097", "value": 503566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371061, "uuid": "20b0f5ec-f37a-405f-a29c-f6b6e40c25e8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371061, "uuid": "f97affa8-3e08-4003-bb8e-4c1d516cb1d8", "value": "Contract_Draft.gz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbb5173-551b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779371064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371064, "uuid": "3a7b94dc-e5c6-4fca-b15b-3c532754ffa7", "comment": "Malware payload", "value": "1339de04a9f13b18f61773867691cc9f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371064, "uuid": "0cfbf89b-55d5-4de8-a72b-83747004639d", "comment": "Malware payload", "value": "78b4028c82dea4f1b5c6b83dedb4f6cb05f6be697dea102707bc82430c19f4fb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371064, "uuid": "998a21de-b047-4596-be46-45af8c9fb0e7", "comment": "Malware payload", "value": "74c3dce557fb0391a208eadb1e259bd6127a026c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371064, "uuid": "603e4d61-24cf-4a18-b253-d81625aa7e84", "comment": "Malware payload", "value": "610a29c9edb086dce711f8fc1d580bc8c8bbb4c1d7504ee26839e08144056fd3222aa678abafd6efda1f7e03c7f501a0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371064, "uuid": "8a8ae5a9-3f72-41ca-abd4-099d93ce5f5a", "value": "T17B2105E9093F014AD316EF3348F1D250F28C60C51025C58904065F851D153E79B57630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371064, "uuid": "ea0d0697-1f23-4967-bc76-8ab8fe319c2f", "value": "12:5jF/FRu8iUEHRhHgcTVGP+ZZA07nCtLn8Jcaqn:9F/FRbIRCcBGPdlt7oK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371064, "uuid": "ffa862f0-2d00-4b66-bc92-e1f92128b952", "value": 1254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371064, "uuid": "b35370b4-daab-4ba5-bf3a-11391b5a415f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371064, "uuid": "202e904e-875f-475a-af72-a037834c5466", "value": "Outstanding_invoices.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17746ca8-5521-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373604, "uuid": "2e20f3d4-1ddf-4c33-9c8c-799f823d29b1", "comment": "Malware payload", "value": "14ccec59fadc72b86d26c85c0db16b6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373604, "uuid": "f09c6cb5-7a79-4717-8267-494d4f7438af", "comment": "Malware payload", "value": "78c5e8ca9474815c1cd85825b00d9be487a0e049fb827b12ef74bc57580cd3f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373604, "uuid": "4cfc7e59-77b5-4411-bcec-d71a5a9c392d", "comment": "Malware payload", "value": "93e2223d7c8268cdc31681e257691223bf85c31f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373604, "uuid": "79950749-7987-4b85-8d84-9061bccc3439", "comment": "Malware payload", "value": "ec594c833f893f8121934ad891e8c41504432f96420d3ae8137414c99db39eef15b641ef3101b9ad554da812ba561a44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373604, "uuid": "dec58ae4-81ad-416d-bcfa-4ca005390e30", "value": "T19955E0153B498D0BC2936B798E68F3765764CFCD3A16830696F1CCB7B9ACA87AD405C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373604, "uuid": "7a8b1c0f-04b7-4f26-a703-d579e573b2e3", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373604, "uuid": "f12d649f-2a6d-409e-b55c-d5d522f0afb8", "value": "24576:0ZbqxGFMhCGa7cQPsUkPyQ1lF0jYb67fx5hmku83oD1dEUu28KkzFu7biFW:8bqxGFMhCGa7cQEUWF0jq67JXmkoMXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373604, "uuid": "007a0f08-5040-422d-9a68-933bbe40d6f0", "value": 1298344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373604, "uuid": "863bdd92-a91d-4d34-8026-39ebceace868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373604, "uuid": "aae0f785-3b9d-4c2b-998e-32d5b13610b2", "value": "Ref_7021929821US20240709031221650.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da281583-550f-11f1-a769-42010a9c0008", "comment": "Malware payload (AntiDot)", "timestamp": 1779366199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779366199, "uuid": "34a3a1b3-b2f2-4fb7-a7f2-6be911a5b134", "comment": "Malware payload (AntiDot)", "value": "f4d8432cee7a32f1af540b82060e42fb", "object_relation": "md5", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779366199, "uuid": "1b11df84-af94-4a54-9234-46a27587f574", "comment": "Malware payload (AntiDot)", "value": "78ef29227c3af00b3d31d9cb214febfcc1424ce78fa813e5a6b7ead453f3fb67", "object_relation": "sha256", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779366199, "uuid": "75007952-3007-4628-a3c5-8c24e561a907", "comment": "Malware payload (AntiDot)", "value": "df3051d84e6e26d845f0d3408329a359e8d4996e", "object_relation": "sha1", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779366199, "uuid": "8c91e71d-96a0-4bcd-b16e-2c5548a08a1e", "comment": "Malware payload (AntiDot)", "value": "9a7807e301628fde39ac6ede1b36c96d6ac661405d9780942bf80bf6be16412ba8df34015ea3f2d2fe3c8a680e12be75", "object_relation": "sha3-384", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779366199, "uuid": "f75d6ed8-27c9-4cb0-b42b-6f70af5b263e", "value": "T19F37011890C6003DE36A30F6575E5DF2A2502B69A2C2C8DDFEB57816B993D23FD10DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779366199, "uuid": "f8b6e92e-1008-4cd4-98c1-64b63d67c236", "value": "393216:OKYmDjkedB3ul6SzavyYc51TsEc/pUkGDKhUkIetZ3BX:OoBTbJmTC/p9uPetZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779366199, "uuid": "7f762fb3-87de-43f3-a7f6-a7c2b866c3c6", "value": 24161236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779366199, "uuid": "4aae2a6a-6990-4654-ad03-8615a195c6b5", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779366199, "uuid": "ad8ef9d0-138f-434c-a7a5-0e3797d9778d", "value": "com.jaheno.constant.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885c56a1-54e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779349741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349741, "uuid": "a4dacc31-57c1-4c7f-a7c4-84e3a8529127", "comment": "Malware payload (Mirai)", "value": "0500eda17c1a47e7f27b86c5e7379e9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349741, "uuid": "f2d0ddce-2450-4de5-a801-2ff89a92fde1", "comment": "Malware payload (Mirai)", "value": "79140196f59a107dd4a5b26f3728a53ae6390d6b1879d973299abab0a962e167", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349741, "uuid": "ea51a843-ca1a-45bb-a00a-24678557cc2d", "comment": "Malware payload (Mirai)", "value": "9f5afa657d97c09f52f4118326df119d4d42a5b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779349741, "uuid": "5ad2e0f1-4ced-44b1-8a98-4598ee99f209", "comment": "Malware payload (Mirai)", "value": "dffbffdbb4b521c006f8b891753ad55d7cc362350dfad192094f90e79ed277a60a614396dad5781c7b73ae0fcd1c2d18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349741, "uuid": "ac5fb13a-e1ab-44c1-8d1b-20f8640352c4", "value": "T180935B01B3180A43D1771DF02A3F27D5D3AAE6D121F4F684351EAA8A82B2E735586FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349741, "uuid": "5855020b-20e7-492d-9a5a-282eae4358b7", "value": "1536:hE1h0CaMpvxmxFJocN73j5wiTjmrvnzhwfFtd1XKUDeLxiZ4jL5qJstpeKF5WoDM:hE1h0CaMpvxmxFJocN73SiTQcVKZoa90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779349741, "uuid": "338066d6-da67-43fb-90df-3bd8e875c48a", "value": 92012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779349741, "uuid": "cecb2a8c-f9de-467b-bb25-3365844e9632", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779349741, "uuid": "36698045-c3d0-470f-a41b-c7022dffb514", "value": "bin.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19701c14-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779373607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373607, "uuid": "adc57468-915a-4930-9c8b-ce4310775da5", "comment": "Malware payload (Formbook)", "value": "eb6828c14845b6341a0fba2b325f74b2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373607, "uuid": "79564a62-74b4-4c2b-9f97-35d70ca3a681", "comment": "Malware payload (Formbook)", "value": "792c94234b460942954914b93397e9aae4d6c955a85eafa506234e7c8ab60104", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373607, "uuid": "1db818a8-9f94-4748-a93a-fa57cfe8f38a", "comment": "Malware payload (Formbook)", "value": "65c4313cf55bb6a66c2fa8ebc138bd38ee75eb7f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373607, "uuid": "9594b438-e75e-415d-a707-294ef5a3d53f", "comment": "Malware payload (Formbook)", "value": "c626ec1ac2dc0ffced3623e11e133a101f2b87ce283ad5b597aff1ec4b30c551f28f017b07fd2b26447b217a584c77c9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373607, "uuid": "f30c9119-4332-40be-b7e1-a27a5dd7ad84", "value": "T11C1533E2766BE851CF335A3DF2871D000E1CE5604F3B6E44E6109CE5A879ACBC9DE681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373607, "uuid": "ed6b26a3-667a-4831-a4cc-d473296ce2da", "value": "12288:3SBUmN7fAxXdWF8EXXinjgcE5z4pufMgmbuyI+6LjXc8H2wNzyWF+/yk9:itNTAxXMF8EXUjnAPTS1GjXc0zVgyk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373607, "uuid": "0ae4049f-6656-4488-ad50-24732484081c", "value": 876756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373607, "uuid": "2ea1571e-c43a-45f3-b9b6-09024c0db772", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373607, "uuid": "1d0f7397-fb5a-4d49-85e3-7c8ebe072a0d", "value": "PO#86637.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2faf821a-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (Loki)", "timestamp": 1779371067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371067, "uuid": "0ff23ebb-1305-4245-8dcf-c02b80a6870b", "comment": "Malware payload (Loki)", "value": "25e63e72f959cf4b0deeacd27f97e73d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371067, "uuid": "55016a7d-5ca0-4e57-ba98-28b7e779c406", "comment": "Malware payload (Loki)", "value": "793a4d8313bd832cfc8d547e9f7daae0f8869b368c14075bfde88d8c27486214", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371067, "uuid": "29937a82-8f07-4677-9d66-67b5933edbdc", "comment": "Malware payload (Loki)", "value": "825bb67d3fbd4b13405771e146b656f682f239ab", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371067, "uuid": "015b935f-af7d-4ecf-a66d-231d7555cfef", "comment": "Malware payload (Loki)", "value": "e9dc6e9b7cffab57002c350b97aa98b922bbe589b47716e1bb8b46dcf51d37aa2e3851396ceddeef845fe4fb0e768dfd", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371067, "uuid": "7afb925d-92bd-46e8-9fe4-2f48624fc7c4", "value": "T18CD2E1F5D2E1C72E8641032F34C0AD69E6BD604A30E3EA90159BB516EC491F343F86F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371067, "uuid": "bec5651f-82b3-4be2-9722-fc7ee2763baa", "value": "768:/rorw12ruD3k1QG7uN/hAHaZRqOQ05+u2cc7PM:/rorxuDsduN/r+OQs+uZco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371067, "uuid": "05b104ca-4f96-4d3f-8e44-a3110969fafe", "value": 30042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371067, "uuid": "786b8b8c-e9bb-4c52-afc5-21281efef14a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371067, "uuid": "3ee03a33-4362-4fdb-a87a-d8376c602a22", "value": "Quotation.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b75a2d4-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779373610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373610, "uuid": "55ac9849-d36b-4981-8352-e5d213c2923a", "comment": "Malware payload (AgentTesla)", "value": "cc64227495c20715f2fd20faf4f9840d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373610, "uuid": "260bde30-30f9-44a1-9aa6-bf64372e7030", "comment": "Malware payload (AgentTesla)", "value": "7954bb92a2d4b2c608c5d1152abbbce0f7081304dabdd2bd8f41a0a8af0035f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373610, "uuid": "24cd8ff4-7520-47bb-b11c-b84c834b86c4", "comment": "Malware payload (AgentTesla)", "value": "5d1956a5317be2d9e5cfa7d11bb3400a0e98f6f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373610, "uuid": "83e2e125-402a-49de-b3a4-c36fa106f1a2", "comment": "Malware payload (AgentTesla)", "value": "2bed82ddb96992ab1da81119ced6db0a1228a1c8754c9c4cb7c2e37e28c4a9416d340425b7256fd9cf93cd3761eef32b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373610, "uuid": "0f368a38-9afd-4bd6-a63e-14017210032b", "value": "T1E02533FC01C6722D562A9C88E5A652CF936FF79E2DA1F25B17E304008FB2646A44F7C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373610, "uuid": "c015ddcc-208d-4b84-8ba6-84aa5e810329", "value": "24576:90vMdjFSoUS3QDJXDDgLxvnD4j6zld6dlufTJNtl1yN6:90ERFtL3exUKj6zld6dlsTJN1yN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373610, "uuid": "8501f1c0-690c-4f78-9365-0878a8f47073", "value": 987807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373610, "uuid": "83605c25-3fb8-4055-92f3-c93aa1bf7733", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373610, "uuid": "e96c913f-6cab-4d74-b1f1-feae88f4c177", "value": "TEKL\u0130F_TALEP_VE_F\u0130YAT_TEKL\u0130F\u0130_xlxs.z.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c6563c-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779371071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371071, "uuid": "09495dc6-62e2-420b-b0fa-a7b5b713dfe5", "comment": "Malware payload (Formbook)", "value": "1f05d3489c155f741acf6c60222533ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371071, "uuid": "3d8d8d29-90a9-4aba-a2fc-2bbfa37f6a54", "comment": "Malware payload (Formbook)", "value": "798fa95813d288933757022c943a26641e0fa710a5e94b294d161dc9787cbf16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371071, "uuid": "32d1b4f6-e279-4fff-aa56-cb5878324c76", "comment": "Malware payload (Formbook)", "value": "1a1b5754b18000530470655ab4644a2485536a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371071, "uuid": "d8c537a7-0238-4ddb-bdc0-4c5f7eda716b", "comment": "Malware payload (Formbook)", "value": "820b4413ac72604c9b9fa93155969d0c9682672694c0200fdc836c8127afa383ca915241a529ac86de8bf36b51581c7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371071, "uuid": "44751be2-73be-4d64-9184-aa7c117d36a7", "value": "T15DF4231266C0FC9AC19233F054B68CFA0A56B971ED5877B28790F29F9870383C597F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371071, "uuid": "1d6a880f-8fe8-4f1f-891c-37375b7c178e", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371071, "uuid": "14b03038-c0f8-4c32-a889-53135caf5928", "value": "12288:XsHzOUNUSB/o5LsI1uwajJ5yvv1l27SB/DBMb3TGLLsJc0s8fNpwu0Zhyqr5847K:GiUmSB/o5d1ubcvhDWbDkLsJ48fN8Zh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371071, "uuid": "6631d17c-42e6-4307-8fff-f26767161831", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371071, "uuid": "9cafa4dd-5f24-46bb-9629-752ff338e974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371071, "uuid": "90c9badb-6b9d-4ad7-bd3b-47b62b5986bf", "value": "DHLXINVX0914534XPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50c6c6f-5528-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779376982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376982, "uuid": "72cc80dd-e9be-478c-931d-d3fb6d08dc4c", "comment": "Malware payload", "value": "a61c7288997ee1b63535c02ef877fa51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376982, "uuid": "df77698a-2501-4efd-aae7-2d160971b557", "comment": "Malware payload", "value": "7a2c8630590c2d4630dc2a1c872dd5b113c0bcef99f03f18b148ee227c17317c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376982, "uuid": "87139f88-5211-4d77-babf-53b814b4b2bc", "comment": "Malware payload", "value": "3d5d0f2549bd5b2b22022a05653b5a48fad9b580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779376982, "uuid": "48417fbf-b3be-4e62-b8d3-24464befe87d", "comment": "Malware payload", "value": "b0b958a1a892c68d8b29c66be559e9e0be2abafbd55c358d0c841437f13678c2cc86ba32551d87fbf84b4c4517e91290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779376982, "uuid": "b2471f87-24ff-4b16-aedd-74c25e564480", "value": "T16DC02B0F243F0060C11873344FE00C1A0C00C4C828A3F04E08CC83EE0EA20C02A0337C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779376982, "uuid": "c5e0cbbe-c5b4-445a-be85-a03d29ce3d3e", "value": "3:vhjJpJlllmUAWJVuMRjGcl/jHDVtz3tnpJlllmglQtlR9JVAB+lF/ln:5jHrllpbtRjGUHxN3HrllNQtL9bAB+l3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779376982, "uuid": "002605b5-efb8-4a29-830a-990c543aa72d", "value": 163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779376982, "uuid": "a1d95388-ac6f-4fc6-96df-d9cdbc20c8eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779376982, "uuid": "69d1cb37-130b-41f8-a7d7-881064769bd6", "value": "sample.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7465fc-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779373614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373614, "uuid": "4d1e8856-f3c4-4a8e-a89c-acd5768edda2", "comment": "Malware payload (SnakeKeylogger)", "value": "02def88e6ab1d8818a372c462272cda7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373614, "uuid": "86530e8a-ad4a-41d9-bc15-fd3d9067bbbc", "comment": "Malware payload (SnakeKeylogger)", "value": "7a310c85d3a3334c4e715402d09355dda340e0e32f784eab626e4ab1a7aff321", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373614, "uuid": "206d1770-8126-43bc-842a-12052fe942b5", "comment": "Malware payload (SnakeKeylogger)", "value": "28da6867891259c1b1f0cd39cae184d533fd8b02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373614, "uuid": "d58e2d72-efef-46ee-b090-c2adb302daa1", "comment": "Malware payload (SnakeKeylogger)", "value": "b45b34a0ed513f0ce6fc375f9e70d745c7e387e0eb8e65db7b6aca24bfb9a7c53047fc397a22883732993e3094e927ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373614, "uuid": "45828fc9-dc83-4796-a18a-b018611a7777", "value": "T12DE4DF8862EC2F42D5B95BF56675850187B3741A2A71F30E0EDD20EF1BB7F409A52B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373614, "uuid": "41a68ba0-6118-41bb-bc5e-a8bca4ee43c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373614, "uuid": "c64a70bf-a2c8-4964-b96a-ef68ecafd545", "value": "12288:7dR4YVK+orvSdGYcfhQ32RFrkJ03I4tcYr41NNLdXGrBOv:7L41+n8W36rkJ0WYrC/ReO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373614, "uuid": "0138cc36-3cfb-468e-b176-4b8ce1a5a937", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373614, "uuid": "a733c046-7c55-4259-8dfd-f54a96c96e5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373614, "uuid": "9063545b-b333-4db2-a738-3756ba74da33", "value": "Purchase_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3565696d-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371077, "uuid": "46fbf05a-6ace-4c9b-afa5-c69e88a038c5", "comment": "Malware payload (StrelaStealer)", "value": "5c871c0af18326f6ad44450dfbc3886f", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371077, "uuid": "7cdd9e23-d9cc-468e-9dbc-9e7ed97c8dc8", "comment": "Malware payload (StrelaStealer)", "value": "7b0f4e8b6587ecd1884418f7fbb375e657053608c1fce445173a6c400576317e", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371077, "uuid": "b9e062a7-70c8-477d-bfcf-6fe25cf47fde", "comment": "Malware payload (StrelaStealer)", "value": "be4b7d12aa63d5c5dcac20a20e4916d68da2d12d", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371077, "uuid": "5f7497b0-df25-41f2-ace4-938569dc3e9a", "comment": "Malware payload (StrelaStealer)", "value": "19c2025092c197ad7ba04f92df2340657e9b31fb49c36e3103e73136dca9b77ea899009d54f3cb9f20accfc650f7d73a", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371077, "uuid": "a3a507ad-d2d0-4f08-b495-26057397659d", "value": "T170442307E633ACC3985E089E0FDC091CBE2DE458F543DE10B65F699E3493D50AAA99C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371077, "uuid": "c4a54eea-f4af-4418-a44f-5b6cf4edcdbd", "value": "6144:d9EUyDvGbVRPcnlHdvYE2kNfTzn4lyCpVA7Snf+ExHtGE:d9jWIRPcnddv92kNfALVySn1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371077, "uuid": "bcab1609-d535-4044-bd60-5e5495c3172d", "value": 271042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371077, "uuid": "b32d1b59-afbb-41b5-81a8-3a4d21c4c3ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371077, "uuid": "dc0864c8-4d6c-48fa-83bd-340f97a833e6", "value": "382424.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7dc70d-54ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779350819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779350819, "uuid": "545a9e8a-0afd-4b53-a0c4-639d81c02b0e", "comment": "Malware payload", "value": "a8a6c4fed2ab2a2ef79edc4683e09f93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779350819, "uuid": "81034f07-4a72-4d7e-acd0-7138108d0052", "comment": "Malware payload", "value": "7b3b896739b4ec09f361797c60fd68b3a02d71ecbad7c51254d67ebf3817e3ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779350819, "uuid": "be822364-3d45-4c25-96f4-88c8f8fc8327", "comment": "Malware payload", "value": "ae73a7b8794bc987e64c49f9a329568ad9c55b52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779350819, "uuid": "c11a1ae7-b8d1-4ba8-917e-d026d1eb878b", "comment": "Malware payload", "value": "0f38f97abaae97fc1f4fda95849e54e762cc961ee1bb3e95b994bc1ccba513cfd0965d328dba8db3cff1667228fb9116", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779350819, "uuid": "8494d101-92b3-4686-9e50-dfc766908298", "value": "T1FCB423A20C309582DCF3492962EE3151A5A2BEB5DF1CF6111522BC7DBE256C7C64B8F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779350819, "uuid": "a6152809-e1c2-4729-9aeb-c43ed12d0224", "value": "12288:aejIro9698mOhbGFWoJWdB4QN/42HTp8mFCmGYNDHOy:5IrSo8lbGgoJWdBfZlTp8hzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779350819, "uuid": "ffb3ad73-4cdc-4ecd-845a-79555ccb7532", "value": 519396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779350819, "uuid": "80713ee9-a219-4e76-84b7-d37ee638bf3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779350819, "uuid": "08f8f935-bcfe-44d8-9a1f-6230b2575167", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2125e485-5521-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779373620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373620, "uuid": "b975cdc9-d341-4565-aea3-79e1d3ef9488", "comment": "Malware payload", "value": "85ac462a2600151abab14095897370bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373620, "uuid": "af67cba1-f022-49e4-9344-1dd336e626b8", "comment": "Malware payload", "value": "7b3ef6871b0c4d64dd7fd96937c190763fae58bd560131b96dbc9ef860c75e54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373620, "uuid": "1156bc2d-dad8-4b37-9fb6-23bf5ccd578c", "comment": "Malware payload", "value": "f55fcd49672b9166d98527e07535e140aab8e7d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373620, "uuid": "4f8260fb-731f-4b83-8e54-d7a244531058", "comment": "Malware payload", "value": "e9caf9ab7ea03bc3f17b05009615775f3b8ec9b46f3a98c6304fcd36de95e69c42a732ab38d3fc83eabb0917587d04db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373620, "uuid": "7326d9d0-8dd2-4b7c-a73a-f86d64f9764f", "value": "T196F4232472990E77EA728BFB0072145503FDA17C6865E2C89DD460ED5DF2F0947A2F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373620, "uuid": "1d41ff38-1940-4b1a-86ca-28a935bb2dad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373620, "uuid": "92b6c2ad-c7dc-4086-a6b3-d32f56f01a72", "value": "12288:6Q/H2aJWGs0lcVbFlPLHkPXHLVbPHg3CoC3SVyGIC+q2kFmGwcJwmK6t:64HtJWGs0qVbwPbO8AJD+7dG/Jwn6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373620, "uuid": "4afaf1b2-8f80-40e8-a2d8-d53b68cc45d5", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373620, "uuid": "a8b5b8af-97b8-4521-99b8-785afa5ff34f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373620, "uuid": "d5b5f0ac-4efd-4d0a-8a0c-afa150045790", "value": "products-list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9a9d52-5505-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779361726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779361726, "uuid": "31144e4b-8919-40c2-b7e6-1bb87569a850", "comment": "Malware payload (Mirai)", "value": "e98289e04ff18448a35b8f7ac2e4fb72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779361726, "uuid": "170ff975-fd5f-4dcd-bbb7-7ca5f2e4d06f", "comment": "Malware payload (Mirai)", "value": "7bc338ded40be4b25adb8b8911c9d1850fd9bd7db1d07fb7b37d6b5797c30f8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779361726, "uuid": "6c0781e4-3778-4dd0-bd9a-18a479cb766a", "comment": "Malware payload (Mirai)", "value": "63113d1505174b69caf183b749c891ec796290cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779361726, "uuid": "acb666e9-54c4-4938-9443-4ae806382db2", "comment": "Malware payload (Mirai)", "value": "6414d6a0960bb8cf088a0898d61748580a1288bd1c2e0370ca4d8a49d39eabfcb0feb0b5042828510a34546b22ba5ac0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779361726, "uuid": "d8727c27-87f3-4cc2-be27-29e4e0f7510f", "value": "T1F3142B46EA418B13C0D627B9FADF424533339B5493EB73059928ABB43F8679E4F23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779361726, "uuid": "58ea3b6c-9aff-4099-99bd-4ab75ba373cd", "value": "3072:FrWmClsbqqXiDR+1MUVUWavaMEKfTVvtxEkb9Kj8eovgoXM/R6MK/d:8mHqEy+1NKWavaMEKfT9R9KjVovtXM/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779361726, "uuid": "1db60620-98b0-4ce4-9637-a9c0890cf082", "value": 191674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779361726, "uuid": "7b685efd-44ad-48db-8322-9089ce4d0f75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779361726, "uuid": "8cfceb7e-bfe7-4f0d-aeac-2c81c32332b5", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6217549-551f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779373038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373038, "uuid": "e96f4764-2d51-4929-bd29-057d3acb56c4", "comment": "Malware payload (RemcosRAT)", "value": "45b642e4828dc6d6c499ab33da67f3a3", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373038, "uuid": "830fa47b-2ba2-412f-affc-83e40c1996a2", "comment": "Malware payload (RemcosRAT)", "value": "7be5e41f05fa80cc5afcc32b664d2214c5713da78ebaf965fd36369797b0711d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373038, "uuid": "d2ba949d-4657-49df-8d04-9b0a92a4efb1", "comment": "Malware payload (RemcosRAT)", "value": "165ad60e4029d5ebe0cdb405796c027a706c8f82", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373038, "uuid": "189ae479-38ed-48e3-992d-b74987ad82ed", "comment": "Malware payload (RemcosRAT)", "value": "f5f98a0e69f9bc86ef7df3897f1170d781b2771c99cb6f1a198d3b8a9d65a4cbf5d84ec2a547533b36fa42725d941368", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373038, "uuid": "d5a7eed3-b1cc-4cc2-9bc8-2dfb26291ab9", "value": "T13132BF4027E2DCAC97899D9FC74F6051B2A1EB5B71F0B773B1B5810E24C9C6426E9780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373038, "uuid": "83f0cd0e-fcfa-4038-9884-268713b622a9", "value": "192:EKr3bl+rA34yY2jv2VVlP6SQYyj8/WNVQETanLd1xTHoZ4Cqcky9:Ei3bl+rjyY2jOVrBETw1JH5CqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373038, "uuid": "fb500ae0-7b82-4ac6-b198-97de9d7e5e51", "value": 11248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373038, "uuid": "12f74f3a-bfaa-4ee8-a40f-22f769d94458", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373038, "uuid": "8ea9afff-66cc-4436-a076-e4993218d709", "value": "Payment_USD.gz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23477bf1-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779373623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373623, "uuid": "386cc243-c0bc-457d-b923-84241320f297", "comment": "Malware payload (SnakeKeylogger)", "value": "86ed0a34aa04e814c87a2f4951bfabe8", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373623, "uuid": "af9e2acf-707b-43e5-bb00-0cee0250b93e", "comment": "Malware payload (SnakeKeylogger)", "value": "7be8a5c09efd250aa2143a5c52697bd099a9248c276aff25f33e4bbebc13cd54", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373623, "uuid": "cb5fa916-004b-4da5-a351-8ec805080abf", "comment": "Malware payload (SnakeKeylogger)", "value": "0003ad8c5121a79961f602b0fc82246a96c0d5b6", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373623, "uuid": "4ec7a61c-c0e7-45bd-95de-70e76dcf6f07", "comment": "Malware payload (SnakeKeylogger)", "value": "0d3a38f2f84a8498c6fda057d9347adbefe141b1c680c244cc1a6d5360f699faa627e9ea86d37512dd66da1409bfe5ce", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373623, "uuid": "63e20d87-9ac0-48f8-8ddd-6aa1655bb050", "value": "T1DA25336915EC24439EAE4845C26C9AD5F02F63EFCDE73CB85E87C2BB9D147C0620299D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373623, "uuid": "3cfb6f29-e33d-44ac-add6-f669facdb2d5", "value": "24576:at7Y8R39qYXC6ruzSTzEyIT9e2j+nBupwmYhXp:at7Y89qYXC6ruzS8n5dawqhXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779373623, "uuid": "10a097fd-1524-4803-b1cd-b85690162c84", "value": 992642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779373623, "uuid": "385c0055-6a56-48d3-98b5-70e39edb9564", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779373623, "uuid": "9dd2a145-9151-40c2-adb9-df3582f7e9e2", "value": "New_order_PO#86637.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376b6dfa-551b-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1779371080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371080, "uuid": "6fe8b1f1-fbf6-4e0a-9cd9-e175f5b6e922", "comment": "Malware payload (StrelaStealer)", "value": "ca3c6809d8908e33876e6993c9f42efc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371080, "uuid": "53556c54-f539-4614-8210-fe5eb64170e1", "comment": "Malware payload (StrelaStealer)", "value": "7bed9ee451623837181a5d166228965bd1148f41c6868957032ae088c954c51c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371080, "uuid": "85f08e9e-ee18-4c6f-bba1-869aa10f054d", "comment": "Malware payload (StrelaStealer)", "value": "05f299bd2afac78bc1c9909f8b92b9f84bc1b25b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779371080, "uuid": "dd11b3cd-b419-48e4-a4ea-5d6ab4d59b45", "comment": "Malware payload (StrelaStealer)", "value": "63b69442a816a19ad2faddd8cbed4a5caa29172d7071d7dc527f333718c8586d1c4b63215f436ce770675af77cb1e6c9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371080, "uuid": "21bf1283-4dc1-480d-a55a-cff0351988ed", "value": "T19443A8124AA6DB4366EED0686223009BA499C451D74C53C8B0776DE7CA8FD3C89DFB3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371080, "uuid": "fa9be36a-0191-4700-a0c6-9a3f3d65cd2c", "value": "768:HO84OOD/FUSX7E5SD139GqCWT+Ry6USEVS80ah:HO84tzyQiEVS8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779371080, "uuid": "335addf0-21be-481e-b708-7c26474611c5", "value": 57293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779371080, "uuid": "2d192903-8da6-43c8-aa9b-573545a2be37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779371080, "uuid": "502f73f8-8219-4a81-a098-11e8b2232ec8", "value": "581920970676112086.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25398343-5521-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1779373627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779373627, "uuid": "35374599-6ec4-4c42-b6ed-7c06739ab3e1", "comment": "Malware payload (PureCrypter)", "value": "ca3c5ec33d393a13545b06e78290dae7", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC",