{ "Event": { "published": true, "date": "2024-01-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-01-21", "timestamp": 1705881781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "da2eb7d6-a5ab-47d2-aab7-8e24a683c9e8", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b1d682-b864-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Lazarus)", "timestamp": 1705845428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845428, "uuid": "f534b9ad-c5ab-4119-894c-8971bedfc1da", "comment": "Malware payload (Lazarus)", "value": "420a13202d271babc32bf8259cdaddf3", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845428, "uuid": "47546b7e-594f-4579-bc58-36798a0217bc", "comment": "Malware payload (Lazarus)", "value": "00433ebf3b21c1c055d4ab8a599d3e84f03b328496236b54e56042cef2146b1c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845428, "uuid": "51a99e6a-0cae-4ad8-9179-97a34b39d8fc", "comment": "Malware payload (Lazarus)", "value": "7221445c823d67f03b438a3c83583f9364a7f0b4", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845428, "uuid": "23f93586-8ed0-4fb4-956a-d5257c21173c", "comment": "Malware payload (Lazarus)", "value": "2485761ee61b6f0cf09d22f8bfff374ab61b363dcdfef349a0c3939eb149586af2d2e66fe0891782f6a90320a4bd2f6b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845428, "uuid": "c39c21c6-85da-4181-9e9b-edc1ac105cb8", "value": "T1C0533B0973A140BDE5935274C8B39A51E372B84A5372939F2F6446AF9F237C16938F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845428, "uuid": "a4909307-768f-4de7-8f80-c6ce11a15153", "value": "0c88d36e7925fde645da2cbf38dad83c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845428, "uuid": "168d8b7f-5b55-43c7-9e60-9986986db531", "value": "768:weQtV+Nia8Ol7zBOwpa5WWkZDDgAYtTKU/cY9Qvw2xHckDJXrsmgFM1xzHMyrPm:ZQt4Nl8uBOwyW/q9TKgQvw2Zhr2Avr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705845428, "uuid": "dba7299d-9852-4b5b-8fc9-ede849b91a1a", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705845428, "uuid": "85a95528-1179-4e67-90b4-a5a006e38662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845428, "uuid": "1376d55f-a591-4b69-b749-8e39ee9d082a", "value": "usrgroup.dat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad5afa2-b835-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705824844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824844, "uuid": "befd997d-29a1-426b-9550-8e9e1557b37a", "comment": "Malware payload (Mirai)", "value": "63b6aa4756b328765be4bbc12090040a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824844, "uuid": "2e519aeb-935c-4143-a28d-a2c16989510a", "comment": "Malware payload (Mirai)", "value": "02cb3d33a14f371d5698f4b83154304cda91f09a2a2b29ce6049adb3afdf6ef4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824844, "uuid": "bea5d843-17a2-4b1e-81bd-0755a4f7fc7d", "comment": "Malware payload (Mirai)", "value": "0e770bf6d5655392ef84c39aebaf366e0168fd29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824844, "uuid": "1dac17f1-9c40-480e-b095-e05a0411c79e", "comment": "Malware payload (Mirai)", "value": "9d58ba0801af3e555b439813f17c567174143f4ed9977f1a43ede6d4181b6fde82d7950055f46cd89859e045fb42e22f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824844, "uuid": "1dde197e-fa70-4001-93df-b7ccb6d98459", "value": "T1B973A9092E358F6CFB5D823697B78F219758339626E1C645E16CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824844, "uuid": "2bf89ebb-6b73-4ab7-ad01-7866e0a483aa", "value": "1536:lo89L2T27mQaXcn6EyvXqaQSiIHW5VU+6Y3jfhdR2QEc8LMkwd42+T7w:lo+2TIaXIE6aZiIH0VU+6KfhdR2Hc8Lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705824844, "uuid": "ac70cd8d-c638-42af-a57d-960bd935145a", "value": 80188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705824844, "uuid": "02744306-b763-4a22-8cde-9dfb9d4fe136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824844, "uuid": "c91d2d9f-aadf-4db3-9b55-a1da6f2b00d6", "value": "63b6aa4756b328765be4bbc12090040a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b178c095-b879-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705854330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854330, "uuid": "28e7c844-6f9d-47fe-a30c-5dc01ec3b996", "comment": "Malware payload (RedLineStealer)", "value": "f881085a38a6d3029dbb208b73a4cc19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854330, "uuid": "2444265f-a479-4f21-9dfd-1f7527a0d223", "comment": "Malware payload (RedLineStealer)", "value": "037f545f15559b353c39606eaa0b3a93e63f402dff30665c03f2f35d999b6062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854330, "uuid": "42331f9a-8eef-48ce-9856-cad2a1d08da9", "comment": "Malware payload (RedLineStealer)", "value": "2072691c5e4d25971c8e10388095d096dd0122e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854330, "uuid": "510b71f1-7fa2-42c1-ac2e-1c7ce0aeb3c0", "comment": "Malware payload (RedLineStealer)", "value": "08de1337af5afd7d0d38254f27b16462d616fb6f8d48a442dd583d020544b21d5407c98c61dab4e63989fba8eb81db8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854330, "uuid": "f1a71d50-bfa3-449f-876e-0637a96e1a84", "value": "T149F6127672BACAE2C0154732B9929123333E9D727F574B7332B8321F0E7275196992B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854330, "uuid": "3bfac2ae-745d-47d4-a63f-ec99e5d08f68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854330, "uuid": "6cf44404-1906-4886-9658-49ebe94ccc29", "value": "98304:6/1FK8uWvXodPOTZgMVv2wNN/ZM2fjHno4:6iavEmTZgMVvNvxMWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705854330, "uuid": "1cb21227-e53e-481a-b6f5-8ebe27593884", "value": 15557120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705854330, "uuid": "7432a1ee-c4d8-44d2-8ac3-e4395106306c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854330, "uuid": "3395e3ca-0348-4a2a-8af2-7f24dab965da", "value": "037F545F15559B353C39606EAA0B3A93E63F402DFF306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033fa3a4-b85e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705842441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705842441, "uuid": "537a3e97-80b6-41bb-8b6a-09b7b2fcc9f7", "comment": "Malware payload (njrat)", "value": "7ae7a7de00ee72ac9d1aca67374dc3cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705842441, "uuid": "202ade6e-efa3-47c0-8f20-e240272f6953", "comment": "Malware payload (njrat)", "value": "041913272fd2e9e4bd0ae2f304c1ba7e87939b88f8c20dc00da7512f6f374f85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705842441, "uuid": "76bc8251-2c48-45a8-88ab-262f3ab7cdec", "comment": "Malware payload (njrat)", "value": "cccee23c3e4ed32763845715eb72b282868c38b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705842441, "uuid": "c19d83ed-c26a-4bb0-8818-dbf4d63f17a3", "comment": "Malware payload (njrat)", "value": "711a8d5f4ac0c17a53c6300137355bb54a7b86c2b161e3531ac1fc22c73841aad3b6b88c3a9f79131d42665d818a945e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705842441, "uuid": "e7a48708-cecb-4ce1-b875-111171571cad", "value": "T18CE2084677E84225C6BD6AF88CB313254772E3438532EB6F5CDC88CA5B676D00246EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705842441, "uuid": "f1524f02-e582-4068-add7-b2e15c537e0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705842441, "uuid": "a48867b3-0303-4bd4-8ed2-3a86abd37bce", "value": "384:30bUe5XB4e0XJgONalXCpF7r/RWTltTUFQqzFL1ObbR:cT9Bu9YlQYHbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705842441, "uuid": "be581c89-4016-4e21-a6ca-22b823c13672", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705842441, "uuid": "a4d935c2-52ff-462d-a8bd-11110bfc0c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705842441, "uuid": "9e79886e-3654-422a-8db2-90f4fca6cdb5", "value": "bTdw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62f35f3-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829454, "uuid": "7a5f8e0d-f7c0-4d4a-8ea8-cb0e05fa4312", "comment": "Malware payload", "value": "15629a6423d50072083a558039be73ff", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829454, "uuid": "d7a1325a-f9a7-4d04-aaed-8cfcd84872f0", "comment": "Malware payload", "value": "04b112d574c9e474c0b1e9a5338e16b0348325ddf74ce2eea8702e3d45df45fe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829454, "uuid": "251358a8-5609-4acd-83f9-e043685fd8e2", "comment": "Malware payload", "value": "cb678bf8fdb4494fdbab121631582cbfef3054d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829454, "uuid": "aafb48cf-ce2c-4937-abe2-d7ac06381840", "comment": "Malware payload", "value": "7e36015c877e76bccb2588116d537abdd848d92a80e10369cf4db889b059ddd208a251717198e847324336c4fb2e8887", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829454, "uuid": "ae71b697-4f1e-4664-abaf-c91da154fef3", "value": "T13073F192EE729B48E8C81C35B5FDC79E6DB27CF53E3494BB14A4B719B8B83109712442", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829454, "uuid": "3364cf9f-e53e-45e3-9ebd-e715efd6a73f", "value": "0cbf970c7b2931021b41a9689023109b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829454, "uuid": "2cf9fa41-5f6b-4cc2-aa2b-6ccbb3376ff3", "value": "1536:yTG0PQeS0ZDikqFgzCjeXriOBetvMs6ReUUfalJfYhyN80R15:y60PjhZmH+CjeXrsn6MTTyN8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829454, "uuid": "a7373a90-cd71-4eee-af7e-2509760d86ce", "value": 76824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829454, "uuid": "58ce6e0a-43f1-410b-865c-ab00d5137aad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829454, "uuid": "87c9ddc3-3522-4767-8afa-6063d9e70364", "value": "SecuriteInfo.com.TScope.Malware-Cryptor.SB.14554.18340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2e8d44-b802-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705803288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803288, "uuid": "92f0b03f-9edd-4dde-bd6f-b1c8312c5222", "comment": "Malware payload", "value": "9af0b7ca55fe8970d0259163c88b92ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803288, "uuid": "f0dc9739-6e88-46c3-9eab-66cf63e77332", "comment": "Malware payload", "value": "060e9a06574030b5328a957074e1bb39b3b7fc0744930a377faa03a793d1be98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803288, "uuid": "10692200-0129-4fb7-acab-65ed14d6dd57", "comment": "Malware payload", "value": "d371dc23eb0458afb1490e71d9dab97eb457d8af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803288, "uuid": "b8fc6df6-780e-4f28-ae9b-a73d41d4f81d", "comment": "Malware payload", "value": "182f5a3c40d98b3cc70ab22cf3e18ac4e2fca46085638ca7ab224b9fa58b82570c2e9f876f4ed82a036d9760a1a928bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803288, "uuid": "16c77e0b-98b8-45f6-aeb3-c005db2a279f", "value": "T11F054A4123F88F2BE1EF6B75B4700A1543F9F917A6B2E78F5A44D9A91C53B408E407A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803288, "uuid": "00496136-e608-4f96-a506-8e566353952c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803288, "uuid": "37972ae0-a2ab-40e7-ba69-4ecc6f68dd88", "value": "12288:FBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUxD4:FBjk38WuBcAbwoA/BkjSHXP36RMGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705803288, "uuid": "94cff925-2cd5-44c6-8809-d78dced54ed9", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705803288, "uuid": "7976b2b6-3732-40a1-8650-460245092482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803288, "uuid": "debe1b60-ef65-4479-b905-0eb5ee6311fb", "value": "Windows.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d18c359-b856-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705839048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705839048, "uuid": "e37e2c36-534f-46e9-87e9-d3a248abd6ea", "comment": "Malware payload (RiseProStealer)", "value": "61d615bacda10a2426a6be8f2db666e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705839048, "uuid": "605a1b08-9e7f-436a-a19e-697161ffbcc9", "comment": "Malware payload (RiseProStealer)", "value": "06d9a6a70a11383588175688c430261a4392f03cfefe5f2464388f6adfd43510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705839048, "uuid": "54152864-1e77-42ef-8e95-a087bed7de05", "comment": "Malware payload (RiseProStealer)", "value": "5b64a1ae774d516f0a64d247eb7d1ce85e75baa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705839048, "uuid": "c0c1459a-fc12-4397-8386-62ece2573107", "comment": "Malware payload (RiseProStealer)", "value": "980206c1e36021022e2becb6de1653f9e99e400890863859a581a62a5377376224b8d4a1630bd25f4bcc76e0b029d33c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705839048, "uuid": "fe7c2a1f-dd0c-44f1-ba0b-87a692b09786", "value": "T1191612E17EDD584CF49861B38FF59DB89A1BBCD87626162B2016366FF6337011E0A813", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705839048, "uuid": "cf124326-ba31-4156-b981-fafb8a38d857", "value": "110a9f45d4a7b5222808ebecd21907e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705839048, "uuid": "150c0b2d-a435-4802-90b4-9f38c6840237", "value": "98304:UpF34OiZrq1DfPHNADtV6v++EHqR65e7jp14Pa0/ucmaD9t:Uj34O7NADtV6v+ygk7jpjGuXeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705839048, "uuid": "ec2dab4b-250d-4677-9696-f43ed4c55f2f", "value": 4031488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705839048, "uuid": "a9728827-8ec1-476e-839e-8a8603767076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705839048, "uuid": "5c3ac486-49ce-45cd-9804-7a54afd5058a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1425e710-b85d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1705842040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705842040, "uuid": "367db787-b741-478d-9e75-ea3620891968", "comment": "Malware payload (RecordBreaker)", "value": "c1112f639bf9c9c2999ad48b462a9ca5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705842040, "uuid": "1acd1484-fb84-47e4-ad0c-058c4c0700fa", "comment": "Malware payload (RecordBreaker)", "value": "06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41c132dc6831fb1e68e41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705842040, "uuid": "9446017a-69c2-4b7f-b90e-11c3cc77b8f3", "comment": "Malware payload (RecordBreaker)", "value": "836dd758c3f8627eb1055a6db637f93e1e80f933", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705842040, "uuid": "93371d29-c083-4ed3-ade4-14769cdb49c7", "comment": "Malware payload (RecordBreaker)", "value": "f285e7059b1e502a0fdb4d50ae16eb6a283bde09e76d5c1277d4fa4078e87e42ddd743f8a1b17ab2dfbc9acba24de18f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705842040, "uuid": "c33d1736-c48f-46e2-b5bc-a6223400af0a", "value": "T141F5330566580106FCF8833B6BA1E41646FA1F5BC93389A90FDF3FB4578E15F2626227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705842040, "uuid": "af54a2b8-5010-4e02-b2fe-2b5c4fd9dae0", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705842040, "uuid": "0ca43069-ecca-4392-857d-69c4ed6d68e8", "value": "49152:eszzrLEvk8wpIPv3bhmScqWxZNiUP+3K9C75sRmEUwP3xba9o4:e2LEvk8wgv3bh3cqqNigGrSzUwfZa9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705842040, "uuid": "ffff6cef-c442-455d-b0fa-8a382cbae409", "value": 3467488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705842040, "uuid": "1825c83c-391f-47ec-89f9-b477d32561d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705842040, "uuid": "c6e60a9b-5dbf-408f-b243-24a63423d7b3", "value": "06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88b7427-b833-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1705824331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824331, "uuid": "8feebd86-2de5-4baf-9c66-b476d074c388", "comment": "Malware payload (QuasarRAT)", "value": "b86ba0844db442df61a5889b004e615b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824331, "uuid": "2ec2695a-6a59-44cb-a215-afd171a3a901", "comment": "Malware payload (QuasarRAT)", "value": "0790bb235f27fa3843f086dbdaac314c2c1b857e3b2b94c2777578765a7894a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824331, "uuid": "3cc9ad7c-c220-408f-8a55-fa914ca2d90f", "comment": "Malware payload (QuasarRAT)", "value": "3c6a65bade42081593d651abbda8c5f108be9adb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824331, "uuid": "5adf731d-63ac-44bd-a460-b25c65cb7072", "comment": "Malware payload (QuasarRAT)", "value": "8a260578d4c9eb36cfcfadac3af5632e05a2c5c9b9c63e7b7094dff9cafd6d8cac3c16db14adb85406edd51a8cb4ef83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824331, "uuid": "b5e5eca0-af84-4323-88c5-3f2f25b9210d", "value": "T1CE767D107BE8CA27E1AF53B185F116525BF4F806F352E7DB158C25A91C12380EE267AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824331, "uuid": "11ac7924-bd0d-4a94-ad77-f490b5305dd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824331, "uuid": "1c743b92-726e-4af6-bebf-6574cf1bcc68", "value": "98304:ZRlP3kST9lgfU9PfCvRfj3Ml27OuKr+gvhf2n:nlvk49ifgCpfDvOuK6mk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705824331, "uuid": "78cf1e82-f094-43f3-a5a8-eaf21f33baf5", "value": 7466496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705824331, "uuid": "cc2a8cb2-3bfd-4886-a6a9-ff655378939b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824331, "uuid": "52d07603-27d9-4f5a-a321-e1a840cc78d7", "value": "B86BA0844DB442DF61A5889B004E615B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8a19d6-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829443, "uuid": "127942ce-a1be-4dbc-88b5-70f937f6df88", "comment": "Malware payload", "value": "f0a39446bf76a4f646416c3c8d6ce5c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829443, "uuid": "357c9e27-c149-4e46-a042-4e0a72aabf41", "comment": "Malware payload", "value": "095d4c837d24545cc3aef984a94adcf69861430cb9a9bdd05e7c0e787ee40f69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829443, "uuid": "c2996021-9ed9-4381-a74a-7925811a964f", "comment": "Malware payload", "value": "f86e6355a97dfbe49d39ed54951a244c7c1eed33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829443, "uuid": "1f780182-1e11-4b1d-8679-42b689b3bbe7", "comment": "Malware payload", "value": "35269b5f0b8b9bff3c4747f13066b24b2dbeb3082a93a467b5e1391580bc6b07308802ec74a7d7e06a7f17f630262558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829443, "uuid": "3f1ea863-fddb-4716-8cc8-5033d21b75f1", "value": "T16DB57C06E34384F2CD6702F15597BBBB8E31A6155020C97AF348ED5CEFB39827A5A325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829443, "uuid": "14a02a84-b32f-4eb0-bc35-de26bea1815d", "value": "eb9efc88f92f59826a53aa1a079b2030", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829443, "uuid": "b3484dda-0ae4-472e-9490-a750d2916356", "value": "49152:tZIP02x8qo8ne8FKRNCqZgokQLIEPqYKHJYVPvLdTK9CkRZ:D402x8qo8ne8FKRRWonzPqYvVP49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829443, "uuid": "52eabbf1-2700-49ad-82c5-1c762e07c408", "value": 2398720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829443, "uuid": "18de5ed9-f7da-4197-b515-b20662832133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829443, "uuid": "3cf4deeb-ddfa-47a9-89be-d68ba38ce4da", "value": "SecuriteInfo.com.FileRepMalware.5463.25940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0df222b-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829472, "uuid": "6abc631b-15bd-4acb-a56a-2a5698cb6257", "comment": "Malware payload", "value": "4ebe7a563ecc5747391d35e8ebeb6593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829472, "uuid": "8edb8376-0750-4a6a-9d1f-dc14e9ff9769", "comment": "Malware payload", "value": "0adbd3dae6816f9a1e9b292144452786cbb5aa3f2c059c2772cf3fc4c98519ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829472, "uuid": "caf3ed0c-919c-43d2-83a6-b77a2a2b59cc", "comment": "Malware payload", "value": "cceede6e82865d8e7cee810810f614698985caf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829472, "uuid": "57d6249e-f007-4c91-9521-adc55fbea335", "comment": "Malware payload", "value": "c1622921cdb570a8e96d3c8c15d1fc51373081ed29271244ffe622dfe75f226d65c7646e81fedc64b783769031bc5056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829472, "uuid": "622cd668-554b-495e-b465-b70fca00cf0b", "value": "T14D64CF68B3C2CF06C8A459FBBD15E2D023A5C919C3C6EB42F934D75D2CAB2855ADC05B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829472, "uuid": "4f0a625c-ee58-469b-85bb-937ba9b6ff04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829472, "uuid": "1e3db925-17e9-4789-9d7c-47a7d042ee23", "value": "6144:QZZVSgFbjGGs3psj3CEo2fLC8BwrKRtW4NH9zZaBXyDvaI:SjPGX3I3CuLCewrKRtZNH9z81yDvaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829472, "uuid": "4f71bc45-d67f-4010-9bac-3711f0b8c9d4", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829472, "uuid": "9b05898d-6f3a-4e06-bf47-2251a7bcaad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829472, "uuid": "77f8d030-37df-422e-9396-61fe81f9162c", "value": "SecuriteInfo.com.Trojan.DownLoader9.48637.15340.21704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c67254-b876-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705853129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705853129, "uuid": "93437ca0-8ab5-4071-9234-0826455b897d", "comment": "Malware payload (RemcosRAT)", "value": "f6118a965e44ee55e708edf7adcdc1df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705853129, "uuid": "798855b4-06ec-42d9-9fec-09ef3330fbe8", "comment": "Malware payload (RemcosRAT)", "value": "0af76f2897158bf752b5ee258053215a6de198e8910458c02282c2d4d284add5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705853129, "uuid": "1fcab19d-0a7a-47b8-9ad0-28ca28ab9de1", "comment": "Malware payload (RemcosRAT)", "value": "d5ed640efe39c52ed9a08841837654979f38b384", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705853129, "uuid": "c4604cbd-9faa-4a6f-b3fb-09daef340203", "comment": "Malware payload (RemcosRAT)", "value": "30e321d006964b3e2e750875a702f829cdf25bce1a8ae3f6e2fce9e4b37fc2dc901643933c42d8f2285a3e13b8794abd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705853129, "uuid": "8ebf7a37-513a-4cc2-bc6e-cbf25c8e7016", "value": "T17BB49E01BAD1C072D57524300D3AF776EAB8BD2018364A7B73D61D5BFE31190B62AAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705853129, "uuid": "92905f63-530e-4e5b-9f55-c2f52eaaf175", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705853129, "uuid": "c1267fd0-5fae-4339-b337-d2958d4d1bae", "value": "6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNA5Gv:8X7tPMK8ctGe4Dzl4h2QnuPs/ZsBcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705853129, "uuid": "f36e72da-3f16-40d8-8ace-529d4c1210ef", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705853129, "uuid": "c32b1ab3-0d8c-4dc6-b07a-02888e079533", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705853129, "uuid": "1cd5925a-d0e9-4206-a935-3f61ec96bd1d", "value": "F6118A965E44EE55E708EDF7ADCDC1DF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2caf68-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829435, "uuid": "e1dcacba-3d1c-4c13-b546-51d62e5defbf", "comment": "Malware payload", "value": "b9547a8f96f419b264975b82ac07ba7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829435, "uuid": "4c7198d2-32f1-479f-9f87-a97fdeb2a20d", "comment": "Malware payload", "value": "0b9a0988a78eed73ca889742d24a69bf05cff1b503bfc241147733cdeeec732f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829435, "uuid": "82ae8ad3-e3df-4ccc-88b3-75dea64d229f", "comment": "Malware payload", "value": "550471d1ffd866d95d811e750be6ed6b3d949c59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829435, "uuid": "87b2a295-7db3-4fb2-89b9-8fc1660d9f4e", "comment": "Malware payload", "value": "0b4a9ed8023add5db8983604f0e0780bb26dc43a1ed26fc3e5f7607c92cee9b332b941e6a10ced8df2c6d416a744b888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829435, "uuid": "f09175cb-d31d-4d2c-925c-4b5c0e4b947e", "value": "T12FA5E142F7D681F3E12B503084776B3AD536ED936F128A83B364FDAD4D33391A56221A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829435, "uuid": "3f488766-5d45-4cc4-a56d-db1d350f889d", "value": "9ef686e15eb2ff9c539aac3e328ddf1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829435, "uuid": "21a4c193-0c3b-4588-89f4-27b281441ea7", "value": "49152:NzaWwBgaNeX9Ki7+s8KuqGaX0ToIBAUZLYrLm:haWKga4XUfJBAUZL6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829435, "uuid": "9e7cd825-185a-4467-973d-0a2cfeaa7ac1", "value": 2088960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829435, "uuid": "454e96bc-814a-44a6-8f78-0f398c70aed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829435, "uuid": "b9fcfaae-72a3-4829-b374-ce940f093d3f", "value": "SecuriteInfo.com.Trojan.DownLoader11.11699.1437.26678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c844d7e9-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829457, "uuid": "320ad3bc-9e05-4840-84d8-e4e217531249", "comment": "Malware payload", "value": "6fe332d85e806dd095b1297e7e6c6756", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829457, "uuid": "d8e3460b-6fb9-4f88-a179-4e081ea7e567", "comment": "Malware payload", "value": "0bb5b64906b685aba4b1c3c6cdce3b05a00bcce44b19ef076d77a4011371d13a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829457, "uuid": "8ddd59e2-dc4c-47d9-919e-b3d1a87bbf62", "comment": "Malware payload", "value": "e1822ee2cfd95bec97649eb2bb531932f1549a8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829457, "uuid": "f3e6e81e-8518-45d5-a5ed-b1d47f9cc2c9", "comment": "Malware payload", "value": "b26b6907d035d8b69f9a88bb5d4516f8deefe52f5299977646bd552e7dcb09f4e41397dcfc41ab13116664d549710ba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829457, "uuid": "f1008e89-e87b-48af-85b2-9ccfc08b15ee", "value": "T178760185F9FBF0B4DD56C17C8DB9D9366A20FECC4B117ACB1248FE285936A8113221D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829457, "uuid": "cb29b999-4b28-4d72-aeb4-2e57f781469a", "value": "b9d7280765df1af2868eda734d18dce5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829457, "uuid": "43cb4891-3e5c-4b78-af97-57161b8c6035", "value": "98304:uCvdf0ZZo8AMzLtoG3nTDwytnWGbUhDrimsoPG8SbpCafKa+rci209NIkwi+SRew:up4t7PGfpCCvmNIHi+0zgYmFtzl54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829457, "uuid": "c9188231-6cd3-4674-88e9-01419e566e42", "value": 7278860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829457, "uuid": "3dbbe122-a14e-435f-803f-e520ec6910d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829457, "uuid": "5d25b64a-3486-47e9-ba7a-caef317752da", "value": "SecuriteInfo.com.Win32.Adware.VrBrothers.C.6847.29627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3cc208-b882-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705858051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858051, "uuid": "fccbb984-7319-4ad5-9e80-4ef7dbd3ec4d", "comment": "Malware payload (Mirai)", "value": "0004ced9391e3781445ae0af0037228c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858051, "uuid": "78d913af-b0e2-4a3c-b1be-322dc4565270", "comment": "Malware payload (Mirai)", "value": "0fb7214a01ed667cebcb634823ff30e56bf38121df130c0b486761f4e5a39acb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858051, "uuid": "45ce777f-a328-471f-a954-ea23551eeac2", "comment": "Malware payload (Mirai)", "value": "a00e7b1f5bc95b4bda832e2c1c202ba1c60e5ab7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858051, "uuid": "527242f2-d62c-42eb-ae0a-120c8dcce974", "comment": "Malware payload (Mirai)", "value": "cc154cd57039666a26388df1eb337eeb88ad85b69f484ade75dee4635596ec883a3d31518fff86919e11abd5218322bb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858051, "uuid": "6a879824-2d47-4e17-894b-c552c0ea9653", "value": "T10DF32B46A7408A13C0D22779BAEB42553323DB64D3EB73059928BFF43F8679E4E27605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858051, "uuid": "0927ea4b-0c2a-489d-99b7-1f38bd8ca514", "value": "3072:vlW9dqO9EwOa2ypNnXQIW2SVPUWKTlbNRsM/9IEjI/:vl0dqIjOa2ypNXQwSxTKlbNWM/9IEjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705858051, "uuid": "82786e43-67c4-4936-897b-12125d39f8ff", "value": 158139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705858051, "uuid": "aa44070c-4dc7-44a2-a1f8-433efe0ecad1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858051, "uuid": "627c94b3-e8e8-4c84-af3e-5ac42441c19b", "value": "arm7.nn-20240121-1727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0b0b41-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829467, "uuid": "8c31775f-45ed-499d-a564-93f46a67e746", "comment": "Malware payload", "value": "b315a2c3b752e189b2b2ee39e3d738d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829467, "uuid": "882d2574-6bfd-48a1-bf20-0862202f27ce", "comment": "Malware payload", "value": "131c08ef330ae074e19bd12a8c926971a0e9ed989edf3700ba670f710093def4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829467, "uuid": "b2ad4dcc-71fb-4024-b62e-ee3194245b18", "comment": "Malware payload", "value": "d1f247f93e5a9f53f86e909587df7c4136ebc566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829467, "uuid": "b59ac3a8-20bc-441c-8229-a140b6aa6689", "comment": "Malware payload", "value": "19c105be8fd46547e37458ad7db96e4a204f80f2b2c5c275645d25d470ecc5e692ac92b1de7919547b96868e4f21b60c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829467, "uuid": "da04d06e-2c41-4687-b0b5-5d733c2f2a27", "value": "T168046C45A0C24B1BC2A64B75C53F5E9DA42FFD103C3AA44FACD88E09973D6207598DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829467, "uuid": "4dac8c7a-d6db-4b7d-ae04-b9d0cb7f3c6b", "value": "3072:JkyT/vTES0g0mrl/rWS3O4NTr5d9BrncKdEJZbQhzIZcYb5JAiRq31PxWsM7qSZ+:JkyT/vTES0g0mrl/Ze4B5j2KyshOFT2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829467, "uuid": "21d244b3-1159-46cb-8fe8-931cd0e702cf", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829467, "uuid": "493181ed-a569-4b74-b9f7-70ecf3744aff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829467, "uuid": "852d44dc-4d06-4eaf-b017-d3e028dbe57b", "value": "SecuriteInfo.com.Win32.Evo-gen.6937.25477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90836c61-b885-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1705859428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705859428, "uuid": "e0feaf4b-2773-440c-944d-5e32288c6240", "comment": "Malware payload (AveMariaRAT)", "value": "bac1beef11c340ae6632b50d2ce1fb80", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705859428, "uuid": "2601d270-557a-4a28-a389-9d7b8e208084", "comment": "Malware payload (AveMariaRAT)", "value": "13a1de911837a6848b57e4e794892372e0d19339448f9075958e21c1071cf310", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705859428, "uuid": "d3d5b301-1b7b-44c3-80e9-8c63571eecdf", "comment": "Malware payload (AveMariaRAT)", "value": "eed74625db691bb0d498afec7b5b376e83bf5ff1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705859428, "uuid": "87cd2ddf-583c-4352-8961-cef6ff7766a2", "comment": "Malware payload (AveMariaRAT)", "value": "466823b37efcd909e058baddf08532cdacd47a12aa868babfb9240fa7adbd89678379ee66fc8e2f012ed8c0becb68172", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705859428, "uuid": "df764fa6-461d-45b4-9e7a-ada24f93fccd", "value": "T1F6C423816790DFE1C8752F7628AB9B6103730629CFA2D7A90D949DDF0331294ADC3B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705859428, "uuid": "9b23b860-5f51-4d4f-a19f-288d61558966", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705859428, "uuid": "13dfb831-fb89-48ff-925c-eb458b51ff38", "value": "12288:XePFLVoq3FMItDhVug2npXPCqCAVzDU17u+vpBze+kkNSLy5eZ870W:XePRVoMFMIt/+FxM7le+3NJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705859428, "uuid": "59500494-8ef7-44de-a3f4-a66d3bd174e4", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705859428, "uuid": "748dc67b-172c-441e-8432-cad9e4b6d347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705859428, "uuid": "9d0869bb-3903-48e2-858b-15f18f9a1ac9", "value": "BAC1BEEF11C340AE6632B50D2CE1FB80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9d365c-b89d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705869626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869626, "uuid": "fc9aff88-d43d-4c44-8a94-34fe47fd7f74", "comment": "Malware payload (DCRat)", "value": "040b32c8ee811985eed4bd068d536b69", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869626, "uuid": "33960cac-6182-412f-b10d-9df98e76a34c", "comment": "Malware payload (DCRat)", "value": "17154764e83a28a94dd2d6d0250d641c9e1284ecd7b6def2302f640728bdc102", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869626, "uuid": "10150b00-be33-484d-a99e-e209184dc021", "comment": "Malware payload (DCRat)", "value": "1d0336e8f35860f03f68e0ddcbfb9041b3fd8073", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869626, "uuid": "1c389087-d888-4a8b-8604-0f723d993df0", "comment": "Malware payload (DCRat)", "value": "3fb8aa5f5d2a8661851987cf137306ed1dc5f8f744fbadc87ac20d78c42872245f874164c532b619140f0abc3428010b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869626, "uuid": "00bcc977-f409-43eb-99d9-aadabab7e5f9", "value": "T153759D417E44CE01F0191A33C2EF55588BB0A85166EAE32B7DBA336F65123A77C0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869626, "uuid": "d64a3f6f-0b3f-4810-b7e9-fc5b87432895", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869626, "uuid": "c7a4f411-d570-4ca2-9c91-49131876061c", "value": "24576:keaMajUi+6C+mDjn7gbkFaSH7Wu4mIWGE1Sy/fBEXTHhaTEEER71RM4I13:keaj9bHmMbkBHVdGE1Sy/ujhaIh+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869626, "uuid": "51b97134-a7e3-48fe-9394-ee82d901cf95", "value": 1601024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869626, "uuid": "58dc2190-ebab-4f3f-a116-494e1ec73c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869626, "uuid": "54117e2c-2a56-4b91-bbff-ad6ed87ceee0", "value": "kelYmkKnxLKe9GwpHrGedCl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed46d29-b879-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1705854325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854325, "uuid": "d90358b5-ef18-4f97-a56c-2d48c7fe2208", "comment": "Malware payload (RecordBreaker)", "value": "f80fd5edf505c1f763dee9f092f58e8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854325, "uuid": "9746ace0-84e5-4bf5-a4c0-fc4c32dfaee9", "comment": "Malware payload (RecordBreaker)", "value": "1787a87f208cd0898943bd70e7e76a2c8b1b39679b20a6ac57d13ff98fd72aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854325, "uuid": "f0ce1a6a-d5ff-4342-b27e-a98bbd1b7559", "comment": "Malware payload (RecordBreaker)", "value": "0b609d4a999959868c5fd1c6e4aba53bf9746f2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854325, "uuid": "dedc7856-6b54-4651-a271-a7799a9b05d8", "comment": "Malware payload (RecordBreaker)", "value": "ea59f23c70fd79eda356e06c7944f942bc6d0838fea785564ee97ed945a3609e8ca177f329cbcab894823ba548bf6723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854325, "uuid": "b680fc53-c9cb-49e1-b225-ae6e55470ac9", "value": "T16775BF3FF268A13EC5AA1B3245738320997BBA51B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854325, "uuid": "f50a6082-dc96-4e65-a6ae-2641c1136f60", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854325, "uuid": "a2196f9e-92b9-4e1e-bedd-06fe057b43d5", "value": "24576:s7FUDowAyrTVE3U5F/H6Kic6QL3E2vVsjECUAQT45deRV9R4:sBuZrEUeKIy029s4C1eH9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705854325, "uuid": "53b1cc71-943b-46f7-a3da-e93076a28824", "value": 1672138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705854325, "uuid": "04869cb9-6b48-4680-b9c9-c89135a7f27d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854325, "uuid": "e58cecce-c3c1-4e48-8e69-560969c513ad", "value": "1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ae0a75-b83c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705828010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828010, "uuid": "ad0c4040-87c7-422b-be17-86f587166af8", "comment": "Malware payload", "value": "e4db12031f1938387633d1d75ed3a9d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828010, "uuid": "86acccb8-e801-4679-9ebf-6350be82cc17", "comment": "Malware payload", "value": "185b8698c785ca6baa66887edb36057816345af75d8231f207b54d486f60e2ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828010, "uuid": "8335a847-5076-49d4-9a27-a6b1499b675a", "comment": "Malware payload", "value": "0c1414b1a4b5c48f1480ff73ef56a226fcc69c46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828010, "uuid": "48b3e585-bcfd-4366-85b8-7ba35793c6aa", "comment": "Malware payload", "value": "ce7b4ad0cd63f5f5acf84245c2d2f891642d020c1d036c010f6c295eac8bbdeb804339cdd3d64756288c0d6ed06437b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828010, "uuid": "d67aaa88-a0ac-4f2b-97b2-2a5ee1059484", "value": "T14C159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828010, "uuid": "a6af0f12-3735-4c11-8502-8e37086a6cff", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828010, "uuid": "5fa90051-d6c0-44f9-97ac-44120dd63d4b", "value": "12288:0qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga6Tn:0qDEvCTbMWu7rQYlBQcBiT6rprG8aKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705828010, "uuid": "b843acc6-49b0-4c21-975d-acf06e4acab7", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705828010, "uuid": "6df13480-5fbf-4c5f-a15a-431408d5d860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828010, "uuid": "cc49bf20-a476-4679-bebe-712b52126ae1", "value": "e4db12031f1938387633d1d75ed3a9d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccad0ca8-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Riskware.Generic)", "timestamp": 1705829465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829465, "uuid": "084084af-6d13-4830-bf60-fd62e1c145e5", "comment": "Malware payload (Riskware.Generic)", "value": "fbf5adfbf8b5e76d0fd85683be84643e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829465, "uuid": "79f775ea-9aff-4401-949f-f45cafab4f03", "comment": "Malware payload (Riskware.Generic)", "value": "1a227e3fff13bc1fa81952c8332a6709becb2910cb9c68219eb038c928ee57e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829465, "uuid": "eb45d847-f062-4e7a-98a3-0d21da0a74d6", "comment": "Malware payload (Riskware.Generic)", "value": "a9aa660fa03b0044c6621509c08bbb9693292611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829465, "uuid": "98fd74a9-10de-416d-8f11-8cb039083b02", "comment": "Malware payload (Riskware.Generic)", "value": "109be62739c0d4f4b55c9db6b76681550cc9808a4cd50f3d3d6b89b07ec9abf1a3da11ddfdc04096013bf3da919a8732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829465, "uuid": "0b6e1d4c-6c1a-4bd1-9ffd-96236ef642ba", "value": "T16695BE01F7C28562E63A5730887A2B36952ADD156F35CA8FB368FE9D2F333D1453211A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829465, "uuid": "b853ab57-3c9c-4bc9-b916-67366debbd78", "value": "a5ed0eb301a985b232b4f4db4a6597d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829465, "uuid": "7daeaab6-31ee-4b56-80c5-330fd5a4777a", "value": "49152:tt6QlEUYxFugcEiv8E+s8KuqGaX0ToIBAUZLY3it:KQlDSPcEivoJBAUZLwit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829465, "uuid": "0934a75c-47eb-44a8-9f78-ec3e8146384f", "value": 2031616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829465, "uuid": "880f225c-7d7d-440e-abd9-3fe60dfddf9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829465, "uuid": "8f947492-60c3-456d-9719-11cdaf91cd43", "value": "SecuriteInfo.com.FileRepMalware.14481.12615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb25d552-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829462, "uuid": "9a46f7ec-bdda-4ec6-a5b3-6aa15702580b", "comment": "Malware payload", "value": "d41cbfcdc322803cf628ed5d9da31087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829462, "uuid": "a7d83883-e7c2-4cec-9ce9-6cd972f356d4", "comment": "Malware payload", "value": "1a822332d2dac141f44750fec0094e073304d920f34afe52e46cc25c021e185f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829462, "uuid": "de541585-a707-488b-acb3-3b234566bca8", "comment": "Malware payload", "value": "28c024ba20c8641fb52039d57ac2584ebcaa7542", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829462, "uuid": "5ab74057-6fe5-4662-95d0-dd8d3ba4cf41", "comment": "Malware payload", "value": "80516eac6c32578a4fc1cba958fcfbba5be68e5f4ddef488ef9a5adf37dfec13eb9def5ef61ac78adb89ee58b1828f2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829462, "uuid": "c217c580-4f9c-49f8-9b98-f3fa52e0598c", "value": "T16FE47C12B9F390B5E63C25F009BA6776EB758B160B25CFC39360EE6C1D732809537266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829462, "uuid": "4d724f86-3aa4-42f0-a79b-6a6d3187d717", "value": "12288:REhgcJsV9laWG5zNauJH4eXx48/dgvkGdCol:R7l9UWYzNHpX2lnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829462, "uuid": "63b2fd8b-7b45-478a-bd47-d999842baabd", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829462, "uuid": "49236b8b-7d6e-4060-bf9f-7303d957e89b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829462, "uuid": "c77a6d80-1ad8-4673-8283-c6860ad356ae", "value": "SecuriteInfo.com.Win32.Application.PSE.1OV7PVV.19236.13479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992c17b2-b83a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705827231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827231, "uuid": "e5c7494d-cd85-4c8c-b295-fe482b9486a5", "comment": "Malware payload", "value": "dfd4e237e392ad81f9b82df06115b612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827231, "uuid": "b1ef5bb1-963f-490c-bc22-5e69d4287102", "comment": "Malware payload", "value": "1d36124c4e9ca7cbd806d3f816c07b557878dab79378e5b5ef9f94bb131a20d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827231, "uuid": "35db7ee8-ccd6-4098-98c1-8600e2a6f094", "comment": "Malware payload", "value": "6f8b31e79e052328291abf7c3a0e9cb474f0d2a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827231, "uuid": "b8af595e-9945-47d2-82d9-a5cb39ef6de2", "comment": "Malware payload", "value": "0228e7f1273ef6c526b0a03dda338ec42b3571398a3e69c28f5d5c5a74e408733f3849060359582ef1e869a8da3a8d8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827231, "uuid": "090d6ce9-0564-4706-803b-2e7a23542158", "value": "T140F5223A558018F6C26A753C4CA7891CDEB7BC08EFB11ACE0B617D5A09F9941B13877B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827231, "uuid": "27cfcc53-f378-4e5b-a0b9-6cdae82ffa16", "value": "9ad2bb9e338165abd55969dfca4c3b1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827231, "uuid": "247cecb0-d216-46e2-900a-7ee5d9113ba3", "value": "98304:TX0ZTtpY/OHGaZkcLuf/cZLTmGN/GZvqmfF/nEDpr4:TX0ZE/OHIVfUxTf2vqm9/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827231, "uuid": "037f038a-b593-4c55-9d14-0c07ab4b356a", "value": 3547136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827231, "uuid": "fe72bf06-261e-4993-a733-aa9729ef9a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827231, "uuid": "61890aae-4af8-4741-984c-223f342abbe0", "value": "dfd4e237e392ad81f9b82df06115b612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6675f51a-b8a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705873102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873102, "uuid": "bc272fd6-2d22-4902-a33d-6431d4b9ca8e", "comment": "Malware payload (Smoke Loader)", "value": "d7eb93b2a91b8ffee46a4a7d2e9dd232", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873102, "uuid": "230c8ab6-66e3-4f99-bfbf-bdecfe56b2fc", "comment": "Malware payload (Smoke Loader)", "value": "1de489805895c5c666547d588f1d762dbc28b6be48002b99e3404957ecf8fc08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873102, "uuid": "0a05ff1c-bf30-4e76-b95b-db12c2f5168b", "comment": "Malware payload (Smoke Loader)", "value": "66a5a5f393a5e5b6ab818ccc54df43dc0f27f3cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873102, "uuid": "419a6a04-3b4f-4d1c-9159-3ba1c36605d0", "comment": "Malware payload (Smoke Loader)", "value": "47f78a06e40a97fb10db84f9fc6995c48ddb782d7b58c9bb2e47e26cd760fb17734b2d66811d95b493ba3bcbffa63f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873102, "uuid": "382c1801-fffb-4dcd-8875-1c15a89bf4cb", "value": "T190247C103AF9C031F3F7A63146B4D7A50EBB7C936A71559E0A97E37A1F34682866031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873102, "uuid": "ccbad693-a443-497e-9943-d3de84648008", "value": "cb42cdcfc60d1d7d29fcef2a22a6efc8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873102, "uuid": "a8776987-991a-4d5f-bf29-d995b63c5bec", "value": "3072:P4MkECL7mTfhjJXcPHVFVEFxwWozt6pdtm6x85wpTygMXEfYw:P4T73c2FVEit646x85qygMXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705873102, "uuid": "9db8afd3-896e-4882-8468-0eceec6cdee1", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705873102, "uuid": "84fbb197-eb09-4bc7-af81-90321c8457d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873102, "uuid": "ff89c337-7459-41b5-bdc8-847435a63f78", "value": "SecuriteInfo.com.Trojan.Siggen24.36475.980.31143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2039c9b-b89d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705869793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869793, "uuid": "e107233f-3544-4cfe-8d2a-4a864dd5043d", "comment": "Malware payload (njrat)", "value": "0d692c15bec7a59a4fc336efb74ec898", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869793, "uuid": "ee6c579a-2019-4d3d-89e4-97141a282fd7", "comment": "Malware payload (njrat)", "value": "1e9bf2f7d2e70e7c968172ef2a9b38ed480d349d59516afe8d2eaf4ad5df4af7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869793, "uuid": "4243b6c0-6ef1-4605-aa39-ba7852c3e626", "comment": "Malware payload (njrat)", "value": "2909f371ec5860ea74d47ba9c1205f985a15b026", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869793, "uuid": "e31498ac-142d-4056-91ec-7dee3319fd17", "comment": "Malware payload (njrat)", "value": "e3e2a178acbf9abaae183121c2a09872cce18432102d2df8568195931931e0ad3ffd528bc10fdb226ed14f8d9e1c61f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869793, "uuid": "46ecef53-39bf-4712-b13b-5baf2ad495ae", "value": "T192032A4D7FE18168D5FD067B05B2D412077AE04B6E23D90E8EF664AA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869793, "uuid": "9cda84eb-484e-48ca-9798-f26889ed444c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869793, "uuid": "bb198a5b-a45a-4b57-83a7-68ea3dafd76c", "value": "384:heSvEiTbTvpWNcZ0y8fvCv3v3cLkacparAF+rMRTyN/0L+EcoinblneHQM3epzXq:US7TZ38fvCv3E1cQrM+rMRa8Numft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869793, "uuid": "e0251656-05fe-4eca-a2fc-6eeba45fc8fb", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869793, "uuid": "37fc597f-4dda-4994-a40d-6bea3c6921fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869793, "uuid": "30b9c7d8-606f-473b-a9f7-d4b392fa780b", "value": "1e9bf2f7d2e70e7c968172ef2a9b38ed480d349d59516afe8d2eaf4ad5df4af7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a0a879-b8b6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705880326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705880326, "uuid": "5d0c1bb8-1a2c-47ed-9dfc-843797e1fe5a", "comment": "Malware payload", "value": "c6ffdab02a1ea6fc91e6fc16f872aca4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705880326, "uuid": "95b55c27-fd5f-4b1b-8c71-4cc822b503a5", "comment": "Malware payload", "value": "1ee42933c211a851209fbb098d56215eba5785c745608c5863bafa5d417eeaf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705880326, "uuid": "de59026b-b9b0-417a-98fd-6e74504175ca", "comment": "Malware payload", "value": "e9c5771c6a9c7c93dbb25dfc608f1baae23f01e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705880326, "uuid": "18a766eb-b834-4cc2-b115-647ce6fb1137", "comment": "Malware payload", "value": "225fb963c9c3202cdf587ee00cb6f76fbfd28f4eb8dfe01177d6a547b95ef4f14f2729fcf5c19d5c4a93697990d366c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705880326, "uuid": "644f8938-9323-474b-982a-0c9e56a840f2", "value": "T177532B09B78B9220CA360A7880F3D45513F1A7DB2573DB4E398492CE5E237E6C99375E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705880326, "uuid": "9f48de27-806d-4f54-a197-65ebd1205ae1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705880326, "uuid": "9dadbe80-31d2-47c4-bcbb-0d333bc67d49", "value": "768:XPwB8/1Q1y8cfJ6zL6HAO7QnD5P8S8g71MrP4cfvV+bi7ND0pKDU0bkVvm82fXu:/IKUrxaQnD98S8g7svFLD0pW3yvmLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705880326, "uuid": "7bcc30bb-0b57-420d-9de2-0283421e6ac8", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705880326, "uuid": "f8410939-2cdd-4e82-bea8-06a084953233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705880326, "uuid": "88ec3303-aa18-43e4-a7c9-f3a937455e8b", "value": "SecuriteInfo.com.Win32.WiperX-gen.29619.29445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06456ec-b801-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705802842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802842, "uuid": "f136777a-7fd0-464c-a1b7-ad201c21d83d", "comment": "Malware payload (njrat)", "value": "f62a5c582f3896bb69a0466a063ce6f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802842, "uuid": "3cb8e181-caf9-4c5c-b01b-8c73db9a4c7d", "comment": "Malware payload (njrat)", "value": "1f3588fe796c5ff8e958d0f5fe425fbc84854785c94860c6bd904d09dd8597ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802842, "uuid": "af0e043b-87b4-4bf2-abbd-4f37194c795e", "comment": "Malware payload (njrat)", "value": "9f7ccb0412936d8b37f1f3f4d66c17fea9eb52b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802842, "uuid": "21b6c9ac-2ce2-4caf-9ddf-6e58bf2e3c93", "comment": "Malware payload (njrat)", "value": "14d868b1502b3138222d76676dd7e8a93c032a14347c07d9ae5e6ee0bbd4ebe1003e8f904aaadfbd5c11a75efc2b3d5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802842, "uuid": "3bfdbf77-e5aa-41ec-9b5d-550988a40434", "value": "T16DC2195D3B908166C2EF2BB006B2DB2502F2E10B5A17EB5F4CD844FA6B773C14D819E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802842, "uuid": "93570fb0-4cd9-4dc6-93c2-b90117ecb3b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802842, "uuid": "079f8acb-1fba-49ca-8f91-50f43e314105", "value": "384:JLd6cufEYAA/XgWeyoHzCYe/iBY2OzRLTm3yilqr63+bbtVvGD:5l8AA/6T5e/gsE2VvGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705802842, "uuid": "56010834-8864-4711-90bb-2016d5165b94", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705802842, "uuid": "12ca99e4-2344-4fa6-9bfb-4637c407518c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802842, "uuid": "1ceb75fc-6c20-4279-87a8-94c4f943fdba", "value": "bTdd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0296500-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829470, "uuid": "c053ae7c-454c-4cbd-add7-cdbda9b2badd", "comment": "Malware payload", "value": "dbd79147b1db56d056ac8f420d1819d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829470, "uuid": "7e431f54-ea2d-43fd-bf4d-0cf5940430c1", "comment": "Malware payload", "value": "1f5f2c2f1618340817c8018a7dc68b02ec82a5996f6f0974fab41c37e11bdfcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829470, "uuid": "aaa509e5-4439-4f5a-912a-06cc35bbed77", "comment": "Malware payload", "value": "b7638975e6b474632cb1cd4e181ffc1740ca81f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829470, "uuid": "39194ebe-dc2c-4092-83c0-8fb5297462a5", "comment": "Malware payload", "value": "d8fe0ab9b8824d32ca82ccc1a0d06e11910b6203297e238bcbed54a63a114dfa50803b0457927c360f14ee3e7069fe12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829470, "uuid": "884372d7-bad7-4671-834c-3074187d8fb2", "value": "T1FFA3AD1037D8C62CC36A477064F2E3793638A643F96ACB0E89D05D8F7873B425D5A6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829470, "uuid": "a2bc32fb-aa80-45d9-832f-033e8f4821e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829470, "uuid": "17f8a006-7bb6-4035-a095-95a12718da54", "value": "1536:XprQBfC3X+X5OXakSLoZHJqtBy3dbstGhUtjGtv4n4PZHJqtBy3dbIZHVNtB83dM:Xpr/3uJOXaatktGeGcGttktG6tXtYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829470, "uuid": "bbb5d749-b282-429c-8989-09ff87725960", "value": 103936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829470, "uuid": "3b5edcae-3003-4450-ac11-273e273ea702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829470, "uuid": "5bae8630-72da-4842-8064-da97724cffb8", "value": "SecuriteInfo.com.Trojan-Downloader.Win32.Agent.xycgqm.15791.27332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d1ccef-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829425, "uuid": "17b0168d-bd4f-4f2c-8f1b-f2d535fc9ef2", "comment": "Malware payload", "value": "047d1bb28995fb615844c24d3a2cf8b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829425, "uuid": "cf2cd3df-87cf-4118-8b63-1725cb9b5812", "comment": "Malware payload", "value": "20ed2f367ee3f0795d98518213157940830db4d22d8ebd4a1423760521851f67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829425, "uuid": "df88d224-beb4-4256-90d0-765866624cb5", "comment": "Malware payload", "value": "6ebdf64348fd47bdf1edcd16a7a812271d371250", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829425, "uuid": "c17da12e-d8c1-4097-b7f4-676b852f695d", "comment": "Malware payload", "value": "3d713cdeebe6968e6e18d6acefd39407638bd8c3d9f149d08c34228c51f6e1742bb214f49215be79142297e345fcf297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829425, "uuid": "43137783-ce35-47a0-8630-ce4322f10ba8", "value": "T17C340803B341C12EF2990E3395B6CA60D976BC367D35D54B6209768F1AF03826979F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829425, "uuid": "8af6e69a-dded-41d7-9d03-085451360763", "value": "058a8c5b38c5e253b14b288f5a4aa3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829425, "uuid": "7aea4875-a151-48f9-8c84-918e98cc968c", "value": "3072:0au4sgm5xhby5JTZQu4epojdkYv55RCezn/T81B+ySRdL:074sTvheLTbP85RCezbwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829425, "uuid": "cc8cb205-0319-4a91-b824-543d83863f58", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829425, "uuid": "78696941-c53b-4f3b-b35a-0fb030690d05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829425, "uuid": "59860103-a719-4d83-b89c-2ce985ab4410", "value": "SecuriteInfo.com.Win32.Malware-gen.22432.4586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b492d1-b835-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705825183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825183, "uuid": "6379613d-4c0c-41f1-bc7f-f802c906ce6e", "comment": "Malware payload (Mirai)", "value": "8a1f61868451a6bfcac35c7deaf2b8d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825183, "uuid": "9fbe22bc-c821-4d08-8ebc-f896ebd4eea7", "comment": "Malware payload (Mirai)", "value": "22368e0c318aa6c9c68804326debd8b5789ab3fb5aa0ce28f10e0cba3c24d534", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825183, "uuid": "2fbd2cee-70ae-4625-bb8b-fbbb3e0de1b3", "comment": "Malware payload (Mirai)", "value": "cd7196f9b8da63c1499b4ed4b092626f97072f28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825183, "uuid": "1dbe676c-fdcd-4543-b0a3-e271ecba5e6b", "comment": "Malware payload (Mirai)", "value": "7e14772f4b0dfb6a4be53231c41cd5a07b65226c9dbe0a77168cdb0e216da8ab41b3217d3803464f96d68ed981635f10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825183, "uuid": "4588a8d1-248b-4898-9756-b15209accfa0", "value": "T1A0839316BF601FF7EC9ACC338AA91705289D611E31A93B75B930D428F25B25F15E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825183, "uuid": "7c8ce6a0-9e7d-4f1f-a16b-fe4cab97e3a6", "value": "1536:bw4pjQLOQ2GTZHslkJGAopJpPok9Z5ztywd42+B:bw4pjWQAFslok95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705825183, "uuid": "13af721a-0bb8-44e4-8474-0ece8d76cdb2", "value": 84172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705825183, "uuid": "61e13127-cb07-4b44-8c85-582f31b33f59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825183, "uuid": "9273c1a5-ef67-4940-aa50-9d2ca793ec2e", "value": "8a1f61868451a6bfcac35c7deaf2b8d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1861d06-b835-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705825205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825205, "uuid": "045c1d2f-2794-48ff-988a-f9e859db36bb", "comment": "Malware payload (Mirai)", "value": "e04dcb48ab322b9e07c8f2f2f0726ee4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825205, "uuid": "e684c645-e576-4218-bcd0-d379f5e54fb7", "comment": "Malware payload (Mirai)", "value": "22e01998bd717d0506eda8dec5f79542bac1e3afaa88bc31814230e257d65d69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825205, "uuid": "5b55c886-e809-469a-a710-0485f5ccb01f", "comment": "Malware payload (Mirai)", "value": "bac8d982072ed5c18ad1a7ba9fe19207d9710da2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825205, "uuid": "807f7214-d329-4c7e-885a-1a2aca664df7", "comment": "Malware payload (Mirai)", "value": "a44fec83f13b9578a15556dfa4d763814f3cec548ccc38ecf9bc2210dc50b4449f5fb2aac45454b0d9640ffe7389ba58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825205, "uuid": "319a9468-cb04-48a4-b94c-e7c069e56ac5", "value": "T11A438E36C47FADA8C5858638A42149741F63F50882A7AFFA9BC587645047FFCF6083E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825205, "uuid": "6cf2ca1b-7079-40ea-8bd0-d8b4839fc439", "value": "1536:rHdIcHE2ZwtdW4KWjUKbq9V9R3qLw2h5CwLd42+:rHFHE2Znnz9ZqLw2h5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705825205, "uuid": "e078b62b-34c3-4d51-b6fd-758c69293729", "value": 55212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705825205, "uuid": "566eb205-8989-465b-b0db-5be6df4218ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825205, "uuid": "cb27f056-fb5e-4ade-ab85-2c9ff11cdc65", "value": "e04dcb48ab322b9e07c8f2f2f0726ee4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258d63e5-b892-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CryptBot)", "timestamp": 1705864832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705864832, "uuid": "8e5b5276-b2dd-4ce0-9152-cc35d94f3696", "comment": "Malware payload (CryptBot)", "value": "43a8636f8748675fb63d026bae9c73b3", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705864832, "uuid": "bccdef1b-c402-413e-b31e-ed480f36fdac", "comment": "Malware payload (CryptBot)", "value": "24fca3cd8aad055b2284fdf5c0cd73642b88bb19de7c3137361e46529da5b67f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705864832, "uuid": "51eb61c0-13e5-4c43-80fb-e25a500e8b6a", "comment": "Malware payload (CryptBot)", "value": "e9f2c0a7e105fe35d3bf72b2cd014d32476e0780", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705864832, "uuid": "48ab01e8-01b8-4c6f-85dc-e1beeca35169", "comment": "Malware payload (CryptBot)", "value": "b81d443c83935b26666e4e4cf64cc1bbbfd343306aa5e3767bb41c462c5ebccd611f2740db1bbb92e1b26482ea3b303c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705864832, "uuid": "c7166934-6cbf-44e1-a223-78583b5d0039", "value": "T15686CE30D0356E27D84311B8E20513005A8B1A8A6B6B52357AF96C67E3BD46F2FDDF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705864832, "uuid": "59ad6d7b-0fe0-4a52-b6bf-6cb0b8146f4a", "value": "d57093b1df31c39974f3f351924783cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705864832, "uuid": "fafbd062-9d99-4ce0-98ff-24275fe0ed5b", "value": "98304:nVEhTEPMnmpIOHOdMJ7/nATC4K7XsWkkjaHjTo82Pb0cM:nKqPo5MJzATC4C8Wfsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705864832, "uuid": "58ceb414-c79a-4cd4-b946-804790ab9e5e", "value": 7837696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705864832, "uuid": "f79f8f12-d6dd-4da6-a9df-6057f9640d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705864832, "uuid": "4eda8ddb-1e3b-455d-9140-978dbff33bfc", "value": "24FCA3CD8AAD055B2284FDF5C0CD73642B88BB19DE7C3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830e5101-b8ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705876586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876586, "uuid": "d79a4ad5-21d7-4811-b46d-4fd5cada83ea", "comment": "Malware payload", "value": "3e5dbf947ddaf226770942d1b6ad7130", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876586, "uuid": "f9d49c19-58a3-4794-8cd2-3c1d94fd45c4", "comment": "Malware payload", "value": "278aaf3aa0e3fe7e72894bd4c7d3ccd64de7a0fd259f82ca74e070d964a619be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876586, "uuid": "ac68741d-c11d-4ce8-bebd-6a99deabf0c7", "comment": "Malware payload", "value": "488872ff753d3205f4ee13ec03074f1d7fee3539", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876586, "uuid": "e440b76f-1864-4a9b-8a4c-5b21aa8481f9", "comment": "Malware payload", "value": "9d3f7bc91cd1718f6088e2940f677132d2ece4292d50943bdd0f609736c872a6aba64d51de7063f143f2e34d4ed79089", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876586, "uuid": "6f0b0216-8a3e-4c09-8451-91771f4f6f78", "value": "T1BF83DF17D910E1A4C521057206A20B01EBACF6A363D279F2B5DF424A1F4EEF7B61DBD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876586, "uuid": "7f0bb67e-5789-4c92-a1fb-bc99da7ffeea", "value": "24a9d698157614300b4f12a31e0a92f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876586, "uuid": "f78a9dca-0da4-43e3-a77f-1b102cfd3942", "value": "1536:z2L2LvPhBV1Ls2mfabERhZ+o1dGWKGzi6/lC+06iUUbsvuDCBVUH5ur:6CLvJBV1Ls2mfamv+o1dGWKGZt8dbsCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705876586, "uuid": "8e427fa7-2f9d-4f51-910c-2254cecb2bf2", "value": 84572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705876586, "uuid": "94e53c56-9dba-4893-ae81-797cc922c2ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876586, "uuid": "0792d92b-f723-4b14-8263-69cbf78faaee", "value": "SecuriteInfo.com.PUA.GameHack.6885.13406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "addc6aa4-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829413, "uuid": "2e2cd559-6d2c-4f90-a32d-a4fa6f8fd745", "comment": "Malware payload", "value": "b9a19c2effc002c73e73bd783bc65136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829413, "uuid": "6b8e6382-0c62-4f6b-b5d8-a690abee8cdb", "comment": "Malware payload", "value": "286bd7c70c2aeb3d64a29867da6a73f26f86876e5e85e115176c2f9926c9be06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829413, "uuid": "7179e107-0933-4914-ac2f-b67bb2a4936d", "comment": "Malware payload", "value": "cab873894f1127b332c607adc6096cc44f54b364", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829413, "uuid": "185c7a4e-bb08-4ad6-9adf-6795ff656eb0", "comment": "Malware payload", "value": "ed463c5f4dfe72bf6470b0fa7d941708e664c3f2accb0bc7bcc487094afc1e24a9016a22a3b3a7911abd95f6cd6c2081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829413, "uuid": "9032e869-3d24-4297-b3b3-c6a91cfa6a70", "value": "T1ECF4AF56B6E401F8E0779139C56BAA0BF6B1740807709AEF23E446692FA37E05E7F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829413, "uuid": "eab7921c-a970-4f60-9ea3-469d009d1e87", "value": "1d3ae125c9fa70b475946ee6ae658c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829413, "uuid": "40fb6d0d-52c8-4118-92f1-3acb903e141a", "value": "12288:gBgsOXdNgYiLtFugE5CWQRZhxFalhzjEpXfq1ZLp8eI20nBoS8EYp:g6cYiLtMgEUW8qjIvgZFNI20nBz8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829413, "uuid": "cb8a9635-4f61-42f6-93a8-196933a84f60", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829413, "uuid": "8fce69d7-141c-4aca-998a-79e233ecd02b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829413, "uuid": "c8b5a20a-634a-4046-8a3a-7a7ea4e61435", "value": "SecuriteInfo.com.Trojan.Win32.VMProtect.28983.4091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4945acc7-b89d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705869617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869617, "uuid": "da02f588-7007-4454-be8c-4b0219b777b9", "comment": "Malware payload", "value": "3e991cd72b8a24e70bcefc50abb9ddd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869617, "uuid": "b74a1d80-a6e7-4c2a-93fb-d274b3986f97", "comment": "Malware payload", "value": "2a8deb49f1faee3df5ba880e39a603485f99dd4234b382b4ab11565b71cb6f32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869617, "uuid": "b46f4ef5-c9e4-4c55-870b-0277de9621cd", "comment": "Malware payload", "value": "57228e17e2c4ddb5f21b9955ae47e125dccb15d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869617, "uuid": "60d11182-3ff6-4099-8c73-f955c3ad5902", "comment": "Malware payload", "value": "9acd39ca14aae9fcf9e5c47892def47f3dca61c409f27e1830e48d8ff399ed0cf130d972988229ef9ce1cb2e60343edf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869617, "uuid": "85756862-c568-4c97-8ea1-bfe8bc8e85bc", "value": "T145941215FB9347F2D568447680F3884023FE639346B3D3876C6892D20E01FA6EB5ABD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869617, "uuid": "20b4ee87-b635-49b1-88bc-4c0a05e272c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869617, "uuid": "2dd0f51a-6a77-4445-8b34-a9d712541a4e", "value": "6144:BJNtNNW/uT12SUL0wAqzuyeRRpMKbTd3s7xNbm3Gd:BJNtNNWY1QBAqKL3pM6xcXWGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869617, "uuid": "75b49ee2-3f48-427c-b551-5c5a94f16312", "value": 415200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869617, "uuid": "52be4ec5-25ab-4884-b4b2-367cee451fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869617, "uuid": "8f201bb3-c649-4f75-b74d-6259ec737182", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d803a23c-b80c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705807579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705807579, "uuid": "b3b378b1-5b0c-434c-a874-105fc1515051", "comment": "Malware payload (LummaStealer)", "value": "3670fddce56990305eab64598c1e9d23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705807579, "uuid": "0ffdaf04-a52c-4cd5-b096-aff9e824a01a", "comment": "Malware payload (LummaStealer)", "value": "2c497d2d5e0e96d90ee71d752ab7a52f313d0cbf629b7d40a52fdcfc94a565d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705807579, "uuid": "167438bb-7489-4694-a107-b681d0c21a2f", "comment": "Malware payload (LummaStealer)", "value": "7670832bb2ec59f0f60bbad93574db6021410fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705807579, "uuid": "d767291a-cdbc-4615-83ea-3f40e1c894d6", "comment": "Malware payload (LummaStealer)", "value": "06d3505e57af758e4023a1a3fd5a2020f898afa53d0974b4652f70e88fb9079cf4600a3dd995e20dafba3daba9ba39bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705807579, "uuid": "e936b021-18d7-4ce3-8aa2-b5ffba87b895", "value": "T16FB47E1574B3E0ACC11A34BA6948B324EF3E88C7435198F7E6648FF279229A15E75C37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705807579, "uuid": "33d361d4-581f-4f34-8f18-ba4a1d139f5e", "value": "41482c048643282f0fa54f6385f74814", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705807579, "uuid": "2d652d43-cc16-4613-a7db-2494eb8ffd71", "value": "12288:HKp1N1IiXJ3Uxhtc0rQm6j6Hz7dZOg3ck45aAtqQEjnbuGdafzq1rB:HKp1N1IiwthHtZHcsDbuYam1rB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705807579, "uuid": "331118c4-d2ba-4372-8b92-56da8204f81e", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705807579, "uuid": "e615512e-43b4-4a32-9c41-d301243c9052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705807579, "uuid": "64297ca1-a904-4591-a1ac-45544ea11e33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2406ba-b88a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705861673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861673, "uuid": "75aa07ee-1c84-444e-bfdd-16f75ff47325", "comment": "Malware payload", "value": "efd0db7a43e94ad1039b077610e5a59c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861673, "uuid": "12201efd-cb4d-4c5f-b3dd-1688d593cac0", "comment": "Malware payload", "value": "2e544bb0d0ec35280b25df0cc144c8642cfa81e26c9b5f2a95593b9e7509651f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861673, "uuid": "d2e617a8-38ca-4ec3-8ed6-4ba50db76197", "comment": "Malware payload", "value": "65e05597958c03681f088c85f699c12aac428d46", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861673, "uuid": "803ebaf1-017c-4b76-aa47-d17857a812fe", "comment": "Malware payload", "value": "c7b79aba4fd2aa2a7740689e017e33dc563b384989697e574eaf245167473d7dcb885d85661c8fcda8282593f6c60b2c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861673, "uuid": "bb785699-4c02-4685-830b-fe8e0b8b11f5", "value": "T10BC34B03D610C57BC0A703B617DFE9359133B47B273B711B23A0BEA96F569889E5A306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861673, "uuid": "1ee5ba52-ae85-4226-86fe-b68bc10165ec", "value": "3072:BvxGCVr0P/+Pf3NIVs3wo9QXWmkI7w/7H4ob:BUoZaoQXWmkI7w/T4ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705861673, "uuid": "0e86048b-091e-40de-9595-d8ffa345db39", "value": 119718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705861673, "uuid": "925f2cc5-0b76-4ad4-9604-02f704dd7bda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861673, "uuid": "a21f974f-ea62-4c32-a3ec-347bab9b4ff9", "value": "efd0db7a43e94ad1039b077610e5a59c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0d9a7b-b882-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1705858107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858107, "uuid": "e360ce1b-facf-4f9b-a835-0f128e6a4bdd", "comment": "Malware payload (AZORult)", "value": "d6637eef607e0f1ba48dd9bad3b70f03", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858107, "uuid": "e03a5128-4982-4b87-b96b-6f1801cc774c", "comment": "Malware payload (AZORult)", "value": "2fc9c32a7a88ad193cf3d24d25a93ddec1f20141a2d50fd68f5c77115abff5e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858107, "uuid": "e92915de-26da-4143-b065-6f9e4f2f426d", "comment": "Malware payload (AZORult)", "value": "4891e0addcc5ae02992699bb4370451dabf6ffc0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858107, "uuid": "e0ecd451-f63d-4e4a-a000-3f681759d78f", "comment": "Malware payload (AZORult)", "value": "d6c92df934eaa94efebfa8e72ad03fad31996cff188ac740a686366b2d09e900dd8acbade5de6a95cb9b8844005b4777", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858107, "uuid": "a4bd1590-8ceb-46cd-954c-377337842e95", "value": "T1AE1135521838DE4D43453B88942AAD6E86B013236B85F2F6746CC5CDF770110C9E6537", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858107, "uuid": "41e153c2-456c-4443-acec-2952d3b9758b", "value": "24:iJFacEC+Czzf5j1IsiRI4QAxBwlVICb1P/vMiKDKj:E7EP8Vj6x+jlXvMvOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705858107, "uuid": "8a7f130a-a43b-4c56-953a-c934c48b9689", "value": 1044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705858107, "uuid": "31694c30-f8ba-49c0-a163-24aea1e50eb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858107, "uuid": "8b40e8fa-6565-4b0e-ba03-cc63ceaa57c7", "value": "hx9RP3BV.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163fd966-b81a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1705813267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705813267, "uuid": "d848c964-dd56-434b-ba57-e03c6e4a3d2f", "comment": "Malware payload (CoinMiner)", "value": "1c38258e33ab23bead674c34db28e23d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705813267, "uuid": "6b4afa9b-8a6a-4191-b934-7c2ffa6c8f58", "comment": "Malware payload (CoinMiner)", "value": "304a4f68bfff226a2049f6c5b38f915487ac75f5b6b62e74d17114bb05669c49", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705813267, "uuid": "baaee3cd-3f69-4b32-ac83-9db95db8517e", "comment": "Malware payload (CoinMiner)", "value": "29c1e4a0261d18051924681b697c12dee2aef44e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705813267, "uuid": "ea256be6-4135-48e8-9d3e-7ffa69df67ae", "comment": "Malware payload (CoinMiner)", "value": "57d2ed628327d24f162717f327f1ed35252b22dd69f002489b948910dc4d681530c082c5de49e9e601e2ff8760200672", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705813267, "uuid": "b9849240-df42-4aa3-89a7-e4e725a80938", "value": "T10C75E041621E0957F3522734D6AFE7330604ED6698E2C60BA2D47D3B703E2AF7BB4A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705813267, "uuid": "3932c537-9fa0-42f1-a9e0-03d5feaf7424", "value": "24576:9JwFeU3G7kH++1w7qWgjnIU69VdO/PWTA0/ElSXryaYl1E0XJx:iG7kH++nWWno9qI5/EZaE1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705813267, "uuid": "5629c839-a359-43c2-9685-846e80ae28c8", "value": 1627648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705813267, "uuid": "2dba3e43-d0de-4eed-b0d0-44ef22f689fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705813267, "uuid": "ffd4c98c-2801-41d0-b2d4-f07476898968", "value": "1c38258e33ab23bead674c34db28e23d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6494032e-b8a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705873099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873099, "uuid": "7700acfd-99dc-4be9-a4ec-f6f650fddaea", "comment": "Malware payload (LummaStealer)", "value": "924a185e467f887b68884c0e79074cc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873099, "uuid": "5c31023b-5ee7-44e5-a192-0a312ff1965d", "comment": "Malware payload (LummaStealer)", "value": "30edef5995e00aae98df72334137646518a33e2252534888a73990fbd3cf9217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873099, "uuid": "d4a50540-675a-4620-8d46-975c624e3e78", "comment": "Malware payload (LummaStealer)", "value": "059eb3245c9db2eb6320f096dd79e3a95899372f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873099, "uuid": "d2c6f327-a9d0-484c-b907-1c2279a97e90", "comment": "Malware payload (LummaStealer)", "value": "da19079402ffd662061daa9b4cfd98ffc2dd3fc84ad47a9aca641df5ba34957c791ea7d3350f461ae2b80f85c0324b96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873099, "uuid": "3c9575a3-04ed-4917-982c-6f74d5045299", "value": "T151E49EC6D4BB649DD8079D3C0135EB1CCBAB1F5136238C14B17836AD1F8929D1AE2EE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873099, "uuid": "6e69cfe7-d12c-4987-98d2-087bad387472", "value": "2093666ecefbfc18c14804ac65dd1bc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873099, "uuid": "cd6e7e75-996e-4360-a4a0-0429b8c65584", "value": "12288:9683gw3PetEdJ3Y4tTMVuYwSUWvz+NIT2izoyqQ+kuurq5GVGF8:96Fwm273YMMVpVFvzNyO7qQ+kuurqEVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705873099, "uuid": "bef937a6-ee90-4cb7-8a25-cb1e24d5b16a", "value": 663193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705873099, "uuid": "ff1dfac7-c279-48b2-8540-34b7dbaa311f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873099, "uuid": "089f3925-2196-47a9-8f9d-3c36e4bd8255", "value": "SecuriteInfo.com.Win32.PWSX-gen.9407.27656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f92039-b873-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705851628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851628, "uuid": "f28f2246-0d39-48e9-b393-700d8f5810c4", "comment": "Malware payload", "value": "308fc955c748bb41a6db80f05e92f202", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851628, "uuid": "50b6e245-f411-4290-a21b-92aeaea7957a", "comment": "Malware payload", "value": "33952833592647bb5749a721c9120b27fc198d80b1e755f95a0073bf9f77f2a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851628, "uuid": "3fcaf49f-4979-4dc3-86b8-6efe5fc39e5d", "comment": "Malware payload", "value": "67349c28811c8d82ba565749a33e6eaab47a0c3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851628, "uuid": "30135f8b-f0f4-401a-b2c8-829a15982fe8", "comment": "Malware payload", "value": "b6898cfd0892d57eb7cb54a941de43e2e8281c0022bb4449324b2d7f5c65085078b7f43b4fad1a253fb6f902fd5b4d6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705851628, "uuid": "27796bae-396d-490e-8bdf-a43c22b97163", "value": "T1F9533A09B787A324C9650AF580E3E51502F2974726B3D78DBDC462C92E23BF5DE43B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705851628, "uuid": "644aa779-b441-4fe5-be5e-76e4ec5df3f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705851628, "uuid": "bb6be6ff-7c45-4f21-aa43-56c90cf5104a", "value": "1536:pBKsRV+GhmxJ9LcC14imSEXfUazytP3TCV:pZRV+Ga4C6imS0fUaYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705851628, "uuid": "812b6827-bd13-4230-bb28-81c500050b47", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705851628, "uuid": "5c0f93d9-8fdb-4bb3-899f-e395e8fcceb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705851628, "uuid": "3a2525d8-b80d-4278-a18e-2ce14c7b7b1c", "value": "SecuriteInfo.com.Win32.WiperX-gen.14613.26285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6723c068-b83c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705828006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828006, "uuid": "00c97d9a-5a6b-4402-8391-a0bbe8ffbc3b", "comment": "Malware payload", "value": "66227dde288ebd0d3552459c6823dc25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828006, "uuid": "c5d2a9b4-d62c-43f5-b2c5-faf4e571fa28", "comment": "Malware payload", "value": "339f8f994254b89111608515fb1084c050abdb69d896305c2c2b27cd3dfd5422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828006, "uuid": "62ced90f-310a-4f3c-b4c7-d4dd80a70542", "comment": "Malware payload", "value": "408d46a806cf6a01be6fedfa4a8f5167cec8de45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828006, "uuid": "bfc2e1b5-28a9-46ab-9731-e744c1612b40", "comment": "Malware payload", "value": "2466e982c6a5e8b855779995669fc394928b7859a42d95bd9f74495c2f794a8747d6f16e29ba18147aa1f177dd4a4439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828006, "uuid": "f9304606-8816-4e8f-b1dc-67fcb92129e2", "value": "T1D6159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828006, "uuid": "dc2f5296-8527-4e91-b458-8e0038bc4959", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828006, "uuid": "b3f7e616-ea92-4a96-a6e0-a341b62197e3", "value": "12288:DqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga6TB:DqDEvCTbMWu7rQYlBQcBiT6rprG8aKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705828006, "uuid": "5b07ebfa-f887-4031-87b3-9bc9b82eda9f", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705828006, "uuid": "dd9d60c5-329c-4180-b70b-a7d928660ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828006, "uuid": "69b6c18c-c3ce-4131-8511-2cdd8f2400c3", "value": "66227dde288ebd0d3552459c6823dc25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90c3a07-b836-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705825593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825593, "uuid": "41e2c516-6772-46e0-8da2-36da313c8c78", "comment": "Malware payload", "value": "ad7057a3d1472fa03f068feb89eb81e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825593, "uuid": "3945b9bd-3da8-47db-a1c5-7d6ceae83a1d", "comment": "Malware payload", "value": "348d5863c8a01db43945be3738198d9dc4d64f27c9c4282d59e1bc01af11dfab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825593, "uuid": "04fa1351-4405-4119-a230-abcebb1e935a", "comment": "Malware payload", "value": "3c460a273a32961823c64e3b2c471b2eb48ed0a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825593, "uuid": "7d7e1c12-c1a4-45f9-8081-cb2909c864e1", "comment": "Malware payload", "value": "0437845e21277a22ec7bac8d28f6b94745f2a51df101998e0b5bc6275f8263f1d560dff0e79f23e31e64f45b67db0dcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825593, "uuid": "0743a476-a5c0-4ba2-9eca-1abb76b2d70a", "value": "T17E949F46B2A445F9D16BA078A19B7B0BEA35340403204ACB73D8E5743FE67E06EFE751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825593, "uuid": "2be6892c-4caf-45f7-a34e-81cc468bd294", "value": "d76f672ed6f495da4bb83044aeaf8537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825593, "uuid": "620f1c7e-faff-48cb-b8c5-6267c149e536", "value": "12288:Pil9fU2f6xmRYNS35PByptXLhu7YR44Lnt4+:PqFU2SxBY35PByptMYRDnt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705825593, "uuid": "0c46ea7f-3e42-4068-91f4-a36661c06244", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705825593, "uuid": "786565e8-1807-4803-a241-1a8619ece4db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825593, "uuid": "2a9ce51b-8827-4e15-a8b3-25b2566b4d3c", "value": "SecuriteInfo.com.Trojan.Win64.Krypt.25876.32605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7029c38-b836-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705825590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825590, "uuid": "96e7e113-4259-4969-a8dd-bc49f4628dac", "comment": "Malware payload", "value": "e9302f8c105d4b32ca784199fb05ea88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825590, "uuid": "0cf91dce-82c4-4629-bb0b-aa32793f81ee", "comment": "Malware payload", "value": "365eaae0ffade55420e99b57b42ab1e3b724e8902407aeacebfb8e1c4c3b475a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825590, "uuid": "185604a6-dc80-4a27-818b-07d835a3c378", "comment": "Malware payload", "value": "20fda24431450963715fc3868e4164c16cb45d7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825590, "uuid": "7b249eea-50ea-4612-a3c2-cfdca460f7f7", "comment": "Malware payload", "value": "428db4d521e0648d0790f93aca46094bece20c6d1b7f06481c6296005b90a90d83d51a198a9e00a475115cedd4f764a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825590, "uuid": "fd06ed67-2256-4b77-857f-492eb31fe06a", "value": "T100258D1B229481ECC5ABB17893AF5707F538784603648EEB23D418762FAF6E46F79311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825590, "uuid": "33afc707-b577-4d1c-b3db-ca1551e1b899", "value": "b0abe31add3d994d1eca4764e41913be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825590, "uuid": "9965b838-c7fa-4e80-a354-b76f3b7c8403", "value": "24576:0ythbKKtoBra48Y0UXOhyn+2/hSMXlIhnMviK:0ytZD948Ype4n5aMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705825590, "uuid": "38229dde-c2ef-470a-9b57-f57b530006fc", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705825590, "uuid": "d4018de6-23e3-4219-a43b-93841f5b1c2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825590, "uuid": "c074e730-4d10-4488-b25e-9d00c5173030", "value": "SecuriteInfo.com.Win64.TrojanX-gen.24187.18812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42511f1-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Riskware.Generic)", "timestamp": 1705829423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829423, "uuid": "14f9438a-7859-494c-a0c8-e8ba87d45837", "comment": "Malware payload (Riskware.Generic)", "value": "ce5c708af30e6a575ad63d05c86609e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829423, "uuid": "2c861b42-beab-4d96-9d95-e52e55325b12", "comment": "Malware payload (Riskware.Generic)", "value": "37ee9dfc63543ae47d2a67b42aefe28739000eb077da87557034b5f36af9a0d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829423, "uuid": "cdb1084e-1058-4ae3-a71e-aa6296f19f3d", "comment": "Malware payload (Riskware.Generic)", "value": "76739dbc9a1a6f4c40de471b295ed307bebcd5b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829423, "uuid": "126fd2bb-c6dc-4585-8169-615ea9e2c9fe", "comment": "Malware payload (Riskware.Generic)", "value": "e80dd1dfae205952eb2afe06e36679bcbe4ed23c664b302befb8cf4e4bf8c31835ec61225ff44b03ec0b5b466d000399", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829423, "uuid": "55e56ba7-5996-4533-a8e3-89aee3c703b6", "value": "T1092522C6F6549AE9C5B804312D66C93D63025EAFDD54690A32E0BE0F3CFA717013DCAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829423, "uuid": "5ff56bca-8f48-4378-b5c2-2edfc5f8d5c0", "value": "ebeb0d8ed952d9cbe21b0a776f3d9265", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829423, "uuid": "aea392d7-4ffa-4cb3-a542-0675e9722dc4", "value": "24576:bVG2s4ZQkakDK2tZMl0YXruXf/cib3Ud7dKIQ6wjA:b02s4ZQY+zXysicK16wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829423, "uuid": "68ee1286-f067-4461-b348-f7ce223c3e57", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829423, "uuid": "d5719d27-447c-4561-82db-7a3ed214b227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829423, "uuid": "3b79c76e-6a65-42c6-8c47-853a16832be9", "value": "SecuriteInfo.com.Trojan.DownLoader11.3092.1954.27622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1487658-b890-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CryptBot)", "timestamp": 1705864315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705864315, "uuid": "3329b047-1e21-490a-8e0d-f36e777205ba", "comment": "Malware payload (CryptBot)", "value": "681457fa460dff885eef657f166d5ef8", "object_relation": "md5", "Tag": [ { "name": "CrypBot Stealer Unpacked", "colour": "#9D1020", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705864315, "uuid": "3b6b11cd-4aa3-47ed-8ed7-d561f50e7627", "comment": "Malware payload (CryptBot)", "value": "381333799197cdf21b4d12d9ce83587673c52b336547a5425bbd9c69bba00d5f", "object_relation": "sha256", "Tag": [ { "name": "CrypBot Stealer Unpacked", "colour": "#9D1020", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705864315, "uuid": "1232794b-a3e4-4870-b834-c993d0ce7887", "comment": "Malware payload (CryptBot)", "value": "44cac83393e0d6d083f0f2ae064090e2478f715b", "object_relation": "sha1", "Tag": [ { "name": "CrypBot Stealer Unpacked", "colour": "#9D1020", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705864315, "uuid": "d536dfef-4ee9-4881-b91a-03f2d2bb55eb", "comment": "Malware payload (CryptBot)", "value": "06ccadddc100a1cb21a5d0754df8cb10b25eae7dd6b956b2b4c1c0d5d7c9c041fc0124e8fbedb4d5f51417395f7cd016", "object_relation": "sha3-384", "Tag": [ { "name": "CrypBot Stealer Unpacked", "colour": "#9D1020", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705864315, "uuid": "80c428af-b126-4466-9db2-b0271ccb4974", "value": "T13E544B00B990C131E271963229B9AF71D5BE7D389F7046CFAB405E3AD9712D2A524F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705864315, "uuid": "f786b75b-e30e-4eee-be0d-3d20203be9cf", "value": "5e83a2a4f8bd496b2fc660065aba6076", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705864315, "uuid": "bd802e22-eae2-46e5-8909-dc1dc23f7ed7", "value": "6144:s068sLPlQBdpbFl37RYeuFAeQKWQcAfoOGCR/4jTHazM80WLXTT9Bvl:s068sLPlQBdpbFl3l0FAepWQcMdu+Ymt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705864315, "uuid": "a62a7f3a-6aac-40d9-aee0-e3d5be3f7975", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705864315, "uuid": "b9708f55-ec44-45a0-95a9-b9153c5e8dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705864315, "uuid": "e8f1671a-9801-4d18-bbc6-d8060608ac98", "value": "CrybtBot Sealer Unpacked.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5e7f3a-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829466, "uuid": "390c3644-fe80-443c-b67d-6c69ccb2e2e3", "comment": "Malware payload", "value": "b950c8949f85c8d03a51766fcc0d737c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829466, "uuid": "6e8e37e4-e7dd-4d56-9988-f7f2b515d4f6", "comment": "Malware payload", "value": "3a9b3da4657e75bbd95ca49e628ff121062a73e408e3aea4b733f053500afe58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829466, "uuid": "feebec46-b907-47c6-af19-23c751b8355d", "comment": "Malware payload", "value": "327fa47104339742f357ea53e252d0049fe5f28b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829466, "uuid": "0fa54962-1233-44bd-b1df-9541c6f12461", "comment": "Malware payload", "value": "3abfaa079e7f90110f5eb00352e7df5144f53a31f718628f203ae9d94f0d6b1d186864a2a4afa17f5a379f20067809a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829466, "uuid": "3892694e-01a4-4edd-9044-cccecf4426cc", "value": "T1F9F48E12F2A281F2E668547089B62775FE39AE420B11CB87D395FE7D1D321819D3723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829466, "uuid": "06b93daa-7e4e-41fe-8cb3-0cf8b1846f27", "value": "7c7a2882afc4ae9cfdbc8eb512ba2d20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829466, "uuid": "19bfb6de-f109-468a-95c0-5b9d534a19ee", "value": "12288:Ojf7yRjmxaFtLFSR1qZfjdSvYb9aHSuCpHTcN9an5yhk1f+yOajPzyXWSABr1Ynp:Ojf7yRjmAl61AfjdSvk9aHSdpsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829466, "uuid": "264303d7-0566-4515-b9f5-9dbd9df65077", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829466, "uuid": "fd8b7c59-75f5-440a-9160-5e29bc85fc6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829466, "uuid": "e30585fe-9e8c-4604-a235-959ecbbc1d9a", "value": "SecuriteInfo.com.FileRepMalware.22470.29860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1d9681-b88a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705861678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861678, "uuid": "af81a642-56d0-4ae0-9902-1d11f5b71c2b", "comment": "Malware payload (Mirai)", "value": "ef5f6f05a67c54034a1df8c9eff1f0e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861678, "uuid": "c5de49ae-e43c-426e-8706-00f2c97ec473", "comment": "Malware payload (Mirai)", "value": "414b841c7bf9921795e6a3afc8966230a1ea8efde91fb675f8d379d67ee7ea55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861678, "uuid": "b86b5861-89ad-428b-9a25-c93ec550568d", "comment": "Malware payload (Mirai)", "value": "0acea2abd7125678cb84101907991f0c1e9fd020", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861678, "uuid": "2b8686cf-2751-4fd8-a4c9-ece7a85610e5", "comment": "Malware payload (Mirai)", "value": "188fafd403f68096367d7987933cfef444c11ca2aa8ff15140357448e95ff8d597aefac59b78bd14daf55385e71d7982", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861678, "uuid": "f355c6ba-e20b-466e-ad0e-30933e7daecc", "value": "T14FE3E617AB618EB7D81ECF3302A68921108E916623DA7F2FB174DA5CF74B94E09D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861678, "uuid": "2410bbeb-222a-4f6d-bfba-6c3d3a021ea7", "value": "1536:P2ejKxkNw2Vp2H6ZPIslAft+l1IqPxB5YNPr4UyWmZdVv5AO/6/Dc:PGoF2aZQ8BIqp8NcFWmnVv5A46/Dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705861678, "uuid": "d8f59830-7bd8-4f17-b309-dc08aa346a71", "value": 155397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705861678, "uuid": "f165124e-484e-42af-9ddd-fd0dbdc5a594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861678, "uuid": "dfa1dbde-4e00-4259-983b-534c19068c9a", "value": "ef5f6f05a67c54034a1df8c9eff1f0e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac63a85a-b89c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705869354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869354, "uuid": "f5ae671e-813f-4006-9632-fbb1f1589ee5", "comment": "Malware payload", "value": "5198c4eda7cdf14946f1d9d6009369d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869354, "uuid": "dc477b6f-3421-4b2f-a04c-fb183efc7d89", "comment": "Malware payload", "value": "419d35044a2613ed3a780f13530d95f255981183a09c1806120160502a3bb3bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869354, "uuid": "5b72501d-b6de-453c-a6ff-53267eef44b0", "comment": "Malware payload", "value": "e010ed49104ac6916f160bde7727a2ec0eca5d57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869354, "uuid": "682d1470-d8db-417c-a65b-416e6863ddb6", "comment": "Malware payload", "value": "4f902fc781f2609d1ff018da5f3c81ccf5d81bb6894dd1ea8a558e2df6b159aa22ab759f85edc14ca6fd30bbccca097d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869354, "uuid": "1561e66a-f5ec-4ba9-a2fb-1f1cf495b118", "value": "T12B74235A6B6B12A2DC8FE7336C2473C08779C3A25A4F96DF704955398B06F5FE207248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869354, "uuid": "b83a922f-afc9-4601-96c0-a1c5f9209f36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869354, "uuid": "23834aa0-e9c5-4edf-b428-9d29f211019c", "value": "6144:r4FOxYqxLO/t+TOHE1AlgF2kIahTs/EvnrXttijGuutWI:cDqxSgTSE1GgwubvrXyGtWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869354, "uuid": "443fafc3-3393-47a4-aa00-ded043d81025", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869354, "uuid": "17e6b650-7b98-45cf-9355-07cc0d6d5594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869354, "uuid": "8f87d3d0-c834-4942-821f-8582813f7ea3", "value": "Fantasy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc372ed5-b8a7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pony)", "timestamp": 1705874132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705874132, "uuid": "a8c7e148-295e-4aab-bf2a-a860984f3faf", "comment": "Malware payload (Pony)", "value": "17a81fecff7781256261a82218aae59e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705874132, "uuid": "ce4e120f-cfd1-451f-87ee-7c3fde60ab76", "comment": "Malware payload (Pony)", "value": "442b8223413bc9b08a5983da23c5964839b1551ab4a84759d94dc5c9a228eacc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705874132, "uuid": "7266d49c-8449-46b5-88de-2c65b07dcabd", "comment": "Malware payload (Pony)", "value": "8ebd577376a83b81b8b27daa7230b18ae0f40a79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705874132, "uuid": "1b859421-de23-48d5-aece-1238a40cb19c", "comment": "Malware payload (Pony)", "value": "9cef673b6551150275d90bff78766df84a50aaefa72dae33bc6ebe049d80f875fc9c2d46cbae5dcfbde4220985bd8b0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705874132, "uuid": "b0829413-1455-4872-84c4-24a338eeae78", "value": "T14FF3BD4F3B7D43F6D271CA3233AA71CEA963A2805F91673EE01851A179F32260D9754B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705874132, "uuid": "e53176c9-25da-41df-aa27-4e3b6f0fc95c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705874132, "uuid": "b87d69c6-8f10-4871-8b60-91043d9a5c3a", "value": "3072:UPmrPsf21O0OkVEHEiDsKfR3Wbw4mz92LoENTIeo9aJy0DZDo8PNX8PNoOq:wm7sf1GaHEiDos4mzAzeABDZJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705874132, "uuid": "660fb814-d6dd-4a1b-b75f-59b8badff040", "value": 169136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705874132, "uuid": "0a5257d6-9012-4c5a-b286-4283d2d33725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705874132, "uuid": "11fd3625-eed2-4fa9-9de3-d079f1eae6fb", "value": "17a81fecff7781256261a82218aae59e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9ace66-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829414, "uuid": "12cf3d89-bda4-4e37-a438-7b87f34ada91", "comment": "Malware payload", "value": "1685b69d484d5860af58282f6914398b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829414, "uuid": "253e1928-4414-44bc-ba0e-6c64456eb65a", "comment": "Malware payload", "value": "4736107bd7950f2a6bef7d97de0de092f3d16c66bbe627bac3222051dc83b5d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829414, "uuid": "a829102d-f9ba-4e00-92ba-16b78debd9a5", "comment": "Malware payload", "value": "8668baebdbba1fd5be46c35a371270bd060fa565", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829414, "uuid": "8fb6a891-67ba-400d-b240-405975fb92d5", "comment": "Malware payload", "value": "ebd3356b292d1ab71aa93d7b4299ee5bb8e1fb6c9b7b7e3113892cbae7568166ddc3037909f269f44646383b1c5dd26b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829414, "uuid": "f82a6c1b-84e5-4a8b-954f-22b22537f45b", "value": "T1224523067404D823CA5686B8DC7ED6F99D3CBD11FA61490FB3E97F083A73366661870A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829414, "uuid": "d0de3fc1-2bd7-4c8e-8b88-79d58072dc25", "value": "e3e1ba523cf61b826993834dca364e87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829414, "uuid": "732f469d-1fed-43e9-a6b3-53de7fc8b6da", "value": "24576:dVlInGbbFJb43C17/vraAuqUA7qtg9O0EPfo16LpGXOIXaGI4eMboUQ:PlRFJk307/vraALUWygQq6AXOIKTFMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829414, "uuid": "9d3b8f38-10db-4031-a7e7-fe5189a3f0db", "value": 1226504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829414, "uuid": "143c0807-33ee-4e5f-b494-36ce953573e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829414, "uuid": "d4e2f32f-511f-458e-8285-252cdc90f3f9", "value": "SecuriteInfo.com.Program.Unwanted.3716.23583.25521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd38857-b88a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705861704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861704, "uuid": "1665ef10-dd61-4582-b410-fd31fea705b7", "comment": "Malware payload (Mirai)", "value": "dc5b37d191af0c6757d793e774f316b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861704, "uuid": "a753f275-29cd-4fd3-bb19-c9eeef95eb80", "comment": "Malware payload (Mirai)", "value": "47a4c78c491705b30cb872eab31319f6879bca66d62a04f63d2e0558d8631b60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861704, "uuid": "02ef1b11-9678-4c45-b729-6693bd5f74f5", "comment": "Malware payload (Mirai)", "value": "666dd3ffcd51db02639c37091ac60dd352c5298d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861704, "uuid": "9bcf829d-5726-44f6-b1b1-bede87d10973", "comment": "Malware payload (Mirai)", "value": "4186483888c194d79c31faaaf40487c7868fcfbab2ec0c3cabfc570f80be8168ce8cf9a5af248e7bf59d13b7cc9c9e84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861704, "uuid": "8395058c-8a14-4c3c-98cd-ff4ec878c124", "value": "T1E4F33A05F640C747C1E22776A79B865933338B64B3DF33199938ABB43BC27991E36606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861704, "uuid": "e5cb0500-c06c-408c-9331-7121548bcac6", "value": "3072:wC2qIZ7a76orzbfdnbx3Aj1PIeoHeV+hV72WmJhny2qAQYzc:C7a76orPfdRAjTweV+hV72WmJhny2qP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705861704, "uuid": "10a53351-da2d-4b6a-b0cc-58e7215c9406", "value": 167599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705861704, "uuid": "19112727-2467-4e53-8298-4fc8f94ec8b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861704, "uuid": "2e9cbd6f-cf69-42f5-9f71-f57b9b9f74dd", "value": "dc5b37d191af0c6757d793e774f316b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f7ea87-b884-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705858839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858839, "uuid": "6d89def7-c8f9-4b4e-a156-382837f54ac6", "comment": "Malware payload", "value": "75c9c61f022960aaabf8bc59cb5540d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858839, "uuid": "c039334b-044b-4be8-bf22-e2be7eacb65f", "comment": "Malware payload", "value": "49200fae77f5a80168c14747ee2e05cb5ee1c0251b9f13c9e02addcf9297ac63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858839, "uuid": "01b594ba-973d-42bb-ae27-8b0796f5f7eb", "comment": "Malware payload", "value": "516a1af0bfe4822572ff20be10fb069536ea5628", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858839, "uuid": "aeb22506-28d5-485d-968f-4b3a3b92498c", "comment": "Malware payload", "value": "ae86200fea2a6a93215e8178a298f9f4d98f248f0f778cf9c1c737eccd5f916488297faea1271a787872e2f835947dac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858839, "uuid": "b8d47aaa-9d28-4ea2-b3c7-9c327c104914", "value": "T14A159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858839, "uuid": "eab1a32a-35bb-4a0a-b388-3636c5511410", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858839, "uuid": "17920bc5-1cff-4adb-b655-afb8db8ebb68", "value": "12288:NqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaaTw:NqDEvCTbMWu7rQYlBQcBiT6rprG8aqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705858839, "uuid": "9b873aad-8a2e-4af8-bf8e-cf4b0350ed0e", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705858839, "uuid": "f420cb7a-fd0c-4d48-a75c-1a115b2f8602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858839, "uuid": "c6fe5e5a-a834-43b7-acc6-de6f7a60523b", "value": "75c9c61f022960aaabf8bc59cb5540d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ec5961-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829473, "uuid": "ecd65d64-228b-4fb0-bea3-484065e32e9e", "comment": "Malware payload", "value": "d194bf3be227e25a2db0f298a2f5ea73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829473, "uuid": "9b74b4f0-9e22-43d3-b1c3-d9035ce9ec14", "comment": "Malware payload", "value": "494565935fcc08fafe980323377e4ce0c3e445122e95afd6db536feb36b94d63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829473, "uuid": "1ddf0f06-f288-4e83-b541-8c82d5837e91", "comment": "Malware payload", "value": "c6fa4217a46c9d6b2c0553347915b0cabedc25ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829473, "uuid": "e9e027a0-72a6-4428-b7b8-bfd1c57eee41", "comment": "Malware payload", "value": "e06802cdd149b0940e5fba2efc0ed79f04e7169b5e3fc8a4a2c464ba6b8a6ce1e731f4c3dbd898dfcb1016707999339f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829473, "uuid": "6b4d8a79-112e-442d-9743-e62366e4d476", "value": "T13D168D65B281C433D1631A38DD5796F86929BE20DE34998777F83D4C7F7A68138382A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829473, "uuid": "810de895-de63-4e73-a82b-b570c3572389", "value": "cdf817b410bc8e72452c44c74d01ffbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829473, "uuid": "8a3d3e50-f445-48ff-83ee-0f09a9d59948", "value": "49152:Roh7fJ3XQV3X0FQN+T+aPRGiQuOepkxn5sElzMMS/0VT7jGHL4mY:R8DJHW0eN+TJZ6tjl/S/0RY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829473, "uuid": "5a7724be-4663-45ba-af91-537f6f8b06b0", "value": 4203008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829473, "uuid": "a245009e-c03c-4811-b394-37bc720a7c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829473, "uuid": "50073696-693a-4180-a2cf-446cd60ce722", "value": "SecuriteInfo.com.BScope.TrojanDownloader.Banload.1546.15470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930957b0-b805-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1705804457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705804457, "uuid": "1db5e3e6-e51e-44b7-90d0-52635ae1b06a", "comment": "Malware payload (VenomRAT)", "value": "25b6389bbaa746df85d53714d4a6d477", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705804457, "uuid": "0d072dcb-a992-44e0-a629-b440020b9467", "comment": "Malware payload (VenomRAT)", "value": "4b02692bf468a164e333bbfc961c5974d0a95009a72ea8bff2e9cb677eae4f56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705804457, "uuid": "0d01baab-7d30-4601-b63b-075edb0c1c8f", "comment": "Malware payload (VenomRAT)", "value": "86e6443e902f180f32fb434e06ecf45d484582e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705804457, "uuid": "f280adea-4828-40ae-a12b-97264e35fbe8", "comment": "Malware payload (VenomRAT)", "value": "2754bc1f6c056e03440dd03eb17d29c8e9a02a4b552b067b42c45aaaa30c955e4d6759da2edd0acd474ef78f80e34f1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705804457, "uuid": "b962e283-235a-4b7d-9f6c-cf10b56e5694", "value": "T1EE735B003BD88926F2AD47BDACB261070EF4D55B6412CE9E3CC454DE5B66BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705804457, "uuid": "d31ca7b8-3e72-4ea9-9421-b17530ef8d8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705804457, "uuid": "3939cbff-067a-4570-a36b-aca9646d1f42", "value": "1536:6aUqAcxVMW7eTmJ9rxjJTkdK4WaxHdSzPMwy/eqmmRhdWVH1bfbVCNIrXQlwzUIE:6aUTcxVMW7eiJ9rxjJTkdK4WaP0PMwhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705804457, "uuid": "db8e10bc-7755-4acc-8a55-7dc64b15524f", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705804457, "uuid": "e1f7ff11-68ee-48cd-bf84-c273a00bc2cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705804457, "uuid": "368003e1-7e2a-4e41-afd2-fa3a2be1099e", "value": "25b6389bbaa746df85d53714d4a6d477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ec888d-b82a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705820437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705820437, "uuid": "44a4c225-0f0c-4eed-b337-b0f60b7985f2", "comment": "Malware payload (DCRat)", "value": "b5f8b849f7ac3acb610c0eb1415634d0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705820437, "uuid": "2c432146-62f1-4f82-bd48-f2f54ac84b1f", "comment": "Malware payload (DCRat)", "value": "4b28df1a5c72982b065966aed5bb123abd06189dffb52822458451d01cd2c80d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705820437, "uuid": "a318c6be-8ca6-44c7-a5be-ce9793ab65c5", "comment": "Malware payload (DCRat)", "value": "6fd900401e40f47ce5530686bac05dd80a736ac9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705820437, "uuid": "399e21e1-fc3b-4890-ac18-da9124f57622", "comment": "Malware payload (DCRat)", "value": "66e64717edda72ec8ab673503193dac9d86ce1d0f629dcf28c2f38f6cde4d03ace825eea4e095665fb9a421e8eda2235", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705820437, "uuid": "bd11719f-f292-4d8c-9f4a-839e8ba86e72", "value": "T12F959E0679635E33C2643F3284E7012ED3B0DB377622EF5B360E65D66A172719B126B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705820437, "uuid": "3ee0bc85-a295-41f9-826c-4b1f0f8b5041", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705820437, "uuid": "583b1319-253e-4f64-abae-d12510e59f1b", "value": "24576:2TbBv5rUyXVi0ITNGsrwdZ1l3D8yT1f5ABz6cUsGgGMeG2C67:IBJiCH3D88ZcUtgGMeG2CY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705820437, "uuid": "58bd228d-0030-4df3-811e-46e513d70261", "value": 1972961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705820437, "uuid": "8fa2aad7-047a-43bc-b2a4-6728ece59f7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705820437, "uuid": "8b53ca2e-efe9-4954-941e-ecf44b69ae6c", "value": "b5f8b849f7ac3acb610c0eb1415634d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3f2675-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829439, "uuid": "682705a7-baa9-497e-b2c7-3b5f539da223", "comment": "Malware payload", "value": "8551f7173762e9d83f69dc0873165a0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829439, "uuid": "fc24840d-efb9-4b82-aa90-956d5dd4443b", "comment": "Malware payload", "value": "4b33b27f36d3f297ab2107e4741e7a550a560166664434c736c8a856aed3223d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829439, "uuid": "72e83d20-e60e-46ce-bca5-a618f99225b6", "comment": "Malware payload", "value": "4fbf1e34b2d777e9d31a241b0736ad09e5ef8564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829439, "uuid": "b36cb003-af05-4a72-9a3c-96170efdb334", "comment": "Malware payload", "value": "8836a4d8e51b66e4ab11ced642d3040275a2a2c2ea316431a601d0acd2563a659b3a06cb622ad579cd34397c59348c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829439, "uuid": "f9bb818c-8d67-4672-a968-bb4b5ab1f1b2", "value": "T1F9D47E8BA68723B5ED223B7211F667364F3293810126A252E371DFD2D8235635E352E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829439, "uuid": "c82ec525-db5f-440d-bf0a-63f09d4bb7f0", "value": "12288:4I985R3TjP9rjIsOPI5rjI9OPIKpWlVByBKFiGYcVs:59sjP9rjIsOPI5rjI9OPI0WlMG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829439, "uuid": "eabf1e07-2feb-4661-9178-96b2fe7ca96f", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829439, "uuid": "0e002053-08da-48d0-9147-b2501187118b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829439, "uuid": "992bbc46-17ad-48e7-9abd-151f5926a0ff", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.19479.13039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01e6ace-b835-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705825175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825175, "uuid": "74d854da-e1e0-485c-9e33-25ab3cf71d82", "comment": "Malware payload (Mirai)", "value": "f053e080243b4e03bfd4b4bf6de565e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825175, "uuid": "7d0d04d0-fedb-4a90-bea3-eeb8791a9989", "comment": "Malware payload (Mirai)", "value": "4d704f876b32ec36bd0fac286114be24af2d29d3e2713de982a92c38447276be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825175, "uuid": "e74a87dc-2c63-43b6-ac5e-4b0694ee82d4", "comment": "Malware payload (Mirai)", "value": "33de99db9930dee68007143c72279a0f8ff0696d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825175, "uuid": "03673fe6-db47-4879-905c-3856a4fa3dd5", "comment": "Malware payload (Mirai)", "value": "606637957100bbd1b5fc6c6e408a13d6b3a81ea98107bce6a9ef360258cbab21812fd8e3f86a2fe1034eb3049f863cdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825175, "uuid": "7f5a9e4c-6e71-4be7-a381-808ef2ae7261", "value": "T10843C652B8815A6BC1E423BBEA6E518D3371B3F8D1DE3616CC111B24778952F0EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825175, "uuid": "50fde6f9-83cd-4aa5-a513-8ebf8d21d722", "value": "1536:Jk48ZOlDxbcYfiQ125+XDW+rd8ea0ClG9WkQx9d42+:x8ZKut4DW+iea0OG9/QF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705825175, "uuid": "3818290e-f91d-45b6-adc9-6efe6a147e51", "value": 55612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705825175, "uuid": "60c90654-146e-4024-bfbc-2a19ea230779", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825175, "uuid": "5eb92c7f-9237-49a7-8c09-8120d0365760", "value": "f053e080243b4e03bfd4b4bf6de565e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bff63e3-b89d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705869729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869729, "uuid": "b3900452-b666-49af-8db2-966960181fca", "comment": "Malware payload (DCRat)", "value": "f6e5e2b98b02e12eb69ca996a0c2c8cb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869729, "uuid": "9d98631d-184e-469f-9b3d-d6aaaee0ac43", "comment": "Malware payload (DCRat)", "value": "4fb58a5ee7ba44f8b9383496178c47aa4b47a304c128c403939bf0bf9aeb7b4b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869729, "uuid": "4ef0089e-9350-4e68-a8e0-30f1cb400b69", "comment": "Malware payload (DCRat)", "value": "6d851915cc95b22798a4519ac453cc2a4f48f021", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869729, "uuid": "81ccbe8e-fb62-4029-b246-461730964ca5", "comment": "Malware payload (DCRat)", "value": "2b5807d825834dac7ba5133bbdba2206259bdd7bccf10cfe4ae357aaaa7b088240d282a0fb83ea2ce5d2cf4b56884885", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869729, "uuid": "26945329-eed8-414d-b087-dfee768e6844", "value": "T1B505D8282AEE153AF0B7AFB14BD57886D5AEF573771E954D08C103C68202B40DE9673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869729, "uuid": "6641ef5e-5586-40ad-a0ce-a3ee26f63603", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869729, "uuid": "39228daf-1f06-4111-bfb3-815862856ef0", "value": "12288:7OTnUJ0dav2TeDefafT/dJJMA+PpW3Ari4VVyZC0+1cw2jINof85AZ6:7OTnneTT/nJMA+P3iE0nHx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869729, "uuid": "400ddd88-c2f1-4f93-b044-709a7902e94a", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869729, "uuid": "cec136c6-1ab0-4fef-a3b3-2f7c08901891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869729, "uuid": "34af84b1-ed8f-4da3-95ba-a451d4e66116", "value": "SpotifyStartupTask.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba64f391-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829434, "uuid": "3ab95a7c-66e6-45e9-9f67-009956878f85", "comment": "Malware payload", "value": "bc96dc404f309c938120fa4ced304168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829434, "uuid": "edc2f118-410c-44d7-acb8-88b8cd5a9dc7", "comment": "Malware payload", "value": "50dbeb5030ff71d31b55219e7339dff9360c79ca16b48d5753ac28e21e3fc990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829434, "uuid": "e07fd871-8a2c-4a8c-8c27-0ba172960a45", "comment": "Malware payload", "value": "82cc35388896b4e66d87cf0e8a9b6b823f0f1d9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829434, "uuid": "4a8840a5-a8fe-4f18-b186-913ac332c276", "comment": "Malware payload", "value": "57e2742e63099851dcaa0c6867ef8c194cef598189e3e7d170bc2b97d4ad322103cb69e3eac0a9253c41db0db9708cd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829434, "uuid": "cd4ba9e1-b749-475c-9f97-98a8cf3d742c", "value": "T1BA33B635B285EA63E9542F304D5EC794AEB23D106E2DD55B7FA0F3CD0D3A3838990964", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829434, "uuid": "400a7840-dab1-4790-85e5-7c12e82643eb", "value": "08829f97003f2b98b3c408d2628e5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829434, "uuid": "0eea4411-d04e-4b36-bfda-adb8a4953adb", "value": "384:B5HsLI36SFc8ze6Fa7StSS5HsLI36SFc8ze:BV6yC6F2SoSV6yC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829434, "uuid": "a78a4961-72d6-4e7b-a0d6-1f30efe2ec9e", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829434, "uuid": "d3dd84a7-b603-4d83-99eb-2db3038179c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829434, "uuid": "4a11190c-f6c1-44fe-a072-f26ba64b5d3b", "value": "SecuriteInfo.com.W32.VB-Downloader-Minimi-based..8805.10049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8967dc-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829438, "uuid": "9f746e3d-fd2f-469d-aa6d-a9b5cf50b933", "comment": "Malware payload", "value": "9ebb8988f1f2ea035f15b874500054ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829438, "uuid": "4326ced6-bec6-4663-9cf2-a1a8d1ebea13", "comment": "Malware payload", "value": "51d1839a2bdd7a17a5d44c799ec7813931622d54d09c4ccf336d42ab256fa67f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829438, "uuid": "feb307e4-3511-46f7-91fd-828b9cacab5b", "comment": "Malware payload", "value": "d91c1beeee30b92c79f931e83a2d1a8eb61f6339", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829438, "uuid": "715455e3-8bc8-4b9a-9f95-855f8e83c699", "comment": "Malware payload", "value": "d4e79becee40e1248cae99a0d8c0e51bfb214cf9eb5e5ba8317b2cb4327341a948d439a3c4b578b86e0da1620d3f8394", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829438, "uuid": "669b35d3-362a-434a-b343-1e91f3b5a831", "value": "T147E47E2296018065E4DC0AB465EFA73F5195BF273B1CFCCB9A84BE9297F31C7A834548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829438, "uuid": "32408d6d-63a2-4fce-a0e9-311bf0cbb65c", "value": "6144:hq9JwSIeu1T5zauhKsmX9JRG7WTBro1lT9IHoEwZy+cIkllnggBoB:hIulw6KJLRG7WTxohWoEwZy+NkQgBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829438, "uuid": "07fec9d7-e00c-42fc-9668-4a9734cfd3d7", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829438, "uuid": "90d0588b-6624-48b0-82e5-75151551f8ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829438, "uuid": "e14dc365-f7c3-4045-b209-6bc89c7d61a4", "value": "SecuriteInfo.com.Trojan.Crypt.31271.13478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59a9950-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829426, "uuid": "63281f49-2eb3-434f-90f5-8266a087115c", "comment": "Malware payload", "value": "6da64a530be6c793f34c105d12c34c82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829426, "uuid": "2e77bc66-2fb1-40a7-b5e7-7716ca40a50a", "comment": "Malware payload", "value": "520da792b4981a669c39650f9a6db063b2f120722177c62f415925f911c45f78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829426, "uuid": "e10d099c-a86d-411d-a892-f5e21db6e449", "comment": "Malware payload", "value": "44bcde438d0a792a5feb83764eeaf5d8e30c5132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829426, "uuid": "9f810b16-8c2b-4647-99a3-8bb1af3030c3", "comment": "Malware payload", "value": "bc276ed76a40cdc5e6ccd915f91cb81d1c5c7442da2abbd7e0cdb859c582df5d77329b522ea5d0c15f1d89b44ff16326", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829426, "uuid": "f4ac0cd5-f2d2-4146-ace0-4ce47085f86a", "value": "T1B7A56D33B686543BC02B0A3A5C2BD6549C3FBA112E569C5B6FF45D4C0F3AE416C3A687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829426, "uuid": "26ec0839-d9d1-4b93-8f48-b49c5b4a322b", "value": "0231159cca4ac0862355370ee9b9ca31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829426, "uuid": "d609e3fa-b842-446e-886e-fd3579a7c3c1", "value": "49152:MIdF0TAYyS8NKHJ5k9FC+hseZj0zsnl5La9TOvTtiRojks3d:MIdF0TBkCdcZiRek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829426, "uuid": "c15d9364-7601-4bd9-9ee8-8fa10f911aa0", "value": 2168320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829426, "uuid": "6ed1b78c-321c-4ddf-8757-cfeb870e803c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829426, "uuid": "d033a572-0a4c-43fd-ad03-5179ac68cc94", "value": "SecuriteInfo.com.Trojan.Agent.4616.30423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47db9b6-b83a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1705827303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827303, "uuid": "060af1cc-a229-48f2-a90a-139ed79ccadc", "comment": "Malware payload (GuLoader)", "value": "4130fdff3f1a1fc74b4466d6e76d88a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827303, "uuid": "fbb0f1d3-bc38-46c6-bac5-d30be488dbb8", "comment": "Malware payload (GuLoader)", "value": "525ea77873dcbe995d987c1324ad728a1fc3a973cfb02085845b4a88aefe3d91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827303, "uuid": "dfc7fe94-e3f5-4f2e-938c-e6709f879d78", "comment": "Malware payload (GuLoader)", "value": "dfd6c6f248dad0843bfadf31a0ebb572a357b79e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827303, "uuid": "b6a73d86-b826-4fe3-9d1f-b8f17558f4ed", "comment": "Malware payload (GuLoader)", "value": "15bd390f69eef3263c4fa777fd4522aec456a98bfd43c995952817cbb73a42f7e93709411ba4aa817855d1965249d039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827303, "uuid": "012c6843-7f70-4ef4-8537-ca4c023efca1", "value": "T1D4D40167B5A0889DE8BD453079F19DEC633BAC63D875A1467B48372A2F332738221477", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827303, "uuid": "9f752257-b523-44bf-96bf-fa904c85c672", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827303, "uuid": "72f18ab8-6f33-4ac7-98b0-ae8c2e2b8080", "value": "12288:TqFPzf+ynsb8fYXuR/CH9iqsEAcnAhsoWE3L:C+ysbCYXtdbGcAEE3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827303, "uuid": "7539699b-4098-4abb-8395-31bcdd85b678", "value": 648636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827303, "uuid": "7c85d1e6-64d7-488f-9e56-a8fe78463d1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827303, "uuid": "c83877ec-5468-4243-8159-0808f1fbc446", "value": "4130fdff3f1a1fc74b4466d6e76d88a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c76079-b83a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705827200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827200, "uuid": "4495075c-af51-435f-8147-f2bb035da8e3", "comment": "Malware payload (Smoke Loader)", "value": "24c6317dbb4c310f427b597c7f48c0e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827200, "uuid": "679278c6-fe7d-47ad-969b-337165381000", "comment": "Malware payload (Smoke Loader)", "value": "534aca35659752725509f5964e080fe73a444d4ea97fef7a4919b2deaaa85d82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827200, "uuid": "0cabcaf1-a6eb-464e-bf1f-c22274061613", "comment": "Malware payload (Smoke Loader)", "value": "525711ac552ca43cbefd9a39bb3cedd44f6ad8ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827200, "uuid": "d6e41d62-322f-4625-8859-72fd4aecf1b5", "comment": "Malware payload (Smoke Loader)", "value": "74691e746c489552c2b0f4a923fb78c0b4aa2e3db256a97f06fe575cfd422ee1aac4e628247af93bc73e40d511557f2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827200, "uuid": "3f43c0ce-7bf6-445e-9e2d-ad349e3ee6b6", "value": "T1FF342A1352A17E51E5A64A328F3EC2E8765DF651BF5AFF5B22388A1F19700B2C123713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827200, "uuid": "ebe25181-83a3-414b-a14f-44b7478eb6bf", "value": "e0e4d350eec84bd11f6f18b6d0e645d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827200, "uuid": "3d272bbf-52e0-46b9-9b98-a7144ba3ac7d", "value": "3072:luSL24J1ow73jLyC3+tmt+f4NsYvZVbEGjcPqAAIiEYAsTj/My4S5yU/I4:luuTjLyC3zMQNsYvZV4nAZAWztmUw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827200, "uuid": "a69073cd-b364-44ca-9566-0f0628bdd214", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827200, "uuid": "495b4a9e-4f19-4955-99bd-370b8895ed2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827200, "uuid": "86b2b12b-6c91-4252-8071-b0a2d68ec688", "value": "24c6317dbb4c310f427b597c7f48c0e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29a0b7f-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829421, "uuid": "845d7bbc-7d34-4270-8c2d-d6ca3f1db500", "comment": "Malware payload", "value": "79662fe5dd226f0fc41ab11a7e430f54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829421, "uuid": "0e63a37c-c196-4661-94b3-454e26e8454e", "comment": "Malware payload", "value": "552e4a9e340e79682cb6763c65d87b288bb1e4a311995d7c0eeaa5e43e90bfc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829421, "uuid": "f7a4aa9d-7366-4657-afdf-c474e59d1e1d", "comment": "Malware payload", "value": "b3dcffd859628e9cf51cfba5ffc9452d92056686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829421, "uuid": "6f7a3d51-39ee-46de-a468-4636c851d9b9", "comment": "Malware payload", "value": "cc7750e2a576aeb04b5a21bb175d197d99c56b7c86f05c62630561a8267dd283db662628c4a15797b671f3bdba03e03b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829421, "uuid": "a49be198-f724-4952-9cc9-8a1b0c6a002d", "value": "T147856B01750280F9C2231DF2A562BF799265ADBD4AA2D683F244FF5FF531E817A29133", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829421, "uuid": "b8f0c6c4-afb0-4c10-98b9-fe8a7af27342", "value": "30fb8e6851c05b9d65c8fe07bd52f8de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829421, "uuid": "d4c1ff94-97f4-4a1b-a713-27922dd50fb5", "value": "24576:FL+M+OuUG7m5XiB4QRRI59IeHRI59Iedilq5RI59Iev:F5+Oct3Re59ne599ioe59P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829421, "uuid": "310f938e-a12e-4795-823b-062fabc42bbd", "value": 1789952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829421, "uuid": "7b62b9ad-4f6b-4cc3-a2d3-46301b22b3e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829421, "uuid": "295a97be-0e4c-4708-b4b9-9e19716c09b2", "value": "SecuriteInfo.com.Win32.Evo-gen.24810.11305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b5e725-b836-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705825591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825591, "uuid": "8a3977e7-5170-4c07-811a-3b2299493f26", "comment": "Malware payload", "value": "129c295f3d50001c000bd84127d18df2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825591, "uuid": "ab89c264-a633-484f-ab05-e4deb3e73bbf", "comment": "Malware payload", "value": "564cce5e981f0fd113680440f44741b12caeb2e9377ff3056dcff43cb421774e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825591, "uuid": "3bba62a9-e7b4-42a6-8b6f-c53a642eeba2", "comment": "Malware payload", "value": "40d2490dafa4ed5a9c9947742e70ae1a068b3427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825591, "uuid": "34bd9991-d488-4a6b-9c79-7814bc800136", "comment": "Malware payload", "value": "cf0bbb8dbe7db7b5f4372a64e667b430e818e649ff37637cd923cf011a69af5581e9cab10138240ba4eca365b4168f87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825591, "uuid": "8e29994d-a9fb-469d-a2b5-98cdab6f382c", "value": "T16825232939D7D5ABCB45A37A4C7BC720C2F8B76D06B24DFF9F808B1D6A429CAD102544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825591, "uuid": "75259276-c34a-4b17-8af3-9959d509f6ee", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825591, "uuid": "adc02f04-b7a3-4cbb-80c6-4955ed4e4873", "value": "24576:ZiqWlqZItc1WnlpmNC8O+JpuSCQDa3DQnfkPseWdwuyXGyMi:hWlqZItRTmg+i3QDkOfkPmdXdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705825591, "uuid": "81b9806c-0857-45a9-b73a-9b45785a1d31", "value": 1000953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705825591, "uuid": "6eb55872-2777-4acf-a6f2-c9c2608cd287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825591, "uuid": "fcb9f30d-7cae-4e4b-af47-aa8a9ecc546a", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.Phpw.gen.30072.4029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5db8c1f-b8a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1705872913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705872913, "uuid": "069663c8-c722-4579-af41-71dcaf14c09f", "comment": "Malware payload (Amadey)", "value": "14f7c4b98e2c837e555d030bfbe740c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705872913, "uuid": "8bd7fe4d-a870-4548-8ed3-50894e52b91a", "comment": "Malware payload (Amadey)", "value": "585892aac1dd2104c9dc5badf75efbc0d5f363456c084741af5e251402473de0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705872913, "uuid": "df1b053f-36de-40cf-9c1b-c706ca80b35c", "comment": "Malware payload (Amadey)", "value": "695e50ac70754d449445343764d8a0c339323a04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705872913, "uuid": "e1e2f93b-553b-4090-88cb-29d4d934e944", "comment": "Malware payload (Amadey)", "value": "1df7115a08092286e16c30d8811163ead1cd005e1ffafc5c0c0783b2d20e5b62aeb6667618b1565738d9000a7f57d1b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705872913, "uuid": "66b5746a-3aba-4c27-ad25-e35f9e0a611b", "value": "T145F42359F74CABB3C3E6393A94F1B2C14BB581B1070AF3AF6494461A5E2DBC254C3467", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705872913, "uuid": "496e3b79-d30f-4d55-9aeb-7d8d3438cbd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705872913, "uuid": "f77f4ef0-ca0b-43f5-840a-166d8e20e5ae", "value": "12288:zc+WiaJxW5LtRFrOL6fSSGBqlzXoDlT4du0PXfk2IFY1Xr6id3Ah44b7PaiSBXAc:zcy/HLaT4zXoD6EIX8H7h44b7P8ARrEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705872913, "uuid": "2c96ea1e-496e-48b6-9c86-71b55b83bd8c", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705872913, "uuid": "7a00fbb4-3279-41be-a01b-816d279d39ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705872913, "uuid": "deda16b5-40fa-406d-a13d-853865fc8ef9", "value": "14f7c4b98e2c837e555d030bfbe740c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c21eeb2-b86a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705847771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847771, "uuid": "7a58ca72-a5a3-43f9-8e12-3002210db708", "comment": "Malware payload", "value": "5c7cdb61d60c948166d02a0573390d6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847771, "uuid": "30a29ca4-cce2-46cb-9321-da44589d8db2", "comment": "Malware payload", "value": "591b810327884966d4765c9b4fe1b6dac7ff52121b8b56a63b9966daf4ba800d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847771, "uuid": "391d9e8c-ae5f-4d76-9cf0-17372c8562a8", "comment": "Malware payload", "value": "1821e7ac131244d901fc73f5b411e44ea8093146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847771, "uuid": "9ea173f5-a09a-4b54-822d-9c2dc5075e9a", "comment": "Malware payload", "value": "3970d2010e291bfe8021eca3d963820be74331b7fcc91028527384fe6e996cff02006d4d1f1fe0cced6d446c10b40bee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847771, "uuid": "24695e09-e8a8-4fa3-835e-a49b438dd825", "value": "T19F533B09B78BA321CA350AB998F3C4511BF297AB61B3DA8B3DC452C50F127D5CF4275A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847771, "uuid": "49b3aecd-e55c-4fa8-a7a5-b4bf3b51a1fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847771, "uuid": "0d3c4669-473c-465d-ac7d-83d18c61730e", "value": "768:Eigzx8/17QuOVWCYw+97ju7jJ3nVaFWf8s7tYt7CJ21w7FP2dP9FjbOVkO2fDzAm:EZKWtQsGFWf8sMuQG7FP2dlBkkJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705847771, "uuid": "49142d9b-ba19-411f-85ba-7948d5be7c61", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705847771, "uuid": "bd7fe8c3-4d8b-42d7-87ac-75e4e71a6f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847771, "uuid": "26c3e819-88fd-490c-8c9e-59299bca73fe", "value": "SecuriteInfo.com.Win32.WiperX-gen.13220.2654", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92400203-b861-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705843970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705843970, "uuid": "4ecfa9e2-aedc-4134-9cf3-037a275500cb", "comment": "Malware payload", "value": "305cbbf5a6b32e9c951860221d4d60d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705843970, "uuid": "31ff8337-294c-4eee-9e70-c772584db476", "comment": "Malware payload", "value": "59adf02507f77f68e91397e6434447e4ff4de87fdf635f70163831cba7cdbb73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705843970, "uuid": "e494ae9a-2621-4294-99d0-16095faaf47b", "comment": "Malware payload", "value": "6471ff04dec63bb624daf2160e8047748a1707d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705843970, "uuid": "3c0ea898-2b0a-4e55-9e85-8e9c29e873ee", "comment": "Malware payload", "value": "b09f7fa3eca479241b1f03b8fe3c0083dfeba4bf4baf157761a5e7ed7916e9ebb529df69f45ccfee75ddd89a79540df3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705843970, "uuid": "e80d5b00-dff6-4175-9985-26589e690b21", "value": "T1E9534B09B387E725C5664AB8C0E3E9500AF2A7472673D74EBDC452C50E237E6EE43B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705843970, "uuid": "f0a9d9d5-199f-40ee-b07f-2b8e7debcfe9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705843970, "uuid": "d5eed319-a204-4149-98f1-6d71979cf6aa", "value": "1536:pkKAdKp69L/lTIUUujllMvTpeE+mUVPc:pL697iCjllsTpeEY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705843970, "uuid": "bf24af72-207f-45a2-8732-53c121fe7413", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705843970, "uuid": "3889589f-a323-4396-acf5-0c983d2bf29d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705843970, "uuid": "8df03a16-d56e-48b1-afdc-e5929308df6d", "value": "SecuriteInfo.com.Win32.WiperX-gen.24102.18017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c9f940-b7ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705801699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705801699, "uuid": "2733c01b-d427-4acf-b9c3-bd2df718c5a6", "comment": "Malware payload", "value": "2fe895b10d493cfef981aa708bbcc12d", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705801699, "uuid": "ede0a0cd-0c7d-470c-a580-217149e723bb", "comment": "Malware payload", "value": "5afa6d4f9d79ab32374f7ec41164a84d2c21a0f00f0b798f7fd40c3dab92d7a8", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705801699, "uuid": "d6c7b267-8934-431b-8a52-8008acf7730b", "comment": "Malware payload", "value": "6222b47ab89341706fd878255837ec0a7d2d38a1", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705801699, "uuid": "e2e6ef73-827f-4426-bc72-941eb34e05af", "comment": "Malware payload", "value": "229b117f9e298caf50c99afc4d913d8963219abf9c69a02f7aa3b400a0771a89e8018927209900cbc45a051416194500", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705801699, "uuid": "67c5a1d4-9ba7-4f99-99b8-d2084150acfd", "value": "T1F3F4235FB0E1369573BA13501152C092E0866DF9A64F8EE337E26E252EE20739CFF552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705801699, "uuid": "ac49832e-1bf7-4b85-9521-8de8451a60a9", "value": "12288:tC7mc8uJ3Cso8fOXe7mByJsSbXDLAHacyCDB+qG8foJe7KJUNsSbZXs:uPOFE6bNCh2et", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705801699, "uuid": "7b13a4a6-9c11-423b-836b-01c8b6eb4a3b", "value": 758027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705801699, "uuid": "2600b47d-a220-441a-b34f-9440ea7a067d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705801699, "uuid": "c64008b3-dab4-40e5-b11f-9642f9e533aa", "value": "AbroadDuty.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d38aba-b8ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1705876376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876376, "uuid": "2828b70f-6d72-4385-b0ce-427f259585b3", "comment": "Malware payload (IRATA)", "value": "21961df0d7d38838addaca4a73c889a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876376, "uuid": "10db2c78-ef94-4e17-9b82-72b5f58b0ccf", "comment": "Malware payload (IRATA)", "value": "5d5c12060e54e081c8c04910b0e8b2995ab928ec16110314263451e9bee10cd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876376, "uuid": "d643cd6d-eab3-414c-999c-b752eff890ac", "comment": "Malware payload (IRATA)", "value": "8baa96ea5a45f3d9779abb1113824dd4c417ccd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876376, "uuid": "70bddd9f-9b67-4a6d-91be-6b2740655179", "comment": "Malware payload (IRATA)", "value": "743a376138674b386b4fcf3b2ec6a2ddba5fc115fdf25a25ef09188ae7e8dd8fe6f4b69f43a4ef2809366db4a5d9e960", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876376, "uuid": "0dffe10d-4e6f-444b-bfd6-e90506d1b967", "value": "T1182833E1F62F33EAF81971BA2303265277D94414CA55C18DF0EFA0EAB579484A1CAF53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876376, "uuid": "5d2732ea-a353-47a6-8849-29bda8e6aba3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876376, "uuid": "b9d271d0-2c20-440e-98eb-59daf321c6e7", "value": "1572864:JejOt7ysRZuSyMmXGIhLUOp5Mx+3pDQrkEZiMN/XzN6vHCMOFBAx4B4vvQmxE7:JN/RZuSBICqhhQ4EZVN/DNmcqhvvQmxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705876376, "uuid": "427bc499-1544-496f-abf5-7032e9b8fb1a", "value": 99299153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705876376, "uuid": "bf40ac8e-7f37-4989-94e5-35b3bb515611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876376, "uuid": "0ae58ee9-72c6-43f2-8b81-dd8f6ba59f21", "value": "BetaLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0878a46-b848-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705833337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705833337, "uuid": "159171b7-8903-459c-b245-911def523146", "comment": "Malware payload (RiseProStealer)", "value": "bfc9048b5381ff08e29ca318b0cacd70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705833337, "uuid": "3a818026-b9e7-4aad-abe9-a640586b8513", "comment": "Malware payload (RiseProStealer)", "value": "5dee4356ac787ee4f83cfe7268df01b8b6c77ef42cfcd98ed3773745780fcdd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705833337, "uuid": "fe2acb42-916a-4f67-a9b9-85cfbd285028", "comment": "Malware payload (RiseProStealer)", "value": "ff11d18cce7d80134b0e211ba154be3775e559b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705833337, "uuid": "173906e6-3364-4592-ab3b-ee25d057f1b1", "comment": "Malware payload (RiseProStealer)", "value": "717ec3cb7c11a4cb721d88de1410df9a8dcae4858523544a7aee769d2c9633c8c1462fa00121107bf8acb797d86656fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705833337, "uuid": "1e2bb67b-d757-4e68-b364-0c9d90a60a9a", "value": "T174248E5032F68031F7F76932C6B8CBB50E7B7863377194BE1BA1167A0E256D18A2171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705833337, "uuid": "acebf5d8-a5d1-4e8d-8aff-1a82b07f3745", "value": "68649466e471cf2dfe1fd81ad3f6e2a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705833337, "uuid": "59b37a42-510c-4598-8f56-4c4db0830342", "value": "3072:R02xEu9fAZYC8Wa+cb41u76ZGcJzJnmsawZt7/zZoUxUHw:RjWu9fqYr6ZXVawTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705833337, "uuid": "10434cc0-745f-44e1-9204-85f0c8560c1c", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705833337, "uuid": "28fdc69f-6c16-4a6b-b8bc-5c763a245611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705833337, "uuid": "deeb5573-36b9-4e86-a408-a4d14b32e55f", "value": "bfc9048b5381ff08e29ca318b0cacd70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6f3142-b801-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1705802921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802921, "uuid": "2768f78b-997d-4daf-a349-4b217f903a63", "comment": "Malware payload (Stop)", "value": "6b3c3b621f4964f232d23c7b32a2e486", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802921, "uuid": "3dcba58d-2c94-4996-af21-707c636c7870", "comment": "Malware payload (Stop)", "value": "5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802921, "uuid": "c57e9a08-457f-472a-a049-0ff6586ea31c", "comment": "Malware payload (Stop)", "value": "dc7a1111a7fa4380b42dfa8e6d1b22b338aa10fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802921, "uuid": "f52a74b1-ba9e-4e2f-b143-7d33655e7e31", "comment": "Malware payload (Stop)", "value": "6dadde81cfdc5e58cd60e7ac186321e87126357ed9f2ecb3bacfd1fff6ac0dbe1d729e85ae26e1299a0e4ba0179e11f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802921, "uuid": "5d6f78a9-357e-49fa-b0a2-32bead30a0f5", "value": "T19EF4012132F58035F3B7163199F4F7A50D7BB866957296CF6E86027A4F20BD18A2430F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802921, "uuid": "b690c7ab-ba7a-4fe6-ae25-9231cdddcbdf", "value": "c2ef8d3e41174217744d73a64eadb475", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802921, "uuid": "5b19ed56-8dda-4dc6-a6b0-eafc09391359", "value": "24576:nAVmJoIjqT53ve6LT/8EMuuV1y5SYVWuQWJb:AoJ/Q5XHz+7yA5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705802921, "uuid": "53381975-9228-49b3-be06-3c9b3cbe5951", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705802921, "uuid": "79f60991-4d34-4842-a15a-e522652eb2e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802921, "uuid": "3ade7c18-2583-4976-b17c-8ada56f0b7a0", "value": "buildz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5877e04-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829453, "uuid": "ee8d79cc-14f0-47bf-87f0-149ff11332a2", "comment": "Malware payload", "value": "c0607d2fb17d9a2819453576f93cd0f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829453, "uuid": "6a72e721-5d1c-4d1c-806f-d2099bd94bbc", "comment": "Malware payload", "value": "5e449d57c27f8cba062c1376b59ea959228facff0cc5ec6e41e1e1c001bb29f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829453, "uuid": "e73579ee-2685-4dea-910e-133637526b18", "comment": "Malware payload", "value": "82b6f82dbaabebeccaa6efdcc1b49c1f8ec52d64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829453, "uuid": "3f36c813-b36d-42d1-b5f8-0e94e32d717b", "comment": "Malware payload", "value": "afccaebbd63cbad5352d31ebcbaaf3143c6675e55e6a86e0a334ed3a03f717b730cc7e4d7b292a7c1cbbb185fb90164c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829453, "uuid": "c3007b39-d2f0-4bfe-9d1a-9c2ae8209ef4", "value": "T15D258C0BF5D2C2A6E35635700A6E6F3A5EABE5078B708BD35229EE2C1E372515C37131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829453, "uuid": "c1dc007a-8154-49db-8853-84ed57c670fb", "value": "12288:vqlJqLmYniVg6qkEycxqvBuUrAnn8B80DNzB:vIJqq+iSb1zqv28q0DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829453, "uuid": "f375306c-4b01-42e3-9623-e2a7e3422660", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829453, "uuid": "ef026aaa-9692-448b-b328-db5a2c2985c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829453, "uuid": "bead1a21-b21d-4f5b-b90c-6d5366194926", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1S437JY.23681.4422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fbbfde-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829458, "uuid": "06158e7e-dc0b-450f-b5e6-1020ca98eafd", "comment": "Malware payload", "value": "b32169feba80d98e7f865171a0cd45c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829458, "uuid": "9da7dd42-9060-47fc-95b8-4ff6c75d8065", "comment": "Malware payload", "value": "5fbb3fde2cad7a79be14f6410b571d367646a43aefd133d9100a5f48a44101f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829458, "uuid": "19c14931-64c6-4477-b35e-bab61696b013", "comment": "Malware payload", "value": "a44d3e98c4dd7bd6d152e478b54ad1b6884bbdc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829458, "uuid": "ec046347-38cb-460b-ae94-f13fb4ce085b", "comment": "Malware payload", "value": "7421fe0cd88dd112d086f7f9ec3c0b2a082d94b1c26a70f2f610044c57f9968669c34f827ed0eb20c4d165f59fa5977c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829458, "uuid": "9fbaa4b8-e2ae-4e86-a33c-f8d0e1ffce0b", "value": "T188258E21F6E280F2D61915300C7A6B7AEE36BA0E4F50CF83635CEF5D6D325A09E36156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829458, "uuid": "346ed91b-45f0-483e-b06a-cd66cd0226ff", "value": "12288:8ZVrAvE1bdBSv5VhbX1rVeHRPCLqqrXgVQXO2:8P081pBSv5bXpVkJCLqqcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829458, "uuid": "c54447b5-3658-4cc4-8a8c-568cb73c42de", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829458, "uuid": "47106b85-1b26-4b62-8c0a-f117d33c5419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829458, "uuid": "bbbb8bdd-c59b-4183-9100-3e3493ff5d12", "value": "SecuriteInfo.com.Variant.Zusy.429385.24428.21374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15df855-b854-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705838438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705838438, "uuid": "6239a36a-04f5-4031-b5e1-2f0806b637ab", "comment": "Malware payload (njrat)", "value": "d6e07886220dde443f7ee7e7669c11ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705838438, "uuid": "71ca3d8f-e7fc-4e41-a50c-537b094c7460", "comment": "Malware payload (njrat)", "value": "619650da11fb47c9ba3848e5313272a558ff6e5d62d8cec55589ce7af19b4537", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705838438, "uuid": "038fbcdc-ff90-4f34-a870-043107c5a998", "comment": "Malware payload (njrat)", "value": "bf35ccff13cebdb3d137f0bd154e51ab031d6066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705838438, "uuid": "315ce4ca-e19c-41de-a13b-f8161dcc61fb", "comment": "Malware payload (njrat)", "value": "ee45d117fe0d0b96abf10776fcf492e162a4c9a5ea01820905cd0e696f48975e7058c6488dbadff90cd72626011157b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705838438, "uuid": "e79e8de4-028c-4740-9d5c-ddfe9ed1ef7c", "value": "T10184815138D634788973B587D1EBAA394F77F43A0E0A4A7F30246363CB635036E57A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705838438, "uuid": "e174da70-d4e7-46b2-85f6-4f7fcaceff94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705838438, "uuid": "ec966596-c238-419b-a7da-58917c23da6d", "value": "3072:beF4lljDwYGftyh1PWTR+y2EhZ/rFrqqq2eZIYS+g4:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705838438, "uuid": "b0ccaee6-7784-4e57-a227-4526bf2ba32b", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705838438, "uuid": "67195063-d0f9-4cc9-80dd-3e041ab35377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705838438, "uuid": "df1b3add-cf85-4e80-9eef-e45df5fb79f9", "value": "D6E07886220DDE443F7EE7E7669C11FF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c84c06-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829450, "uuid": "609ca730-b5da-490e-b858-ba2df935bb5b", "comment": "Malware payload", "value": "f855e9d495b870511abf85213afca4ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829450, "uuid": "5d1a2750-f034-49b1-b22d-ab109deaa59f", "comment": "Malware payload", "value": "61d828285f7b1b6ad1cb1e171b20121fbbad58c9c88b16aaa0a98bf4d1008c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829450, "uuid": "6ef462be-6f9e-45d5-b5cc-779c96eb310f", "comment": "Malware payload", "value": "e4666b5a65f7207ae4508e6b8b0428b3b0df9bc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829450, "uuid": "9c41951f-9775-4d55-af21-2f3adc020284", "comment": "Malware payload", "value": "259c57176993707b423390673972eca9a058202272b446e6a3e52adbf75eca48ab23fe58b5c559c67d3d28f6dcc7e1fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829450, "uuid": "24424d44-6f75-44f4-aa3a-04c0c455ac8f", "value": "T13DD42324A0647369C41093B3D9B99EB74738AC325E0A93BD741BB3FA1F5E1E07C72691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829450, "uuid": "307b0488-fa4e-4ca2-9d52-ac9911481af4", "value": "a7333743ef063a68d1d860bbdf1c328e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829450, "uuid": "43e47c4e-4afc-412b-81b9-f612ef6f2084", "value": "12288:7QuOJ2SUsxkqVQAxNT5KPGivBUBwuIpyGsbCZeFDqcDBAalx/VwY:8RUs1xzKPxJUBWsbIG5BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829450, "uuid": "e25d28a4-3f0b-4e2a-9828-b9b360d85b65", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829450, "uuid": "7ec09831-6b75-479b-ad12-0a6a35228c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829450, "uuid": "400592e1-4d00-4f8d-bc1f-207a7e348f7d", "value": "SecuriteInfo.com.FileRepMalware.4031.30031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e4932d-b872-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1705851331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851331, "uuid": "4797e42f-255c-449a-bde8-1c6a62957ff0", "comment": "Malware payload (AsyncRAT)", "value": "f24ecd62c00dd9db120fd3d54b069960", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851331, "uuid": "bfe64837-25c2-4eb2-a2e3-c4afa2873be8", "comment": "Malware payload (AsyncRAT)", "value": "630db15b4a855ca42e13666e2046c639a4c2847e0d1fc52a4242ebc369ab26e7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851331, "uuid": "fcab8a0f-b86a-449c-96d8-c434ec269094", "comment": "Malware payload (AsyncRAT)", "value": "9a5f2a032d56b7347781ff3baa7343bf3cc3f203", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851331, "uuid": "b08ab7c2-fb05-4073-9d2a-bd9a13369736", "comment": "Malware payload (AsyncRAT)", "value": "02b090b633e8271dba79a43b48c66a0b554bf04e15142331d30132919813eb0b99f37235f27fe0ee494df81deca37bcd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705851331, "uuid": "3716128f-c500-4616-a4c1-e6be9563e9d5", "value": "T149A79C0773E60195E5B7D2388AA74507D773B8634331CADF329D06152FABAE09A7E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705851331, "uuid": "6aa55904-659b-421c-b344-6930d0128eee", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705851331, "uuid": "776fab63-c30a-4dae-b780-7eeb607ece46", "value": "393216:R1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfL:RMguj8Q4Vfv7qFTrYwPP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705851331, "uuid": "610eecc6-e6d1-4c42-ba9c-5e655c98fa6b", "value": 45401235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705851331, "uuid": "ab0ce9f3-0b8f-40e4-828b-a89dc999a218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705851331, "uuid": "2747f175-532e-4db6-acab-b526fb2b528d", "value": "630DB15B4A855CA42E13666E2046C639A4C2847E0D1FC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d7ac5a-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829445, "uuid": "01ff22d2-9db6-43c1-80d2-6631381893f0", "comment": "Malware payload", "value": "3e72333ed6b6f8f358018d5094d94015", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829445, "uuid": "c6dddd76-767f-4753-87f3-959ac3c09e66", "comment": "Malware payload", "value": "6356588cf41f6af19c0fb4ea113736d9182933a59c261661da66e3f378e09fb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829445, "uuid": "12148190-ef69-44a0-a785-ac84918fc265", "comment": "Malware payload", "value": "3a7b774335da37d40d4b3ac910f48793b01f2bec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829445, "uuid": "7d8e3293-8644-4672-9cd5-14e6a9fb19c4", "comment": "Malware payload", "value": "0afe84f00adc0b3ffccf4e85e2055d9dde571a2d908022e14f8a0cd8d677a4e106d787ffefc755a7db0b8b65c0bb1564", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829445, "uuid": "a55800c2-7b31-4b45-aa3c-08b125de8bb0", "value": "T116C219C74F544992E6984EB065AED23A9E72D1964FB0C2EB536BC4DC2CE53E03D2610F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829445, "uuid": "fa006946-8897-4187-86c2-4d1a97f19bce", "value": "474579095e30868736a4c7d83576b259", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829445, "uuid": "eacbcb9d-ad11-41b7-b373-87fa96d3891b", "value": "384:BGmKa8dNZY5xRbnu4n/2OLLvYH4pt74IVsDs1Y:BzX87ZY5r9n/PL44ptRas1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829445, "uuid": "a19aa0fa-f22e-4441-ad15-eabc075fb837", "value": 26136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829445, "uuid": "335a9ad6-16f6-4ba7-a7ca-ae269e51d400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829445, "uuid": "3e0b192d-646e-4f00-ba29-16d756b48441", "value": "SecuriteInfo.com.not-a-virus.Downloader.Win32.Agent.du.15761.28432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b77c09-b7f5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705797650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705797650, "uuid": "def4bc4d-3c80-4421-8738-17151dadd000", "comment": "Malware payload", "value": "aa12849f36f35868b4e3551bcee1bda6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705797650, "uuid": "ca7fd481-899c-4ed7-a165-498a22c6e002", "comment": "Malware payload", "value": "6403de5e09b48cbd74486e270b3d88bcc71baaf7072b5eedeeef7efc56548ca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705797650, "uuid": "1d113724-c0f0-4cdf-8d9c-e740d9ba33f6", "comment": "Malware payload", "value": "fb5990bb7b25bf915f6a7cd07eb60d9d12be2923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705797650, "uuid": "e3e49b3d-181b-4a2c-bfeb-b4d4c619c3ea", "comment": "Malware payload", "value": "ab2455cf76eb320cf9f41c04b384cfbbbba73816300484a308ae074c6d75b4f0a5c8aeb8a1c0a7bff610843dcb0866f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705797650, "uuid": "a4af772e-8c10-48ff-a3d4-fdeced9947c2", "value": "T1D816129C721172DFC89BD4729AA85C64EA6078BB931F4203A07316FDAA4DC97CF544F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705797650, "uuid": "5bb33fc9-1697-4e3f-9e50-37f8971b2a74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705797650, "uuid": "965e0ca7-0e57-4738-afba-2fab88d6ff57", "value": "98304:yOPdLnGSMoAH7vPi03gcb435lgsXp5OiY1HzQaIS0yVfTLN:ZPlMoAH7Hi0nIHGZI5irx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705797650, "uuid": "fc49307a-0f17-4a10-a650-2179eab7472a", "value": 4317184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705797650, "uuid": "a03e14ba-e575-41b1-a409-263b58f0e253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705797650, "uuid": "bdb9998e-698e-4d0c-b167-c73e457051ab", "value": "SecuriteInfo.com.Trojan.GenericKD.68092645.24402.27266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c417c4-b87a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705854631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854631, "uuid": "3c9f0916-d373-4996-adeb-d425e1b556e0", "comment": "Malware payload (njrat)", "value": "f9180be93d7d2b91d67cd4b396c8f37e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854631, "uuid": "ffe2d6f2-852d-4040-a88a-79e19460fb06", "comment": "Malware payload (njrat)", "value": "64403ff7f6f5bb72e66567c526f2b7301babcce1d40aeeafa01a72d32272932f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854631, "uuid": "97f08026-95f4-4ef4-bac2-48b8c88dc2bf", "comment": "Malware payload (njrat)", "value": "cd5661cd84967955496d25a81d2c9afe06c72af1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854631, "uuid": "2c7ad978-59b8-4734-9874-20bea19127d1", "comment": "Malware payload (njrat)", "value": "253082d6e8389612ca4633e2e0173f4123a53fd0240f5d743d322ed9e2b4c73844b2eb55b3e20b4eff51ae200508af4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854631, "uuid": "24c61d5d-d1d9-475d-9e72-b089d68b5f5c", "value": "T181A21A4E3FB88966C5BC17748DB5961103B0E1870422EE2A8CC550DBAF73BD66D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854631, "uuid": "76fd58f3-e55e-44e1-b4ff-a575d3da238f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854631, "uuid": "a2f60a6b-57fd-4688-8ad4-807f2cd720de", "value": "384:HDweXCQIreJig/8Z7SS1fEBpng67gL2IBPZVmRvR6JZlbw8hqIusZzZeGFu:HULq411QRpcnu3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705854631, "uuid": "b6b6e872-9e79-464b-a2f1-e0ab7f9a809f", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705854631, "uuid": "d03d38ac-d239-47f9-b6a8-2f480245c6a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854631, "uuid": "526c2d5f-7ce5-4609-8709-d61bba4d0693", "value": "64403FF7F6F5BB72E66567C526F2B7301BABCCE1D40AE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb21334-b801-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705802864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802864, "uuid": "420227e9-1f50-4d93-9992-a2cff331694a", "comment": "Malware payload (Stealc)", "value": "e296752dccfe6ef1bfbecd495bf22006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802864, "uuid": "6d4f2e80-56f7-4464-98a3-578bb549bd25", "comment": "Malware payload (Stealc)", "value": "648166dff73b5133f600a6011138ad19d01667fa7202b3050dfa627f96b89d0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802864, "uuid": "30ea1943-0694-4b3e-b5c1-9b7a5318896e", "comment": "Malware payload (Stealc)", "value": "9efdb4177ce91ff66ac40b4aeaefc2906da24b50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802864, "uuid": "1b5d74ba-e3ba-450f-a0a5-d43caf21b4ac", "comment": "Malware payload (Stealc)", "value": "6e1d09f94115d5bc3826a9b1d34acd0c0331345817cfd040c610613dc010b539c8218b589e24585c748a97cd0b1eef92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802864, "uuid": "6741fa69-64bd-4c6d-b2d8-46c4080b1f30", "value": "T1F25602ECAAD97518C1F323B544750A8D9ECBBF033FCACF0E00E1556D850AA92E5D626D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802864, "uuid": "233bbcb7-88fe-4b8c-bc7f-da8340acf505", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802864, "uuid": "5e6a3ebc-29c3-4fd3-91ff-88d4f9be1634", "value": "98304:gLf+58sq6Vir/2staH7QCBSl1IlhyfwC5pvm5+KtrNEC0TtyvcjZ/09Br12SYoEg:78sqyir+EacCBSl1uC7sFNEC0Ttyv00B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705802864, "uuid": "d075d6a4-bb4a-4a0e-adfa-7a0bdc8e3192", "value": 6193152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705802864, "uuid": "3d0f6c7a-60cb-4b6c-9017-a01840020bac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802864, "uuid": "ddc24a61-c22e-4fbc-a7c9-a5deb975956f", "value": "28888c47bbc1871b439df19ff4df68f076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c10410-b877-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705853241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705853241, "uuid": "263e8aa6-427b-4e26-90ca-a3ca97f18b27", "comment": "Malware payload (njrat)", "value": "6422355143a1281beb8bbbc90db64249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705853241, "uuid": "e27fcc44-16c8-4e6a-af1f-da5d41648e7e", "comment": "Malware payload (njrat)", "value": "654553fbf3eb2b4d62f626efcd81da99001f87857c7efd8f49f8281459018c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705853241, "uuid": "8c0f9fef-26da-483a-8b5f-be9186ec79ea", "comment": "Malware payload (njrat)", "value": "1c6ef0d9714e223e42e15c015481e96291a546e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705853241, "uuid": "9095c736-ab90-46b2-845d-ad5ae17d69a6", "comment": "Malware payload (njrat)", "value": "d75952c51ca670a5e31424afe0275b88c89c8598892ac23178ae31832a422abd16e421ca0428c9c0b09a3d4bdc57b9bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705853241, "uuid": "07d1eace-09e9-4c1d-8125-857fc8231a1a", "value": "T1A4E208067BE94215D6BC5AFC8CB313214772E3838532EB6F9CDC88CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705853241, "uuid": "fb596b5b-c867-48ce-bdfa-c886a776622d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705853241, "uuid": "1304a1a1-04ac-4ee9-8ee3-68cc7768749f", "value": "384:S0bUe5XB4e0XqOzDw0Q0mS03AWTxtTUFQqzFt8Obbl:LT9BuZ455dIzbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705853241, "uuid": "69775bb4-8442-4357-896f-b95567427623", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705853241, "uuid": "70a3221e-c77b-4d92-b921-0467e30e6aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705853241, "uuid": "56f94c58-5ed1-497c-8c67-488e6e57bf18", "value": "bTdz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2637ad0-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829447, "uuid": "72ca4d21-9374-4ca2-8957-9bf464d04a47", "comment": "Malware payload", "value": "3ba553bb9e43967c3f082a4350b933a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829447, "uuid": "c3584c39-a162-464d-b52a-125bebcc980f", "comment": "Malware payload", "value": "67f5bba5f2014cb49b1f29c88113834a55c12c0c3e54b0731f92ad132d587af8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829447, "uuid": "9a377cda-b436-4201-ab8e-ef95365ccb9d", "comment": "Malware payload", "value": "bc165513b0210840691003d73b509023784e92ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829447, "uuid": "ced1b2ba-cc46-49b1-8e55-50bf90114e73", "comment": "Malware payload", "value": "9b5c59fc0b6d2e701b3db0c1649f072ee6d45abd3bdbcfee23c4463ab81bffdd13112d9f29cacca832674d5797879a0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829447, "uuid": "c65ef207-97ee-4d82-a4d4-6a7838f6de26", "value": "T12595F1CED9072333D3A654F0946A9C8CDD690CE2DA7CE56633D6534274360BEAC3A16E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829447, "uuid": "21a7159c-04ac-4930-b255-1e12fc589039", "value": "3c0e71b329777d5eff973d94465ac05c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829447, "uuid": "4854f8af-dabb-425c-9e59-07faa5e392e5", "value": "49152:oSIli3vmqbDKN7GuZa17j7ignVHVVkEhuTZXcCmpxKN4XyR:oSoi3OPN7GuZIjnVHVVka0XcCfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829447, "uuid": "88054a02-3738-48a7-9b2c-c25f98375ec4", "value": 1937408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829447, "uuid": "9a19f0c6-dc21-44d5-adc2-9d5f645c1e31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829447, "uuid": "fb742b78-e1e9-481a-bd30-97dc793ac4c0", "value": "SecuriteInfo.com.Win32.Agent-AXGJ.26296.2938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9016ee-b808-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705805731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705805731, "uuid": "7939e46d-bdb2-4e19-97ec-5971db0666d7", "comment": "Malware payload (DCRat)", "value": "adca3b46e05698f48dcb89453cb5a076", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705805731, "uuid": "b5628ca2-9b1a-4207-b20d-e475fc182c68", "comment": "Malware payload (DCRat)", "value": "689d937f87069a7cb6b0dfc4c1fc970186b7c222e4f4195441937d2fdf9e9e15", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705805731, "uuid": "b7988ae2-83e2-45b3-bf3e-eb5b6b5d1145", "comment": "Malware payload (DCRat)", "value": "d45ac37d633bb86b747e2f3a0ab8af28ae5b34c5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705805731, "uuid": "dc0c7d04-cce4-466f-9a2d-efe09e599f75", "comment": "Malware payload (DCRat)", "value": "31dccb6e50b299d86bf4843577359a10d6655ac4fd340de391057cc661f9e87b000058b05d23f6e868b4241adc4b13d1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705805731, "uuid": "9419f9dd-858a-4c5a-bf4f-93878f749e0a", "value": "T1CEA5BF6679D28E33C36016314557123D82A0DB36361AEF5B361F2497A907BF18BB22F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705805731, "uuid": "6890b365-fd38-4987-9a33-23fad0c9dfc7", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705805731, "uuid": "0ece7daf-8965-4f7b-85c8-82b3fedfa70d", "value": "24576:2TbBv5rUyXVBCw6upkjYk63MPqSOs16bIfyjVNyRdfLjgeLGI5w1X4gjXe9NzSzQ:IBJBrs1OIfUNgdd/5wWgIBS0vPkrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705805731, "uuid": "7b7d5225-da34-4890-a2b7-10f3f81e7399", "value": 2250571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705805731, "uuid": "00b9f048-dc8e-472d-998a-97604901448a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705805731, "uuid": "0b8fa7e2-ad38-4439-9459-9b0e917d6c0e", "value": "adca3b46e05698f48dcb89453cb5a076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b76a416-b8ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705876600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876600, "uuid": "ae198a71-b5a9-4260-bed1-e7fa83de5e7f", "comment": "Malware payload", "value": "30f75b5f386f045ce1b13df57cc2657d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876600, "uuid": "870bf31b-fd05-4ce6-b524-e8d9419f2ae1", "comment": "Malware payload", "value": "694ed24b3ff06f0573e2d1ee9bd9ef0af4eeca4b3aec63c072b7ed13c281e60b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876600, "uuid": "252a83de-4292-4566-be24-d78e2aacc4b4", "comment": "Malware payload", "value": "dde34d049cdda7a21e1ca29e53146b47002d1258", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876600, "uuid": "9af31305-f313-4ec9-b769-4ebe37ee0b49", "comment": "Malware payload", "value": "8905a55a6b8a7e67b9dd0fb6db2e1ed6f69923d5e51fd46d544796ecc998799f01c2e461d6120d1e54627187e303c705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876600, "uuid": "64ca9255-ddbd-442e-a8d7-007b4ee2496b", "value": "T180F4F431DDF6D0AE853200602399F8B90E1C81226BB78CFF9F495945AC20DD9B7BA5F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876600, "uuid": "f5ffab9b-f0f9-4aef-9e93-04f4aa5c9eb6", "value": "e23f18375b270285046dc93de15784b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876600, "uuid": "884af451-bf15-4819-8435-3b865d0e684e", "value": "12288:srKGbqc51q/x8yiMUqczLxmFdKltFo5DVaniDo7RYUbqSu9gGDgGc4PK5rSeueLs:arbqc58/xDiMUxL00lfDndaSOgUe4PIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705876600, "uuid": "8b0dc978-951f-4b7c-ad59-1b2a752dcba3", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705876600, "uuid": "db960789-abe2-407a-8430-395785f0dbf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876600, "uuid": "c5e149c4-ab9e-4569-8549-e4c35803dabc", "value": "SecuriteInfo.com.Win32.SuspBehav-K.17162.23626", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8993557-b835-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705825190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825190, "uuid": "f0d4e326-67c9-4864-9908-3e4b7839154a", "comment": "Malware payload (Mirai)", "value": "9556203e0d9e9c56c7ef4c417998ff8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825190, "uuid": "fb83f60a-df83-4ffe-955c-66fb7e84bf72", "comment": "Malware payload (Mirai)", "value": "69c4f1ba9c95d8967188f1eec080baa271dfc5c6fb9fe9e171343a656d040e52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825190, "uuid": "11379e5a-403e-46ff-b1d7-3188b35ad9a8", "comment": "Malware payload (Mirai)", "value": "807c1a1bffc71ccb9725d13553b50ff08b7ae73c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825190, "uuid": "6627c00d-8fb0-48b4-912f-b336599aa82b", "comment": "Malware payload (Mirai)", "value": "a45d1bcc6607ffcff257a2e6a9b31e82f10f65dd1ece547361497bd1044222612d4a928b303f88e9ae1c1a25bc8d1e1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825190, "uuid": "4d063aed-41d7-40a2-97a6-dfdda7024977", "value": "T1073302B3676E29E291B09777FC33BC1696EC16B85C6730DA2CF05615B3C58024AF2786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825190, "uuid": "37561c89-72d0-4b34-a9be-8b8acc59ae55", "value": "1536:j9O/ZMAXIxNUk0ZdvWLcPqF1aBexo4opKZbm:j9O/ZNKy/WLGqFUFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705825190, "uuid": "01284bfa-6394-49d8-a4a7-11a6f659a461", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705825190, "uuid": "15b0057b-0351-498e-a52f-b0ac091023d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825190, "uuid": "2c5211dc-7384-4175-a1ac-2994de70dc42", "value": "9556203e0d9e9c56c7ef4c417998ff8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6652741-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829427, "uuid": "560508a7-3cdb-48e8-a48b-637788c89f6e", "comment": "Malware payload", "value": "c1be7c48e7c1fd2fa931a47a1e6b1e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829427, "uuid": "b48d9a08-72bf-4622-b947-f6751737c216", "comment": "Malware payload", "value": "6a108c7483a5fa785399fac1b66889d98a55d53a55f1049bedcfd2654a6a9a57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829427, "uuid": "dc18f0a7-1a4c-47db-8c18-bc8223162de9", "comment": "Malware payload", "value": "06bbb74480de474579f74f34c5fd6e81f96f0413", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829427, "uuid": "cb7885dd-6f9a-4b54-b29b-5ba6c6e639d0", "comment": "Malware payload", "value": "9bdc910bf9db37a9259ff630a49bedd86047bff52708d52dc1d9dc98ad57e291ba1d61515de98e361a033f0f4abfdf14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829427, "uuid": "dd4852aa-8571-4edd-af1e-b8b3f628b42d", "value": "T13C95335277CA9CB3C4201F35898FD2E89339FE18C7990D9F74E6B71E6A709471A4A20D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829427, "uuid": "6cb68a84-93c2-4e90-946b-bc7757532286", "value": "c62c18072ca5a95e18bbcbafb1a78bca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829427, "uuid": "3229b524-05ec-41c7-9e1b-e0b872ab171d", "value": "49152:uJd/lNLZgaO6a6mVy4h6+yU7JyndjiVnDuQAZ+:yxGaO/6P4h6+ylnoqQAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829427, "uuid": "2c29ba10-9295-4e21-a3b4-827138d3bb40", "value": 1904640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829427, "uuid": "7c47173a-a7d8-456f-aa21-38b66f832ae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829427, "uuid": "340136d5-49e8-4f59-b77b-5a95c24ea1c4", "value": "SecuriteInfo.com.BackDoor.BlackHole.15202.756.11929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ec7121-b89c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705869185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869185, "uuid": "59bd5cf2-b2d0-4177-b98a-752fcbfbda66", "comment": "Malware payload", "value": "612f646f441b40472c77829ac16522f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869185, "uuid": "e7fa07ba-d1e6-42d7-b31f-c38542233e39", "comment": "Malware payload", "value": "6aaf7768525102f1d8f6418756663c78898e0b701222a196636dfe3d9fb23c62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869185, "uuid": "28ca5a87-4e3d-418f-a2d7-5a4c4edd25b7", "comment": "Malware payload", "value": "e9b111b6976c59f22298a6235d81c49d5c4a3875", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869185, "uuid": "d23dbafa-52dc-45eb-9652-67111c61c92a", "comment": "Malware payload", "value": "ba441965f8ca21cd2b07c9842b7475489236def64ccdf03b08d4b0aecd10e32617512bd4d7cc22b13131449f5726e8ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869185, "uuid": "c5479a43-0777-49ef-be02-05901003fca5", "value": "T184D30221D6AB6235C50A63FB688D124613B4E308DE4F9D09B44D60AEEF9F75CA303797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869185, "uuid": "20fe985d-802c-40ba-8f3a-eb1bf673743c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869185, "uuid": "660bfaf0-7af3-4233-a99d-801c4335c2b4", "value": "3072:sxSe7gV5h9OJvq7PeuSa4H9tIefKv+cpCnuOvWN:87Q5hGq7BSBH9t9f/OCnuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869185, "uuid": "14c20232-8cc4-47af-bfe1-29c9c3934782", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869185, "uuid": "ded38d14-2975-43a3-9709-55fca79694d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869185, "uuid": "6d8cca4e-3137-4865-8915-26a56cd7cba1", "value": "Control.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691fec8b-b82e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705821996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705821996, "uuid": "21a1afb1-d1fe-43c5-9a44-cc114386826f", "comment": "Malware payload", "value": "92d08d74abaaa36562ece66f8cb625ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705821996, "uuid": "b327ee90-efa0-4426-9cf9-9b46bcb18f4b", "comment": "Malware payload", "value": "6c0edcc6278bfe22ceda9e478810f6854073b0ef13ef809d5e734ab1829275ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705821996, "uuid": "e8876505-4e12-4087-aa32-49b4d88282b3", "comment": "Malware payload", "value": "5f4fc3a69691f9621d1f77a6a42247e2d439c8b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705821996, "uuid": "d520e9f4-8199-4501-8798-2ff5daec7d58", "comment": "Malware payload", "value": "fc3b595bd6ba0b26fc80404e3e0266d59164ad5e2f913c01b0ca08369d535e31a4d5cda49d2a1f200cb8f925f593a370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705821996, "uuid": "86c6e4ff-e651-46cf-a80c-e567b5a2c5f5", "value": "T1E0A6224135C660F1DE881831303FAFFB767E0A664B50C99BABC7FA395D32A91A07B151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705821996, "uuid": "b1625883-1e9d-45e6-903f-817070ed463f", "value": "a9541f18fbaef243bd51c677704bb962", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705821996, "uuid": "94699753-46ef-4c9d-aaf1-de4206458d03", "value": "196608:W0nt+yt5dkdaBdOkdsbMaQnV3QOKjlAxS+79KDls:Bt5dkd4dOnbkeuxXBY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705821996, "uuid": "0f96c4e5-1445-4233-bc0f-cd6c9de48f9c", "value": 9814528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705821996, "uuid": "c97c44ee-b6e8-436f-a2aa-68ed8616d7a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705821996, "uuid": "f990788a-e113-4209-8e88-76f808c72a1d", "value": "SecuriteInfo.com.Win32.Evo-gen.28503.23064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1da0cfa-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829420, "uuid": "6120b1d1-2cff-4d3f-9b7e-468d8dfd176a", "comment": "Malware payload", "value": "51425c1117ee12abf85e0663c859c108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829420, "uuid": "28dd8b89-fa57-4656-8d31-fee73f8f7902", "comment": "Malware payload", "value": "6c1554ac23d56ae33ed20b5db6b6b3a17ba859ccd3181000524fa0a208483cbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829420, "uuid": "65c798f4-b0f9-4dbb-ab1d-00f711519a3b", "comment": "Malware payload", "value": "737205481a4615f38d9618342220057de69adc25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829420, "uuid": "17ccfc82-d82e-4091-a3ca-caae8121622f", "comment": "Malware payload", "value": "cbab513d14b3e3faf1dffca35a8531c7f88f26a6ad78d3414d9c4f07d2efc246035393139e9c4a7ee19691133dffd251", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829420, "uuid": "66bcb8dc-4239-4509-a20f-fb7ff9b968e5", "value": "T12F1518D164928CF7FE1B2530057A6F35BD64AE520A048ACF7B34F9580C32DA2AD27D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829420, "uuid": "3f0736ed-a277-4d04-a592-b996e80ce4a6", "value": "6144:l8yHsLlIbFJ+k3p7rZGN+XEi8CpUhavWE1Y+tM3IoNCiWcEpf2sINX3TY253MmZQ:lHSlaJjrYEXEi/pPYNvI/cEpe/np8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829420, "uuid": "609a827f-4ac8-4c22-bcc9-ce753861d470", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829420, "uuid": "da8bf8e1-e5b1-4cf0-a446-ba3e0a124f78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829420, "uuid": "8efd468a-f0a3-4b0a-9cab-b4714e963e2c", "value": "SecuriteInfo.com.Win32.Application.PSE.1OV7PVV.4511.17660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83101db1-b83a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705827194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827194, "uuid": "e5356d8d-6d97-43f3-9353-b86d96f3f563", "comment": "Malware payload (Smoke Loader)", "value": "ab14f43efa13365143d763e08f28e482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827194, "uuid": "03abe8d0-f469-40bf-b3b3-342116e46c8f", "comment": "Malware payload (Smoke Loader)", "value": "6c625069f2f2e6815a0c542e749b12678876af8e954ec6ebd2244d2f4eba99d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827194, "uuid": "6ceb661a-6184-4ed2-a3b0-36c3806d7e0c", "comment": "Malware payload (Smoke Loader)", "value": "cf0e89f91a9ba4008898d13d29894389fbfc9465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827194, "uuid": "27586328-8451-4a3e-b4ca-d76868f42beb", "comment": "Malware payload (Smoke Loader)", "value": "2a89f9e888d2186094804a9f19b128c4276031aeaafae103552947ad67be16cc10dd47f64f55589e5caa21ca42da7740", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827194, "uuid": "7c4659ad-7986-4e9c-bb24-43d4face0c9f", "value": "T1CB345C1392E17E51E5A68B328F3FC2E8765EF6518FDA775922388A1F19700B2F123711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827194, "uuid": "71a66dff-7ae9-411b-b6ab-ac7f6fc0b2e9", "value": "e0e4d350eec84bd11f6f18b6d0e645d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827194, "uuid": "57c0a921-76f6-460b-ade4-b179129a8f60", "value": "3072:chSLF4J1ow73jLyC3pvPd9Ho78bur3HIDvsYlsbEnoMtmIozTD5y4Ir:chdTjLyC3pvPDsrXaFnoMtOzw9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827194, "uuid": "fae70a74-68ef-4c3b-af82-9727fe9a5471", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827194, "uuid": "b7c96288-f1b6-4f71-9c7a-0d26d1c1f490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827194, "uuid": "cde99627-b280-4f52-a558-17a1e8783ee9", "value": "ab14f43efa13365143d763e08f28e482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab5ba13-b89c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705869458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869458, "uuid": "a768e720-f8af-4d1d-ba2a-a1eaae20f794", "comment": "Malware payload", "value": "bade1ca2a8a124dab3d18bbc4c4df1f7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869458, "uuid": "8bef92bd-363b-4021-9845-e28ec25bdce5", "comment": "Malware payload", "value": "6da0257a7a8e9ac18781c93d6873efb942f7e631559882a1fd731a6921963a5a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869458, "uuid": "18f7e177-2bec-4a4f-8907-90daba2aedbd", "comment": "Malware payload", "value": "d9d7e451ee103367195204edb15dba52c0fe8908", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869458, "uuid": "dd9c31c8-7dd7-44b4-b48f-fa2c7ee33c9d", "comment": "Malware payload", "value": "a880f07e90e99f49674dd67a8e93b6df1deb07b8be66299cb398649bd02e86444c28240be6af0203074bd5f8697a7a26", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869458, "uuid": "067b7e04-6c08-4cfa-822d-a616ef67813e", "value": "T1E9058D09B2B463B1FC17A4F18BD49A8E4CAAF939874A71DF6F640F29F214D7C3618116", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869458, "uuid": "b6620753-96e8-46a6-87e4-27a82afd589d", "value": "2cc68961dd8a09287e908343d46b30d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869458, "uuid": "9aeaef21-b66f-4aaf-b2c6-362865c42e5a", "value": "12288:dqUL+fPfio9HKlf6N6UuHILKSGWTo9T7VuP06B4unIFpeoAW4qAYZqK0:b+X6yHK9AXuoLfdo6P0KIFpevDYUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869458, "uuid": "13fb28f3-ca89-4993-97bd-748f8559b4e3", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869458, "uuid": "872814df-9edb-47aa-9322-f1cebf166080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869458, "uuid": "4e8ffb44-5294-4bd3-b820-e64e8e5d4a5c", "value": "executable64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76612822-b89d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705869693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869693, "uuid": "37aa8427-62a0-4bca-8af9-a2c91824ab93", "comment": "Malware payload", "value": "6be102ed0c110d045a277e723b2c6519", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869693, "uuid": "a796079d-208e-41e8-877d-5154ee1ab1c3", "comment": "Malware payload", "value": "7025ba63b11c94f7221aa05a7f28e3d560c7e14d521da25420390c17425af890", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869693, "uuid": "623b4b7b-333f-4668-80c6-e5da83399b7a", "comment": "Malware payload", "value": "e168c8f7f6805798fd88ba126c82c0bada92a34d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869693, "uuid": "5913afb2-31b8-45bc-9912-1404a03872ae", "comment": "Malware payload", "value": "24628801677af66a46ac69596926305dbdd8fe0267d6c241196bb7712df138f2c559c928f6a550bb61a68ba68fa80d6a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869693, "uuid": "13249809-c2e7-4647-9504-a8e04374edd9", "value": "T1DB454A027E44CE21F0191233C2EF494C87B499516AA6E72B7DBA377D25123A77C0D9EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869693, "uuid": "fc404a2a-a348-41f6-a536-b55ed1a8cdea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869693, "uuid": "285bf3f7-0122-47cd-9c71-4f485673edce", "value": "12288:6SNC+Qd9241ju3A8jwbyGdkKCMCUo9iw7eVv3quxkPnTVZYLjtmSYQsyyQtgV6T:xC441jumOKznLZqRfTYLjtmRf1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869693, "uuid": "b6683c84-23d6-4652-89bf-0a758982d0fa", "value": 1170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869693, "uuid": "d25facf3-f312-42ff-9b8e-6ff28a3b315c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869693, "uuid": "19f643da-ea13-432f-9514-3fbcfa9889a8", "value": "libGLESv2.dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd850cf-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829463, "uuid": "cd63610f-2db0-439c-924d-88e41fa8ed5c", "comment": "Malware payload", "value": "a7751f19688b0ade99ef57e21f73b365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829463, "uuid": "8702c781-4ece-4c54-85da-fb999cd18fe5", "comment": "Malware payload", "value": "7056480f91ec4510ee880fc68a81bba689a9e615ed4e2cd1b861a48f715668be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829463, "uuid": "b8183bf8-05e9-4649-8908-a7cd90292c47", "comment": "Malware payload", "value": "14631480de7e20abf058ff82717cfdb00b77eb18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829463, "uuid": "3737b9a1-189a-402f-aef6-a2278732a40e", "comment": "Malware payload", "value": "68d63ffc956f625d8c2575c1cbb2eed4525912e296ce03011354b0f60e0b03716e08bdfba358df5ea198967a53a17f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829463, "uuid": "5eb597a8-042f-4eb4-a8cc-a7791d4fa17b", "value": "T14E94BE08B5B1FC12E05C4CB34DB3E694FA72AB406C51C74F3AE49E6DAC623725A635E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829463, "uuid": "15c717e9-f64b-40a5-a6a4-ede3d6a69f0a", "value": "469b1bae2575baede5bf1f06a01b4767", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829463, "uuid": "1d33fb06-1f64-4f06-b923-08a7a7c77301", "value": "6144:EdFwA1KLwBN6Xi1b/tUJPiRV58aCDe4BJx65tw4:EdLcL+QXiXUJS/8/e4vxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829463, "uuid": "1ffffbb7-ced7-412e-86b7-6b51250f446e", "value": 431782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829463, "uuid": "96c47c29-c68e-4eca-929b-7b8000cfaaf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829463, "uuid": "8648ad94-8783-4bd0-92e6-6aca8f0f7a47", "value": "SecuriteInfo.com.Win32.Evo-gen.21833.7568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932ad6ec-b7fa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705799733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705799733, "uuid": "96683666-a0ee-4966-b56a-7f180ea9c93f", "comment": "Malware payload (njrat)", "value": "aa28701064d96ddddc92dd68f335f5dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705799733, "uuid": "fef7431b-2dce-4c41-84b8-84ecc6671d86", "comment": "Malware payload (njrat)", "value": "70f1e080f972ec48fa843c9f3c5b73968f46b2340a5390f73c1d54595595976c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705799733, "uuid": "0af82877-8bb2-4497-9dc0-20571af07e08", "comment": "Malware payload (njrat)", "value": "4dfeed68ca8eddaa2a0a82ab8658eaeb8c5784b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705799733, "uuid": "6ee7a55b-87c1-41c1-bcd5-da453ebc832c", "comment": "Malware payload (njrat)", "value": "7598db1ad5c36654de5e54c14c6d8209c6ba0ad52a1d8361d15d644f83c7bb43cc109055e7b3afa533807afb29c461b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705799733, "uuid": "b293173b-0f5c-4f1c-8e1c-962e44ad0ee2", "value": "T1A124BC9ED117776CE04586B1AD93FF40818E3A362B774A8375F86FC91BAB309A40911F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705799733, "uuid": "4f082cc5-55f7-403d-9b3d-a10087b2ebba", "value": "a2bd1bcf7f29586f73f6cf577621cec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705799733, "uuid": "c245925e-53ec-45d6-924c-c6bc3df9a7ad", "value": "768:bC/rusgh5bSXH9orV0hGUjxogzbMwjFyuuCxaFPfDvJU08k:u/gzbSXH9aPUdz3FkC+XlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705799733, "uuid": "47481aa8-356f-4c32-9fa3-8ccff317f0fb", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705799733, "uuid": "13b761ef-e630-475e-a559-d87c809af9e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705799733, "uuid": "0f89a86b-3527-4ab8-b267-268c706856cd", "value": "AA28701064D96DDDDC92DD68F335F5DD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94d4456-b85b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705841431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705841431, "uuid": "51901ded-f433-4105-8f53-8de64ef95d1e", "comment": "Malware payload (Formbook)", "value": "ddf2c3396cdf3404b2fcdc0cb32038cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705841431, "uuid": "2dcc6f66-ed3a-4c8d-939b-59b097addc93", "comment": "Malware payload (Formbook)", "value": "717b6db3c90fcbb6d73c9727f664c95fa59a1433447626454ddab5aef6e965dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705841431, "uuid": "81005a62-a6a1-44a2-9c2a-907b7ed0af42", "comment": "Malware payload (Formbook)", "value": "0627a79bdefde1263e460d371851ee46fb720135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705841431, "uuid": "b41fa75b-c6a1-4b97-9afb-cd9f4df9eb7c", "comment": "Malware payload (Formbook)", "value": "94a1da7f4b1290d1a41f82f0fed22baeda31920fa4ac7bbf9f068a7cbc99bc2129f56f37757cbec79573cce51b872956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705841431, "uuid": "f1aea44d-ed01-4478-b288-462168e8df63", "value": "T174A44F282DFF8029F173AEB59FE479AADD6FB26337075859106103868B13D81DDC253A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705841431, "uuid": "5ca660f0-6762-43bd-8633-10ddec7f296e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705841431, "uuid": "cded3bb0-f7ef-4e29-9a30-e4d9e45f1619", "value": "12288:uLi2FcpK5UhoILl5BxduoNBfHQHo5ufzl:uLi2FcpK+rao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705841431, "uuid": "37466798-2fb1-4007-b560-3ec0b679d1a0", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705841431, "uuid": "3d8d6f0a-59d4-4454-9874-2efb7bd73cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705841431, "uuid": "a18ef228-eccd-4c56-b67b-c452b658c29c", "value": "DDF2C3396CDF3404B2FCDC0CB32038CD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b404c6-b879-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705854072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854072, "uuid": "6545c355-39cd-49c4-a7c8-a0f2082c5d5a", "comment": "Malware payload", "value": "ef815145211a1a34f6e93ff364b83a79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854072, "uuid": "9587f7ee-8309-4a9f-b26c-8ca6cd195d1e", "comment": "Malware payload", "value": "73edb93b4c4eddd67d38c7f4681e51216202f8b8aa245460447847652b04e6e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854072, "uuid": "1ef4f43d-317c-4883-938e-53f4a27d910e", "comment": "Malware payload", "value": "5c89bc0d74050c075d1186c29f45b9c1b7a316ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854072, "uuid": "ef7c4618-5165-4489-843f-201ce0420de1", "comment": "Malware payload", "value": "1302c5ffbcc289aad3cdca904e40f770b0375096fc3629939f0ce51465527321154957ec945208eb61f7893b5f2304d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854072, "uuid": "308df2bc-38b3-419a-9f72-877f9d1ce9f7", "value": "T140159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854072, "uuid": "41ed11d6-da82-4cde-8dec-af35940dd38b", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854072, "uuid": "098d8147-88c9-49dd-a695-81162f93e6ef", "value": "12288:5qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga6T9:5qDEvCTbMWu7rQYlBQcBiT6rprG8aK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705854072, "uuid": "ec3bbdb4-4ef6-44c2-a994-260efa03edae", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705854072, "uuid": "925ef086-2e33-4dc6-8973-1c63806106fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854072, "uuid": "ef2ed61c-b1c4-4952-b310-c305ee457799", "value": "ef815145211a1a34f6e93ff364b83a79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf18750-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829440, "uuid": "c59c4c28-cc10-4302-8c2c-43ef67aa95fd", "comment": "Malware payload", "value": "a12eee86b396da07b05c288f6b9844bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829440, "uuid": "aeca8acd-cfa5-4f16-aeb3-25e61f4e9feb", "comment": "Malware payload", "value": "7873975f73ba9d7fb298eea6f1d6477bf62cd17eefa5a6f0bf993fecf851eff6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829440, "uuid": "a0db1363-7921-4d54-9def-c248cb17a25c", "comment": "Malware payload", "value": "5f1979cdbdca4cabcddaef269fcca799d1504df1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829440, "uuid": "f15e831c-1cae-40da-b5c8-24177c99df00", "comment": "Malware payload", "value": "1277843696a2fcfe4fbe64a6f2fa068997a5111e859c0225f0ad73985c40409617476a5c996e8567071fb9a82022ed56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829440, "uuid": "53c4d86a-d673-4d40-a302-033d5874ae55", "value": "T152158D01F59380F3D626143009A67736AA359F860B2AFFCB9360FE6E2D37191D937619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829440, "uuid": "ac68ac5f-0ae7-4617-b3ef-1ab2e4e10527", "value": "1c3a2c88960abf917fc29fc03d5cb79d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829440, "uuid": "495e4c66-cab9-4fee-9cc9-8af220100265", "value": "12288:+7jl48j0jWv8x1H+daLTeNa66+nRPuHI7+Yk72S2GdF:+7jl4RWvA1ed6wlz1uHO+YkiWdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829440, "uuid": "80e2cbaf-1183-43a5-a58c-017fe5b97e59", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829440, "uuid": "34cc4b1b-a926-4bfe-84ca-9999c15c3c04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829440, "uuid": "be5b9c25-9ac9-4f6f-86e3-0a12c15adae4", "value": "SecuriteInfo.com.Win32.Evo-gen.11761.19816", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921ca700-b87a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1705854707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854707, "uuid": "6982cccb-4a44-4a3b-a84e-8905586dfa51", "comment": "Malware payload (IRATA)", "value": "7b5434b70f63659c85a6f74846131a31", "object_relation": "md5", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854707, "uuid": "a5279282-ed21-4f3b-bd6c-5949e7538bcd", "comment": "Malware payload (IRATA)", "value": "787b47c50031a839c96a275cd129beae3b2bb966a0c7519b073f01561a556777", "object_relation": "sha256", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854707, "uuid": "f2600c75-2290-4fcf-acc2-0d54dc4d9419", "comment": "Malware payload (IRATA)", "value": "78ac7e8f8ee08ec2ab3ca192770f43ee76f37023", "object_relation": "sha1", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854707, "uuid": "3241d953-4fdc-4cd6-b487-39b2d7e95502", "comment": "Malware payload (IRATA)", "value": "657c5776e02ae5a8df22c694e530c3e2021ffce9edfdee05a47eda0595d2d3773f2fb66f9c26ea9bc1f6877bd86650c7", "object_relation": "sha3-384", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854707, "uuid": "210e51c5-ee3d-439e-8c42-93bee4e06492", "value": "T147E733006E87F4D7DB51BCBAEB8383E6618D93A477322BE4C12154D9B88718BCE0D756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854707, "uuid": "e872f453-4bd3-4106-b29e-10f5f1a7b693", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854707, "uuid": "2135d7e0-2ea1-443e-8304-4dff0ca56414", "value": "1572864:OyXoONw5lYhIy0S9eI5aTc+o1qJ9AVVMPSCClc2EL7:TXk5qifS8TDosIVW6CCl5G7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705854707, "uuid": "be49a9b8-c5ba-4f85-8a3c-85147921e584", "value": 69679696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705854707, "uuid": "378359ef-c143-4f61-9005-d26c7f393ac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854707, "uuid": "43a36741-cab7-43f2-8464-37f7286f1424", "value": "EpsilonSpaceWorld.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bb5dc7-b836-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705825594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825594, "uuid": "f5d97c22-429c-487a-a0ce-8993f5d8325f", "comment": "Malware payload", "value": "cd60da32f610588c60299adf5e647a7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825594, "uuid": "e627079a-8c06-4300-85bf-13e82f4c421c", "comment": "Malware payload", "value": "7909d22820d90979bfc4ad83b3bbbeb96519f82c1270995d1ad2920e593b9688", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825594, "uuid": "cb40d765-ba5a-47a7-9d85-2546f503dfd4", "comment": "Malware payload", "value": "051cc40c887b402c8df5118a767071b67ee47f33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825594, "uuid": "704b8a73-7cc8-4501-8ff5-9efd62443a8e", "comment": "Malware payload", "value": "b2e5e69c77a99ba09d95192a91798a3e36f9b37293bb26bc394bfa488679429fecd49d4e61e2c25da2de37da242e4084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825594, "uuid": "9fb7b7f7-0815-410b-9bd5-f7fcac335a62", "value": "T12715BF8AA3B401E9D167E03C8467A207E776B49913205BCB27F8C6692F537E07B7E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825594, "uuid": "2ad18f2d-4864-401f-859a-a6df8192e5d2", "value": "ad2b656e676cbb00c688ce97ba3a2f68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825594, "uuid": "4ef2e216-965a-455d-bc65-9243f9e308ea", "value": "12288:lmM7slvRv7lq4rLuCU45qf2/Z2/asRPrb2A/fUxCj2AqeMQmpnYt4:lmMcvRvRuCU4s2h6aGz7fuGKFpnYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705825594, "uuid": "e2b10ff8-01ec-4924-a5be-c72c01584ec1", "value": 925184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705825594, "uuid": "db761209-abb0-4669-b146-29944b047af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825594, "uuid": "4967b91d-dfd5-47df-9a03-95b5b632701d", "value": "SecuriteInfo.com.Win64.CrypterX-gen.21923.26556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3ebf91-b88f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1705863637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705863637, "uuid": "2f3cdaca-0f8b-4bf8-a2c7-f2f51a62853d", "comment": "Malware payload (VenomRAT)", "value": "37fa2e7e97bb22ad70d55986d1a379de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705863637, "uuid": "f91bc617-1012-40e1-8f81-9dde90cd2ecc", "comment": "Malware payload (VenomRAT)", "value": "798e0870efbf28e90fb48671e8ef55bb9b442602cc505522a991153d79f2bfaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705863637, "uuid": "eb7d50ae-106f-4902-b342-e6ff3d36d210", "comment": "Malware payload (VenomRAT)", "value": "1ed663a6bdfa6a9ce443b9cfdee41b65bffa04b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705863637, "uuid": "a406c6c2-e85d-48f8-a3a9-7e993ef3e66d", "comment": "Malware payload (VenomRAT)", "value": "680833e9a1b51c358ff1f9ae91b4a67e4d5d1ab941d6561cbff6d2934629913f317f88fc5a038077e41e08450c9a76c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705863637, "uuid": "fdce540b-e2b3-4482-b008-3cf17d71e86e", "value": "T18EA4C2243EEA9029F373AF795BE4759E9A6EF7633707941D1091038A0B23A41DDC173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705863637, "uuid": "b52b5aaa-73e7-40a5-ba39-76b78c46cabc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705863637, "uuid": "47732f6b-e052-4e30-b27b-ad5abe6d6c6c", "value": "12288:3tqsNFa3Y91xCbY0QBKkPXfx1PG4wLGwI9NhD76:3tZAYUbu/76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705863637, "uuid": "c0e0dc30-ef36-4090-9992-daafbfdedf32", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705863637, "uuid": "c32a8139-454b-4f14-baa7-eb344ef2d769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705863637, "uuid": "a9a6c226-6ef1-479a-b47b-60435899bb67", "value": "37FA2E7E97BB22AD70D55986D1A379DE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978517ce-b88b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705862017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705862017, "uuid": "d6faa43e-a45d-4bc3-aea4-737fc2f44579", "comment": "Malware payload", "value": "ced2b6106c76edfe1ce2aedacbdba99b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705862017, "uuid": "0c4a67be-3754-463c-9db7-8e8032b2740e", "comment": "Malware payload", "value": "7adb9c5b994b53b22602a094f5fd544be5a99e1fd53cc2c8db2802df6e125f03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705862017, "uuid": "411d26e2-8937-4e68-ad6c-20e05d0bce94", "comment": "Malware payload", "value": "cdac579afd679af5fea87e8a3aca090acc97c55d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705862017, "uuid": "4219ced4-9138-416e-84ba-9535005452d1", "comment": "Malware payload", "value": "1334e8cb06177cf0d79a727df38acad0c61b08c437bb80e462e8df9ec8c8236fdc2a74f6eb3eb7f96da8b1f74ff7fe0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705862017, "uuid": "a5e2ff0b-25aa-445f-bb99-cedc5e08e851", "value": "T18237334BD26519F1E9E8913D3248811C8B237D2107F1E9AB4BF5F06A29733E45D7BEA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705862017, "uuid": "7a841e48-ed55-4b60-8bd8-47cbe4011d53", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705862017, "uuid": "d601256c-c730-4248-9c6e-54624bcea108", "value": "393216:xv4QtsPNZcPpUTLfhJsW+eGQRIn/ikWMW4cyQSJGcLA6dpdwqY2o:l4QtsUUTLJSW+e5RCqPk4SQcZAqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705862017, "uuid": "22b6376d-0a7e-4498-b9ed-5f4c63be82b7", "value": 22842580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705862017, "uuid": "4aa66d59-5a0a-4e48-89e0-a58ba8905170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705862017, "uuid": "0a693b6e-8200-47ae-b42a-692da290f085", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.35370.10650.6262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d16c8a-b8a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705873101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873101, "uuid": "930d6cdb-4ae5-46c5-ae2d-e3d600b94943", "comment": "Malware payload", "value": "2294c5c4849ba2e8be5f50df901ce0e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873101, "uuid": "671a44e3-6b50-4987-abc4-8ac90026ee3f", "comment": "Malware payload", "value": "7b53520621913100db88f8ca403e353610334932df8dcbc2e71410ab3f57e330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873101, "uuid": "8d3f10f6-2dd4-4677-9e66-6d50d6d50be5", "comment": "Malware payload", "value": "1e20b34fd10926ebff2b2e23e72325f5719db906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873101, "uuid": "dd497389-9e7c-4d10-90c8-ac5d2ff31910", "comment": "Malware payload", "value": "d975306cc763b20ab3f2bca6ab6ae7ecb4e955dc87ee4f091b013a0998904da59b5fb0a7c6b6c350fe78b16a1e6cb3de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873101, "uuid": "92d5c182-c3fe-403f-ab11-57276f1c7493", "value": "T1B5531A1977879324C9690AFC80E3C41503F2A7D72A73D75E3D8412C55E22BF6CA63B9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873101, "uuid": "21a262da-5279-413c-ac6d-4c1236509463", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873101, "uuid": "cfed8518-9a8a-451b-b43f-7b91855272e4", "value": "1536:CK51tuEh4OkDOcTxghHDcW8juhoafEdmxEor17O:91gEh4zDOqxghHL8qhoyEdm68i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705873101, "uuid": "58b37982-1b26-4fc7-b7f3-cff348837c8c", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705873101, "uuid": "54c054ea-6297-4dcc-b247-a86a8b4f1022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873101, "uuid": "36599a1a-a5ee-4b4b-9464-7d273e41ad9a", "value": "SecuriteInfo.com.Win32.WiperX-gen.21988.27432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd05d7a-b83d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1705828446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828446, "uuid": "d57243c0-54ca-4daa-8af6-bf65c5eaae8c", "comment": "Malware payload (AsyncRAT)", "value": "516c86a848f97f1cec95ca253603d1e7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828446, "uuid": "565cc570-c84b-4ae8-97b4-65863e5312f7", "comment": "Malware payload (AsyncRAT)", "value": "7c7b4d01ce572fb5d63536aa53eff94be082e76127906d91c673bbb4e0d7b8e1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828446, "uuid": "ba233d7e-a17e-4889-a55e-be455be41a7a", "comment": "Malware payload (AsyncRAT)", "value": "4588f8afb6c8c0a9532326e9bc197b178ab46901", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828446, "uuid": "b76a5334-3007-4448-a123-3179e0a6fa24", "comment": "Malware payload (AsyncRAT)", "value": "cf97b01bedae415daac7f4beaf1a42ce815e00980468140a0a2fbc3727fd0fe74809e0d8d3d52f28bbd567d3d72cace8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828446, "uuid": "a108ad90-2052-4672-94e4-96bf2c854a7a", "value": "T1E1F22B487FE4822ACAFE2BF529F2651502B4D503EA13D75E18D8959B6F37BC08D013E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828446, "uuid": "097c56c9-c83a-4e4d-83c7-e7c9f9688791", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828446, "uuid": "045c9002-3ed2-4bee-ae42-b1f77a3b0e40", "value": "768:b4fK1pDGkptwyZScCBSUapNgqlzU/kZl+Bcg4tlTF592IO9h0SURZ:TDGkptwyZScCkU4r9UsZcB54HF592IOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705828446, "uuid": "e9daa955-5675-460a-b41c-c4d6bae77955", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705828446, "uuid": "dfd21776-d7ac-4d18-a00d-eb435ccc7cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828446, "uuid": "a159824d-91a9-41cc-ba1d-884f652f53c8", "value": "1705828445f07ff1c188dc89faa13c1a54cdaafcc8ef41b54b1096edb3ce3eaa0b42904032635.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653487e1-b8a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705873100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873100, "uuid": "d253e3f7-e3c4-4114-9866-2a6d01e1f04d", "comment": "Malware payload", "value": "cca5c282e45251b68430238120fcd737", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873100, "uuid": "8b6950b2-1959-44cc-b210-f75ef56daaa0", "comment": "Malware payload", "value": "7d28181e5877ee2a7cd6160e29c342571cd35e850a5ed36e0a0557e04ff7a1b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873100, "uuid": "4ccee699-33af-426f-99aa-327d041ace21", "comment": "Malware payload", "value": "638e848b8389e04fb8be8ea47a46e28c78110e3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873100, "uuid": "4dc2de65-4e77-4196-b6fc-1249e2709fb1", "comment": "Malware payload", "value": "0b04442493963882bc319d0b0e8e59a970e3d4dcc47d6931dfde35df23339ebfbbce6b0cfa31e06e9de036d84c27031b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873100, "uuid": "86708b5e-2d4b-4c29-8882-79c9b8c24ddd", "value": "T1B6F35A21B4D18072D573153609F4DBB55E3EFC700FA69ADF67A80B7E0F202D19A31A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873100, "uuid": "0a429ba1-f805-4080-8e5d-d6277eba00db", "value": "3e52214ca0f85beb0c51a83e889f72cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873100, "uuid": "31330f31-b841-4454-8f6b-7454ea345ec5", "value": "3072:42TksvlT1cA+DTy+PUJ3hs8vmGUyQ8mwBjZJgp08rD:THHEDTHPAC8+708r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705873100, "uuid": "f1dbe7aa-0b5a-49f3-a310-0845f35379b4", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705873100, "uuid": "665ba845-0369-4fa5-b2e7-b964875baf60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873100, "uuid": "8420f86e-e09b-4711-a22e-1d2d4057581b", "value": "SecuriteInfo.com.W32.PossibleThreat.32703.5918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bec8464-b89f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705870453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870453, "uuid": "0ebf5fcf-0227-4446-a8fe-69fef89dd4a0", "comment": "Malware payload", "value": "c6c9c443276de08f55e112ae8b9805ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870453, "uuid": "1e46e567-12a9-4bd4-8216-ed1725531f14", "comment": "Malware payload", "value": "7d5a7a36c5dec7d16bd7f3abf823879346d4ad40cea0beeeab483ba702ba9a5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870453, "uuid": "84c78828-4d66-4b5c-8722-97315e0a4ebf", "comment": "Malware payload", "value": "7041fbd93d486852df9e7a31cd07e3fa9a38e061", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870453, "uuid": "4cd9ab52-10c8-4674-93fb-7792bb0c0240", "comment": "Malware payload", "value": "4e90805f913ba68d9c50a2727878e0b964a3f407230ed646b5508b02c3d1638e3a44759f1baa551621987fae41cba12f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870453, "uuid": "8dd18e3b-df3b-4844-abc9-033eb226beb5", "value": "T1D4033B4D7FE18168C5FD197B06B2D41207BBE04F6E23D90E8EE564AA37636C18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870453, "uuid": "75f21238-f25f-46db-beae-61575d4235a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870453, "uuid": "5acf9d3c-6aad-4c4e-8b6b-9e784ae22c8b", "value": "384:ZnXyi0mnCVpd3vVmyhKrxTPaczmjcYx03IrAF+rMRTyN/0L+EcoinblneHQM3epP:1BANVdhKrFPa/bx0YrM+rMRa8NuQctN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705870453, "uuid": "ab534813-73f7-478c-996a-a767b7cf71a8", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705870453, "uuid": "0040f32b-96a2-443c-b4b4-7c357f7b46d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870453, "uuid": "faa16e29-d57c-4702-9815-437b54211aaf", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc280d85-b834-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705824820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824820, "uuid": "513fe02d-2167-4250-aa77-6161bd84ee3f", "comment": "Malware payload (Mirai)", "value": "e65319dd9279ba16403ea2f2a33892e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824820, "uuid": "367414ff-6d5c-4fec-91d7-2a4d24bd1577", "comment": "Malware payload (Mirai)", "value": "7e27410d28e8cbdd63cd538820919d9f2fefed60499c466b8437c0170cb9a812", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824820, "uuid": "c19c77e4-0a12-466a-81b9-5c854839281c", "comment": "Malware payload (Mirai)", "value": "35514d57aa74225c02d1149140a357a87f4b0418", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824820, "uuid": "680b00e7-4eef-4240-b29a-215f5eb44295", "comment": "Malware payload (Mirai)", "value": "f64b9af488969bc7df8c1836fc2045732405cf7782d2ac0ba00891fe4407a16c28e224a1b798b2f83f219177cf4a182d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824820, "uuid": "3465176f-622c-4b99-90b7-5b19f4341565", "value": "T1543318C4E903D9FDDC5619712137EB328772F13B1029EA87E7ACAA22AC46B41D44729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824820, "uuid": "7aa2377f-c740-41e9-85d5-3a9004dc49dd", "value": "1536:O13kynNjv6czSEZeLmI37KNCgoTcpoQzWxS2RAfah5iQ:AUyntv6cuEZ437KAgowpoeiSi1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705824820, "uuid": "01d5000b-88f3-4319-a293-9bd01d21e20a", "value": 54864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705824820, "uuid": "3b9d964a-5e6a-4d74-b9d7-f7fa36f6d18a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824820, "uuid": "fb25cce6-f9f0-4b34-bb22-dd7243419cb6", "value": "e65319dd9279ba16403ea2f2a33892e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae63b94b-b83a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705827266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827266, "uuid": "e953ef0d-4276-4328-aada-cc667e794d1e", "comment": "Malware payload (RemcosRAT)", "value": "097127aea3fae1c74c8a32b597a30e49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827266, "uuid": "7c377428-48db-49d2-8e63-409f9961f5ae", "comment": "Malware payload (RemcosRAT)", "value": "7eb6163c64d8a76a6ae68356a2bf76639603dff973c334ef6ef1064850e9fd9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827266, "uuid": "a5f077fc-7058-49c7-be8e-9288ec181dc0", "comment": "Malware payload (RemcosRAT)", "value": "c23fa33a1f723da4a2d429c32f78da1b8982d19d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827266, "uuid": "fdef518f-9734-49e4-8bbd-fbc1d702ff94", "comment": "Malware payload (RemcosRAT)", "value": "470bef387ed0dcf31c7311ec236d9ace0ff7c22d5182dac7786d65b8542967d9071b4ad5cd1e27afb7510de8a78f7cf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827266, "uuid": "0dd5641d-ec1c-4f80-a9f5-7355989437d0", "value": "T143B423C1EB64C823D0E3D134787A5EA78E31D418F5C52F05A3862E91BD3A192B3AF15B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827266, "uuid": "c9106e27-3259-4fb5-a999-3884497af282", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827266, "uuid": "b8526cc4-3be1-4d4f-be2a-41d45048536c", "value": "12288:JRfqNm/Q2uJZ96W9lQpY8SuaPFgGjwRcdo7H1:bqNMjuJaWjepcFzjwRZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827266, "uuid": "ad29e5ca-0971-4aae-a217-539c05ec6746", "value": 505558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827266, "uuid": "d006b310-0ee8-46be-b928-8656a116431c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827266, "uuid": "86c90366-1aa6-414f-be24-bdb4f576a00c", "value": "097127aea3fae1c74c8a32b597a30e49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d875d5df-b83a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705827337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827337, "uuid": "33087d6c-f296-43e2-87d3-0a46fd132c86", "comment": "Malware payload (Socks5Systemz)", "value": "a700e07771888a7e073a04da23496176", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827337, "uuid": "1469daf5-baaa-4af5-9b00-eee7ec36c1bc", "comment": "Malware payload (Socks5Systemz)", "value": "7ee77b87ac780d5f7cbf31cde8c15f943ec92bd7d2b9f8479fab7ebef4a5fa08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827337, "uuid": "13cb33a6-7cfd-4be9-97d1-38e72dd632a2", "comment": "Malware payload (Socks5Systemz)", "value": "f665e96c038d663718757ee72f41ffe83a7b3887", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827337, "uuid": "6a947db7-2e2f-4be7-9c4d-f3e660cca364", "comment": "Malware payload (Socks5Systemz)", "value": "4ddb8d92c5e616f96b2df553159c5f08e665e34be5cd3e473fb5c026e7d7f1d9800a16fa6614b467ad4abd345542fbbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827337, "uuid": "45bea7db-fb02-4f0f-84e1-d7d14e0166ee", "value": "T1671633214C266825E29509B45DE6F618CFB2FE9C6D6E00113F5BB0DE6B35BD82CF2B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827337, "uuid": "023709f8-39dc-4947-8a9f-444b7277c62f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827337, "uuid": "b9a8d13f-632e-4a03-8387-0f6f6183b57a", "value": "98304:TzpwcQs2w5q6OMhLrTRXTlxyrsLoMdGIyxlbArXEGjd358:Zw2hLrT15xyeojIYAYAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827337, "uuid": "3750c409-1927-425f-bfa3-11ec25c8daeb", "value": 4115063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827337, "uuid": "396cbe3d-f86b-45a8-987f-116c6d805f7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827337, "uuid": "a341be0f-94a7-4cfd-b317-8fc1dd6b7412", "value": "a700e07771888a7e073a04da23496176.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a2382f-b87a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1705854493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854493, "uuid": "58f84fa8-cabc-4831-b6f2-012b93539568", "comment": "Malware payload (IRATA)", "value": "01f5883b33357cb0644d02da9fd0575a", "object_relation": "md5", "Tag": [ { "name": "epsilon-spaceworld.com", "colour": "#2308B2", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854493, "uuid": "fc6efdf0-3947-4243-aa59-8724491df2c7", "comment": "Malware payload (IRATA)", "value": "7f765e8e53e0a23021371ef02441508c873c1d75dee5c5269a8181d2373c6393", "object_relation": "sha256", "Tag": [ { "name": "epsilon-spaceworld.com", "colour": "#2308B2", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854493, "uuid": "6eb8080a-c7a5-42a3-91e8-a9468251a27b", "comment": "Malware payload (IRATA)", "value": "5ed7b65e07c562bd6bfc07e1168d0941669714ef", "object_relation": "sha1", "Tag": [ { "name": "epsilon-spaceworld.com", "colour": "#2308B2", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705854493, "uuid": "9532ac69-ee33-4c17-96df-761d8f85dba0", "comment": "Malware payload (IRATA)", "value": "84e2b6aeb8b453e04aba9ca8f62d7fee05c475af04179fb6fe191fd2bc300e817da18248471376c7a995230ea0891451", "object_relation": "sha3-384", "Tag": [ { "name": "epsilon-spaceworld.com", "colour": "#2308B2", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854493, "uuid": "e52a29f2-3a7b-47eb-a55c-72942cc4bf05", "value": "T1FAE733F1C940DA715458AE9344FC6A89FBB0FE4743CEE39220DEA1434168799E3E51BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854493, "uuid": "1117c996-2c75-439a-9cd4-43fb636403eb", "value": "1572864:h9vprtbDzRCDfzAIqb5UInecVlcFVyEgA+2A9RDv+w:h9RrtndgfjqbPne8+VyEUvfDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705854493, "uuid": "3cff4a82-b42d-4fdf-a2a9-fb38dda50bc4", "value": 69787390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705854493, "uuid": "dab6f731-b4d6-46a3-b1f6-c0ce5a5ff27a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705854493, "uuid": "44901fc8-3324-4e80-a5c7-a8c754e4b335", "value": "EpsilonSpaceWorld.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4891676e-b873-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705851577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851577, "uuid": "18f55fd9-0497-4399-b515-74981e3dcba5", "comment": "Malware payload (RedLineStealer)", "value": "26088a8fb975a9efa7af9526b8bba7a6", "object_relation": "md5", "Tag": [ { "name": "cheat-space.com", "colour": "#9E92C4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851577, "uuid": "68a4104d-ca24-4b19-962d-601bd6b5cc8d", "comment": "Malware payload (RedLineStealer)", "value": "816b3910c772e80356a3f91412c4bb7fa0a7860c96e7d0a2fcc39f14cbd5a099", "object_relation": "sha256", "Tag": [ { "name": "cheat-space.com", "colour": "#9E92C4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851577, "uuid": "2d52f653-9c80-4672-8d5b-8adecb90eccf", "comment": "Malware payload (RedLineStealer)", "value": "6d064f7d996f6d0cb4218bf20cf148b278786a78", "object_relation": "sha1", "Tag": [ { "name": "cheat-space.com", "colour": "#9E92C4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851577, "uuid": "d1167e12-aed5-451b-b346-b47671903941", "comment": "Malware payload (RedLineStealer)", "value": "7f7c8887322a6bcaeaed5b30dc644c6b55972864e1244cbecd070b4439d04af520502d9def1fedbe6414028ef73c3b67", "object_relation": "sha3-384", "Tag": [ { "name": "cheat-space.com", "colour": "#9E92C4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705851577, "uuid": "1c9572c2-d54c-4b61-8e09-c62ff88540da", "value": "T192E5BE25358AC636EB7E42706679D77A65BA7EE00FB104DB63C83A2E1EB05C14231F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705851577, "uuid": "7aa94cd7-4999-481d-be99-57a14f48f3aa", "value": "49152:OHrADZKumZrpq4Fb6HXr1iWnYs4ntHurpllQ6azuxtZUTreUuyZD6lvVz9B4PoIk:JKxFnWnyux8TgvVn4QIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705851577, "uuid": "7aae33bd-5840-47cc-a14a-d505e0e2f488", "value": 3055104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705851577, "uuid": "e3be7f1e-73df-4d23-8d74-be377e8840af", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705851577, "uuid": "59907764-551f-4aa9-b7c9-c528b54e6f3e", "value": "Cheat.Space.1.4.3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823f1a1d-b875-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1705852533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705852533, "uuid": "043dc87d-beac-470a-98f6-1aa345842d03", "comment": "Malware payload (RecordBreaker)", "value": "f4d0cda8074bc59ff9f29168cd0866d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705852533, "uuid": "11772829-e946-4fc1-abc0-2516782c8cdc", "comment": "Malware payload (RecordBreaker)", "value": "81b7fb00321a57d0632b50993d514d34e586e86564c1311224a97511914a90e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705852533, "uuid": "1c840584-2c47-47a5-a62e-662943d8106e", "comment": "Malware payload (RecordBreaker)", "value": "8f6ec4b67cce5801ccc68f75560310ad88957e43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705852533, "uuid": "ea0d3b3e-5769-4921-b305-cb51e2c43dd0", "comment": "Malware payload (RecordBreaker)", "value": "7ce1c9473b3c5958263ba38e14fe11db1e44cdbc7b8e122cd40589cd8a6d85bd31de92848824bd2269db5fe752be3d37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705852533, "uuid": "f264f811-7b62-458b-8b2b-2a38629f5943", "value": "T1A875BF3FF268A13EC56A1B3245B38320997BBA51B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705852533, "uuid": "2b899070-baa3-479b-88a2-eeee976158b1", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705852533, "uuid": "3f892f02-33e1-4242-b920-f249069eacd2", "value": "24576:s7FUDowAyrTVE3U5F/OyKic6QL3E2vVsjECUAQT45deRV9Rr:sBuZrEUZKIy029s4C1eH9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705852533, "uuid": "b9528946-97e8-4e12-b334-7c4b18239d0d", "value": 1672117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705852533, "uuid": "ce80a116-6cf2-4a6a-9577-8485bc7042fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705852533, "uuid": "2ddce64e-6b03-4732-bf58-5207997afc9c", "value": "81B7FB00321A57D0632B50993D514D34E586E86564C13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d3f653-b89a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705868234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705868234, "uuid": "0a1931ba-57c6-4665-a1a1-2857c25e6fb0", "comment": "Malware payload", "value": "2f19ef0f99d4429ab3654fa6f43be376", "object_relation": "md5", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705868234, "uuid": "306cb09c-86eb-4386-9f2b-6cfea4292f12", "comment": "Malware payload", "value": "8524a0f1e66222c8a179a105dfffb911662eb96cabc38692cd30f217aa9c4460", "object_relation": "sha256", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705868234, "uuid": "a5d2c0e2-c71c-4c65-bbb7-4fc439693eab", "comment": "Malware payload", "value": "7263db8929f759a3f16243e02e9718beff391ce5", "object_relation": "sha1", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705868234, "uuid": "76b9723b-0fb2-4a9e-b3d2-cb41360ee57b", "comment": "Malware payload", "value": "eb37c7714d133985a43336acd55dd0f66a624977d7eaf9eaac8763033cf01c1616f5f3dbcf266dea1abc503042670e5f", "object_relation": "sha3-384", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705868234, "uuid": "3d5c7090-7ffe-48ba-b3a3-d986e0ed2c89", "value": "T11EE73399FA069667ED50163381FCEBF2B6DD7682B740CBC32B3DFB8568228C5095512C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705868234, "uuid": "27bf6c7d-ed9a-45c6-9b2a-e493a56659b1", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705868234, "uuid": "7d033a64-8136-4af0-9f3d-4c6a7a388800", "value": "1572864:Km68Aw/MlY4wHPg+gOMX5bXlaaftMz86v2dp60E6k:Z68Aw/yYdHPgUMX5caGza60E6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705868234, "uuid": "3ddbd7a4-0f8d-4a5e-9417-a8c2bcd03335", "value": 65692037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705868234, "uuid": "6c3297fe-5cc0-4548-9edc-ee2cdb953777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705868234, "uuid": "acc3b244-da81-455f-9b0d-72aa2e043a0f", "value": "updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9601973-b869-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Trigona)", "timestamp": 1705847471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847471, "uuid": "db3a6441-24bb-4fb8-a42c-9dcbe7303456", "comment": "Malware payload (Trigona)", "value": "c28b33f7365f9dc72cc291d13458f334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trigona", "colour": "#782C0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847471, "uuid": "029009aa-96aa-4db6-b2fe-77d4a4ad05b8", "comment": "Malware payload (Trigona)", "value": "85f4088286ac1eedc94ad9dc6465e9e4b89d1cde3012f9949450fcc9f2b60431", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trigona", "colour": "#782C0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847471, "uuid": "0b0b8807-8e89-4705-8dda-e79aa2e7b7ff", "comment": "Malware payload (Trigona)", "value": "b4ad79b2800a6540f1c460ce6220a4ebb551a18b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trigona", "colour": "#782C0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847471, "uuid": "6b171b6e-4851-4b0d-bdfc-b9b1471be263", "comment": "Malware payload (Trigona)", "value": "b2e45c4265401add4b4e551d5485bc511640d29b2901043b54dd020ecf01de5e7d4e095e6ca2a07e22fac190284d973e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trigona", "colour": "#782C0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847471, "uuid": "3edbc882-d11f-464d-91a8-44c74540b9b5", "value": "T1B8746A3E96814436E0710AF58B66931C603F7E2019F55C5E2DEB4AFCCD3B6536A38B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847471, "uuid": "6e4ef0f8-0995-4ea4-a171-cf5872faffad", "value": "56cd3cc0c6aa320b1afc161092b234a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847471, "uuid": "8a600e91-5f24-47a1-831c-3dabfd5bbe92", "value": "6144:Gx2QdiglMFGfzIBeZO8Wf2cMRsCO/xZqqDLuz+4pQoL27aR9:GAQsgScEydsCJqnuq4z2mR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705847471, "uuid": "a1de453e-5590-47e2-bd35-8797beb9f60a", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705847471, "uuid": "759fb71b-eb7a-421e-badb-45aac92386ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847471, "uuid": "06f0407f-9026-4765-aaed-d8bc01cef5a9", "value": "85f4088286ac1eedc94ad9dc6465e9e4b89d1cde3012f9949450fcc9f2b60431.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7a4207-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829469, "uuid": "a87960cd-a777-48cd-ad0f-642f086c7e0c", "comment": "Malware payload", "value": "bf1592a1d3c68b34c2a00b9f55bf6191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829469, "uuid": "cead6998-8681-4127-83e0-7bbaea587f0b", "comment": "Malware payload", "value": "871f031da2f948767a07cc253468b0bbfe6a243e947cdd6ae7a1ec96fdde40bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829469, "uuid": "3d19d1a7-070d-4c08-aa03-3aab93f2adae", "comment": "Malware payload", "value": "3d1d3b6490def9a6363ebc0305c5bc8722367d19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829469, "uuid": "d9efa3f4-becf-4539-bd73-37c555aa3511", "comment": "Malware payload", "value": "e3c9e83826e1dc0b80a4e1578ce556391d7f3688de467587ff6df86583c925fe886811e1c81c1503c4278b0f4b04edca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829469, "uuid": "6c83eae5-77f5-4c7b-b2cf-2b36e3b5631a", "value": "T1A16423057D655CC9E44057B14319CE0B33CA94AB982A2325A2D4E17FEF53C5F2FAB22A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829469, "uuid": "8f51a075-eced-47b3-8e37-6e6724e044ea", "value": "b96e5ebf22adc79b4d4a141927a80973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829469, "uuid": "ec761c08-d043-4dd4-bc56-a6d344c10f21", "value": "6144:1hWXyA8RTBOIJyYcIqogLqVJx2oX0QP8lDOq2CHu+Jakbx0fOjSO52b4B7ulO9fy:1hWXrQTAG3lVZ0QCDAGuABTJ5yUfd7Mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829469, "uuid": "76534e0d-6d6b-49ee-b5e9-bd2006d0789e", "value": 331058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829469, "uuid": "c26fd462-db2e-4cb6-b483-3f933b8ac248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829469, "uuid": "2866669f-97f6-475e-9d70-af0998638de7", "value": "SecuriteInfo.com.Trojan.PWS.Qqshou.19252.20537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e97337-b88a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705861718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861718, "uuid": "8877a6a4-acd2-494b-aff0-acd0a267e4cf", "comment": "Malware payload (Mirai)", "value": "7b83ed61f7aec128627973ee0dc871f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861718, "uuid": "d014b14a-4c6e-4037-8682-c4d8bd1dd976", "comment": "Malware payload (Mirai)", "value": "8770f1c6a22b805ff7c76f033b9cf30bee19cbcbe920a8184f158753493514fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861718, "uuid": "5b47ecd5-7537-42d9-bf84-efda629a53ca", "comment": "Malware payload (Mirai)", "value": "9c9ce634f4f5f9b18f32df96c05fc435d92cf3a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861718, "uuid": "21654f89-8f21-4a95-845c-72eee9d57013", "comment": "Malware payload (Mirai)", "value": "743feda6a045d65648c303848f9324c58aa46cfdb346111ef2c52b97a2d50de9bbe721334b661112413519d5bf7c64a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861718, "uuid": "5fb4a13e-949d-4718-abe0-55962b6117f1", "value": "T1D6A32AC2E251D273E2970B7512A3CF290532E5672B5F6E29F3683EF8AE16144712B31D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861718, "uuid": "46b61c67-f1d3-4669-8fab-98d6273124b4", "value": "3072:djR8kUrUSUOC+S09Rq9V5X0C2XXXp9NZsg/ot5QCYJ3WmyezXdKCYdoq:ddGjXCZ09Rq93eXXXjsg/1CcWmyezXdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705861718, "uuid": "7ec0c474-a983-4e71-b353-fcc1d804c1c8", "value": 100858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705861718, "uuid": "3df8c5ba-3938-41fa-94bd-884aeded7e69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861718, "uuid": "39933ca4-7ac4-433b-94bc-bd0163098eba", "value": "7b83ed61f7aec128627973ee0dc871f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ac964a-b802-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705803220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803220, "uuid": "232bcc7d-a28a-445b-92ce-2a158b576bb5", "comment": "Malware payload", "value": "d295c4f639d581851aea8fbcc1ea0989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803220, "uuid": "9e46ebaa-ea27-4b76-a2c5-ebce6310a902", "comment": "Malware payload", "value": "8996c252fc41b7ec0ec73ce814e84136be6efef898822146c25af2330f4fd04a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803220, "uuid": "a8893a6f-759c-4dc6-b801-ca93e41e46d2", "comment": "Malware payload", "value": "0cc91f5248ee5b730e79e3d0e517534bd15932d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803220, "uuid": "7e919f74-1e89-4f48-823a-1ffb990bf69c", "comment": "Malware payload", "value": "6023c239bff50c7198a92e33f42a4ddc1873cc7aceea2f8f1acd6b0d2fa336ca733b82433b48c353f57b8efa129bb9a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803220, "uuid": "1453aef3-84b2-46d2-ae6c-daad3bbd4f4e", "value": "T11A549D22B6598172F2110033ADAC5BD086BCA5710E624AD3F7DA652FE9F05D3D520FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803220, "uuid": "7bb06894-3c15-45eb-a8c0-56ae73d1dc36", "value": "17ce412007ec6b063cb9a92ee7b9b417", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803220, "uuid": "aece87fb-0941-4cb0-bb91-a0f9b0aef2fa", "value": "6144:C7iHIcfYlXolTFsr91vzWmUuNTuBjEKz7nwWYcEZoSNDyaS9b/7:VPYJolZsr9kjuNTuVFfnwHYSNGRb/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705803220, "uuid": "28200fa2-3911-41c6-9547-c1d49eed423f", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705803220, "uuid": "40a923f4-1af7-4c6b-968f-8e46d6802cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803220, "uuid": "835f57db-ebcc-4cb1-8d00-0171f7098900", "value": "gsprout.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb6d138-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829441, "uuid": "6cc072a8-c420-4cc3-b2b3-dccc4bfc6a3d", "comment": "Malware payload", "value": "91cd02b3c77e6dc6f393311ff50a7ba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829441, "uuid": "7abc58eb-949d-43d4-9010-43bdabe83228", "comment": "Malware payload", "value": "89acb8db4c1f6fa03eefdd63e445f3d9691329da0659163b51b7803ee049551c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829441, "uuid": "040cb007-97db-419a-8f3e-4bb19fba0062", "comment": "Malware payload", "value": "43ede65eba312205f8a57d1d4ae58855a95748b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829441, "uuid": "f0caf2cc-c1d8-44ca-b5ce-a83f62e8dbf2", "comment": "Malware payload", "value": "6a657521c85eb5258da5ffe78f222be55c0ae50f91fa30ed0fd840880abea3ce4192cc3671efbd87fedad0a459b11059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829441, "uuid": "78717b8a-17e6-4d14-b3d3-d87185c23f05", "value": "T1E26502157767C822E06DCD32DD8B4EE6DA766C14BDC1C59B2FA46EDC2C31290CA63463", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829441, "uuid": "94fa010e-98d8-495e-9288-9b0a41da08e6", "value": "ccae7705d3bafed6b8f5ee79b27d03ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829441, "uuid": "b9851db9-fed6-4e32-92d7-1f4c4691b792", "value": "24576:XWp3wTD6IRvbJcK/KxoGrpzVmQa78x/1Bhl71N1C19o0OmF/FcwgFgGyU:UlI5JLETqxoxNBh/NE1m0OC/jgqGyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829441, "uuid": "5200ca8b-2b28-42a8-9bb8-b7510a7e449c", "value": 1514004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829441, "uuid": "2cb7394b-48f2-4eb8-8b2f-c6a8573bc651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829441, "uuid": "303462f9-d46b-4ab6-8931-b6780b147aba", "value": "SecuriteInfo.com.Trojan.Packed.650.26063.14631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e6a4d6-b89b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705869049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869049, "uuid": "df996f90-27fb-43f5-9809-5395381ae0c4", "comment": "Malware payload", "value": "9c423b78463fb625b687417909fd9d22", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869049, "uuid": "48591946-2b29-4838-9595-3023486b217f", "comment": "Malware payload", "value": "8b0fdf804a770157bd98ba37cc698a1f2579c86e5f13fe96b5da7f9dda10c733", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869049, "uuid": "44164cdf-6bdf-4303-9649-d2cb6532ed1d", "comment": "Malware payload", "value": "929c1f03bd9d36a39e61677885238fe19db4ff72", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869049, "uuid": "cedc288d-161b-42e0-89fd-6e40f433a21e", "comment": "Malware payload", "value": "58b5d853a260292d29325c06b932679ba1c112ef9205f2a106189b15d2f5dc0ef540b3f9cd5d89e53d66d9a77767bf76", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869049, "uuid": "2e025a91-22d5-4c4b-9ca8-c1fb75c54dae", "value": "T1301302378D8D5C64C24182FB31DF4390717A82AE43EA0F58725ACB505785BD4DAFEB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869049, "uuid": "178011d4-8979-4fe6-b8dc-2d93bdec20d8", "value": "768:S2sD3cridM7lrlu+AuclvC1Z/miwzvWKG3Tx0VrRP79TTa1NrklLGH8Lk2J2dI8T:SHPdMBrlmucgpi54k5pYINnRWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869049, "uuid": "988fb01c-700c-40d3-8b3f-0dbb34197502", "value": 44588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869049, "uuid": "d8e7549d-59b2-4687-8724-bd31788ddb1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869049, "uuid": "1addc4fd-5f92-4159-b3c7-af949880372a", "value": "arm7-20240121-2030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d5da03-b89d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705869635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869635, "uuid": "128f5b94-bd3f-4d3b-b34b-e1ce1838cc7c", "comment": "Malware payload (DCRat)", "value": "c01e344b3afbf8c809d7772b4087446b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869635, "uuid": "0e0f13ca-f9ea-458d-89da-4b9e0ee47e9b", "comment": "Malware payload (DCRat)", "value": "8d719797d54ade99d81bc37270540ae77d665a7a11322fbd7cc6821033ee55f5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869635, "uuid": "37fcadb0-4cd7-46ff-8a7b-c0f467c9a3f8", "comment": "Malware payload (DCRat)", "value": "30dbdf97052e450b3649b7f7b2bb59d1130f9769", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869635, "uuid": "4765eb37-454d-4589-bef9-3bd18202bc77", "comment": "Malware payload (DCRat)", "value": "ae2aaf2b23ea556cb2d4a013b00a6131352847d787205666d8acc87e8c867c09f841176dd11b91a6113c76da5f5a1ca1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869635, "uuid": "e3b342bc-8ab4-4e71-9847-e35facff5890", "value": "T192759D417E44CE01F0191A33C2EF55588BB0AC5166EAE32B7DBA336E65123A77C0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869635, "uuid": "6e7989d1-ff9a-44ac-874b-978dd43b8b26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869635, "uuid": "006d76e2-3392-4498-8308-7be490441a8c", "value": "24576:8eaMajUi+6C+mDjn7gbkFaSH7Wu4mIWGE1Sy/fBEXTHhaTEEER71RM4I13:8eaj9bHmMbkBHVdGE1Sy/ujhaIh+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869635, "uuid": "eb9b751c-423d-46ef-811b-6755a2814f04", "value": 1601024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869635, "uuid": "0aa6a56d-393b-4c8a-ba04-2df0cddf9539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869635, "uuid": "d8e190a1-aa3d-48d6-99a0-8de11394072b", "value": "62zmR4jE9Q3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12d87b4-b820-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Fabookie)", "timestamp": 1705816077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705816077, "uuid": "b7a40d53-ff9f-44d2-a565-635ca3810f2b", "comment": "Malware payload (Fabookie)", "value": "90ab18d69c8c28f797acf90b61d656df", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705816077, "uuid": "e3946c5b-3aca-45e3-a3c2-9ca66c4a6e56", "comment": "Malware payload (Fabookie)", "value": "909e4623b8a2fcc82c150fd92a7d85bfdd7d506ec8b8dbf7655ada67885e0417", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705816077, "uuid": "447da0d2-9027-48e0-b567-608d8194f991", "comment": "Malware payload (Fabookie)", "value": "766234b73a93b9b28169b5d51f9870faf983d503", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705816077, "uuid": "4ee0ff31-5e68-4a89-a496-5f352a449cad", "comment": "Malware payload (Fabookie)", "value": "345fb7d3ef41e5da38bed57bb490ed7cbc6b1d9954c314bc15b38acb2f300f71f507d00581cbd7e23d08e327e2d56090", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705816077, "uuid": "e950bedb-e425-40d7-82e4-e1a379870896", "value": "T119644C156FB91CB6C017B43F0C6E84524B337827166783F7A496DEAC0EF76E8D466822", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705816077, "uuid": "e5024b42-4c50-4fb5-b5d6-c0fdca3b16f1", "value": "a7a19cad0c2c193feb43fc00c1b6b502", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705816077, "uuid": "27dc0467-9123-43c4-be38-1c93ecf5e2bc", "value": "3072:oVZTMYQ0qIN6NtVcOXHK5ULK2NUPj0ZeyRS6CSfKVu1xgCAWU8fvJqxEm4x1ESuS:YMnt3HP2PPjqp/1fvoxEvTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705816077, "uuid": "831816c1-4a14-4a53-824b-3848c4dbec98", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705816077, "uuid": "1b85635a-977d-4d0c-ba7d-0322083131a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705816077, "uuid": "35e2c50f-4dd9-4a45-8b9f-20750db9d44b", "value": "90ab18d69c8c28f797acf90b61d656df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a255bca-b89e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705869940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869940, "uuid": "65210d47-aee0-47cc-abc5-7d43eeade73a", "comment": "Malware payload", "value": "79001ff435d6652d09bce9048acbe3b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869940, "uuid": "681431cc-a10c-46d9-8ee2-788af2cb09be", "comment": "Malware payload", "value": "939451e67b32833daf6c6d1391632e2e873351ba4542ffb3ae36beb86b230bc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869940, "uuid": "25873f79-98d1-4a24-8e48-ca96fc5e6f6e", "comment": "Malware payload", "value": "2e0efa48177627a26da347da576fa7fcd9fc1077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869940, "uuid": "ccf3e0f3-2f40-4df4-a91e-e3603c0c094b", "comment": "Malware payload", "value": "3e5f22c40b5a9098150cbe5711ef99ab5a878912bc28b4bed28733d2539aad6577968d9857af69219452bb819c154f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869940, "uuid": "7e6a22e2-dcbb-465f-a911-5151712917bf", "value": "T1B1F3BF18564A46C2D5371E38FF319303CE32997D9A24EEA718B8B6FD37626435081E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869940, "uuid": "56c0576e-f3a5-42fc-a42e-f378b3205d5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869940, "uuid": "d30e07b2-b3a3-4e5c-a7f1-c3d9c63743f1", "value": "1536:tiY0ry05rmUERq0wj4RcIVIbEV3Y2MXrq1tqwyOsQ9AvB/0FOe095:tiY0xAm02bEV0XItqp3wAvBYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869940, "uuid": "a899add5-5eda-4add-b16f-f4b4cadd251c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869940, "uuid": "8a984397-c7bf-4d6b-9162-dc5c7a481f64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869940, "uuid": "4b3c5510-1069-4e13-a156-723d98ee8ad7", "value": "Microsft Security Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3356685c-b83c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705827919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827919, "uuid": "2b36d8c0-350a-46cc-8723-c36efa7ac1dc", "comment": "Malware payload", "value": "ac157704680bfee2dc98b264bd77f6f8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827919, "uuid": "40e9a27b-df00-4c0b-a740-332030078b92", "comment": "Malware payload", "value": "945ba071ae1ecbae02c5ce5bace3e366a07f9a92a639ca85920fa5620bb274f0", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827919, "uuid": "cbf96ddf-aa5f-42ee-87f4-74ac4e0de7ae", "comment": "Malware payload", "value": "155b9c3fd791c33af639d8425ab2bb95e451f4e0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827919, "uuid": "27d07746-ae98-4abd-ae90-11c38dac7d62", "comment": "Malware payload", "value": "a9cd09d957ab4bc22a1a01189792808771231e8d222ea6972d165b99a69e426b78b04380b19c25f7da97a8dc940ed8d4", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827919, "uuid": "50fc1ca3-aa1e-4ac5-8b12-90482902cec4", "value": "T12F55BB342D79BC2447D7EE2336F10A550DE4866FE0303A3B198EE5668A7A2D115B12FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827919, "uuid": "098d4e91-c48b-45b2-ae41-b83ac1fd47ef", "value": "6144:OVElhcrN0xmjYbEeq776GPxejmTGt1uF7JF1:Ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827919, "uuid": "1d47c141-e1ec-4c85-83a3-00ece5ea9a98", "value": 1367892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827919, "uuid": "3f3be4ec-4eb7-4170-98e9-2e9bbd0e9e65", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827919, "uuid": "10e4e8e7-50d2-4e68-89d0-94b08a81bad5", "value": "packagedream.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd96c02-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1705829436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829436, "uuid": "48edfcd0-cc26-49e8-8af4-fb1ac1d83477", "comment": "Malware payload (Adware.Generic)", "value": "29728670dc8206d77f59c6ee3560d341", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829436, "uuid": "0a4aef3d-854d-4d67-9246-649098ec45aa", "comment": "Malware payload (Adware.Generic)", "value": "94fcfd4b6b810e31359593e8d7e25d5fb6df7315bd78f43a43f975a1afafe1b1", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829436, "uuid": "44128bce-06ef-4d8e-a8fb-29bf9dd3a5ca", "comment": "Malware payload (Adware.Generic)", "value": "97bf15bd9bbb28a8482e7bf62f0d5f001dec82f1", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829436, "uuid": "8f63d998-2736-4b23-ac2a-dd223a2a018d", "comment": "Malware payload (Adware.Generic)", "value": "d555471ca1ae2456316a895e8d4297b9cb44d089a1f919a4490e6d3e3eec8da95f3e74d6f4357bf8484c2cfc589b056c", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829436, "uuid": "af411352-19d3-458c-9f22-c6ae15a75fc3", "value": "T13A641247E720917BC5AA4EB22DB36757EFB6B84108F066AFD3C066667A41303E51C713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829436, "uuid": "1bb5e8c2-4fc2-448e-82d2-c648da62696d", "value": "b729b61eb1515fcf7b3e511e4e66258b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829436, "uuid": "e366ae98-c85e-45d3-ae38-6e1c5ff0da6a", "value": "6144:YmJIspJhzGVpkqribzRDFv/ILO5nx6a+B3yUHdxBurBpXTazTRpo:YmJfgS9RDF4L8x6vCU9QBpXTanR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829436, "uuid": "2fae7464-e68f-4858-bd4d-58dc91ae8fd9", "value": 314112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829436, "uuid": "c83c9bf7-7a5a-4a5c-a285-4617763b5b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829436, "uuid": "2cc6757f-d63f-433f-8d4b-c30e0d8fbb2f", "value": "SecuriteInfo.com.Trojan.PackedENT.24553.15769.31275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31a0177-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829449, "uuid": "1b1d49ce-4a00-4e8a-b3c5-7047db36f611", "comment": "Malware payload", "value": "95ae93769d2e02df2bc5c3c21cd27efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829449, "uuid": "04a0b0aa-d9c2-48df-8692-fc6d1636b88e", "comment": "Malware payload", "value": "969fbca0fac7e1b439f797eb4febdc46c4001bd0989d89a1913146a1fd89ff14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829449, "uuid": "96a24dfa-44f4-4b6f-9f61-30dbf38f370f", "comment": "Malware payload", "value": "b35a26ab4d3b0f38d1b64e4af310e07b37a228be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829449, "uuid": "be87f7d6-26fe-4f85-a20d-7cfd79fa67fa", "comment": "Malware payload", "value": "617805cae918c8363469c32653df34dcc789f45c5903b04dc953c6a455f90c33d81f1507915d97bb9e7ed19b3ca2aea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829449, "uuid": "07e00370-661d-441f-b338-d65b40457810", "value": "T1F9C4AF42B9E390F6D73555B00C6A6B76EA7A8A020B11DFC3D364DD2C5D3B2809D7F12A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829449, "uuid": "e4011986-94fb-4e44-9b46-e5819ce221fa", "value": "a3d86a2daeba88c23a4f5a617877162e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829449, "uuid": "737297ff-c1aa-45e7-8d6a-bbecd7339e50", "value": "6144:NUEUVUIaUPbFWdk8F78jQTvLETRQYQiMAk77qSiceteDTi9yoUwjvDRg:NHUra6gdk8Fwj/iv7q7ck2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829449, "uuid": "8988cd26-550a-44c2-a7ba-67ff9e9ceff5", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829449, "uuid": "b5e0720f-e390-49ed-8d76-ae0ebb650eec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829449, "uuid": "4b221986-0176-4b9c-9d59-8e244be606e4", "value": "SecuriteInfo.com.FileRepMalware.4402.23650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec30138-b8ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705876605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876605, "uuid": "bdea5af1-fb00-488e-9a05-b5dd0d5cca34", "comment": "Malware payload", "value": "2839bdf2ec3c82e45a05f5df461759b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876605, "uuid": "7daff86e-1e8c-46e0-98aa-8c7e36b33027", "comment": "Malware payload", "value": "96a5c3398298d301d87b0a736ea2c3448b01f9fce74957044e409d626d8dc479", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876605, "uuid": "397b0100-c41b-4e34-a85a-6f42064695f8", "comment": "Malware payload", "value": "6780220a0ede73694b59866a0d533fb352aee9be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876605, "uuid": "e97188e6-38bd-4c97-8dbf-05a9e291027a", "comment": "Malware payload", "value": "fa6629d2ae11e8624ec0676ac48dc87c0e06663eed005f3e1e68ea720735d1f83e2022de418bc76c09d16b59aa464f2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876605, "uuid": "7672dd7d-076c-443f-b411-867845f79dc4", "value": "T14D533A4977C7A321CB640AB9C1E7D4510AF2D7472A73D6493D8423D60EA37EAC98378B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876605, "uuid": "d939fb87-2806-4ba7-b6ef-72187098e696", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876605, "uuid": "edd11379-ba22-4f49-9c8c-723e2b1a592e", "value": "1536:OTKw5CFY/ZoOncDbw2dLUwwH877vpmtGNOCF:q5CFY/zncb/UP877hmkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705876605, "uuid": "607a9e7c-4b4b-4dd6-a0de-9ad196dff19e", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705876605, "uuid": "cfddcc3a-77b1-44e3-85aa-682d9e691a4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876605, "uuid": "d643f5d1-fc06-4c89-95e5-a43eaf1ea8d4", "value": "SecuriteInfo.com.Win32.WiperX-gen.15070.14495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39322a2b-b801-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705802588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802588, "uuid": "0c5c7ffb-4b0e-43ed-9379-54e8a24a143d", "comment": "Malware payload", "value": "b15a8047abd9a3af013cf6c77ce15acf", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "stormous", "colour": "#428ED9", "exportable": true, "hide_tag": false }, { "name": "stormus", "colour": "#357B11", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802588, "uuid": "503009ef-9adc-403f-9417-5fab9ec854aa", "comment": "Malware payload", "value": "96ba3ba94db07e895090cdaca701a922523649cf6d6801b358c5ff62416be9fa", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "stormous", "colour": "#428ED9", "exportable": true, "hide_tag": false }, { "name": "stormus", "colour": "#357B11", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802588, "uuid": "8df08930-fede-449b-8559-e89b19668ad9", "comment": "Malware payload", "value": "aa62afd6a48d3c42ed66d4f5b9189be847ec055b", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "stormous", "colour": "#428ED9", "exportable": true, "hide_tag": false }, { "name": "stormus", "colour": "#357B11", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802588, "uuid": "4acd2101-595e-4dde-99e1-7bfa9a305465", "comment": "Malware payload", "value": "d7d76f06fdded8d2092f686a95ebf6f9cbd0848588ecf7360a71014153dad1744ece30f149256d8b2fdf9a126c267aae", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "stormous", "colour": "#428ED9", "exportable": true, "hide_tag": false }, { "name": "stormus", "colour": "#357B11", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802588, "uuid": "5c02cf87-5cf1-495e-8f86-84f73d03334a", "value": "T1701242A17C81683452738EA137A7A915ED0B211BC20987D87C4D919BBFF051892FFF6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802588, "uuid": "d66ae046-23f8-4632-a3f0-43ae02f0212f", "value": "96:CzQKDxaCkpsxa8n/E9TAQuEIDLb20RoDxa8uHAEMz5xaD/A8b/6QlJZgVF/7IiY8:QwiG3uKyH1Wvze3FxNBzQrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705802588, "uuid": "a87a0f1f-522d-4e1a-ac04-098ea67b5364", "value": 9281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705802588, "uuid": "3ea3a732-ff42-44a9-848e-5e2d99354a2e", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802588, "uuid": "8ab768e0-55ee-496f-a28d-f0fde761c61e", "value": "Stormous(1)(1).php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d74b7d-b8ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705876589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876589, "uuid": "c06d432c-7b48-4b1f-b5a5-23789cb46359", "comment": "Malware payload (AgentTesla)", "value": "445e82fd556f280ef03917fbf7209c6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876589, "uuid": "76aa4515-9ac8-4b92-9624-1b1c3277f1da", "comment": "Malware payload (AgentTesla)", "value": "970159779b41c4445972cfafbe8e19fb9a803145446a84a41165661588c72fa3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876589, "uuid": "de3514cd-f82f-4a45-98cd-364476afe057", "comment": "Malware payload (AgentTesla)", "value": "4305c76e00ac7dfdfc9d27c1878133861a864e51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876589, "uuid": "23af3901-4ed4-48d2-8efd-8e15bb467df8", "comment": "Malware payload (AgentTesla)", "value": "15542ed34b0f7cce68fd9d0dc35615ccdb2b33b8e3b83ff91f29d1068cf021ac53e43f3ef0177ee9ff2f2a210d1116bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876589, "uuid": "e2d5e276-64cf-46c8-b539-020a37d685ed", "value": "T1A0D23C2CC7EC453BCABBC73C8C934643A730951BA20DFB5A24D993652943355BE912EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876589, "uuid": "193e4f3f-2ad4-4fe0-badc-edf5fd7029bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876589, "uuid": "c13d7597-0e23-40fc-876c-509dd040f8f1", "value": "384:+G7TXDnvJjOpdvg06eUVh9eFFFpnofncpisKiaB7XNMezl+ZcX:R3zxN7sFF3ofcpisKiI7X/wG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705876589, "uuid": "135a1424-969c-4a72-a283-7ef85906abf6", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705876589, "uuid": "39173d5e-7977-4671-bf37-53613c5df367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876589, "uuid": "25bba583-bfce-42e1-a9a1-db567a0f57fc", "value": "SecuriteInfo.com.Win32.PWSX-gen.25537.3692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a745774-b88b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705862022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705862022, "uuid": "043730e1-6c2b-4e76-8009-ba64d71cb15a", "comment": "Malware payload (Smoke Loader)", "value": "5975d5f166114533acd70bd68ee34980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705862022, "uuid": "4d06d163-b849-4d65-a85f-5a30ff007e9f", "comment": "Malware payload (Smoke Loader)", "value": "97d96881923faf0f965623a5097bb5e7bd87ecce22fe496e17da1242f0fb8930", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705862022, "uuid": "43541a5c-5e21-4bc8-a98f-bbf90168d588", "comment": "Malware payload (Smoke Loader)", "value": "ed58b0c406473948c1e70cc5b820664503f25505", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705862022, "uuid": "06c6e998-d737-49ba-b1f0-5c8cdcbefdfe", "comment": "Malware payload (Smoke Loader)", "value": "47fd99a10eba5d10074dd148afe433b5e3230fac1dbc671729d6696f66ee4119fc2b21b97be0287ce137a31857cc048d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705862022, "uuid": "8320142e-be13-4a4c-9d1e-fe861bb82588", "value": "T19D246C10FAE44831E3F75A3146F0D7A50EFFB8926A72558E0697176A2F346D28A2071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705862022, "uuid": "dddcf739-ce99-41cb-a58a-18cf69e307a4", "value": "63d0afcd26c2db3e8a1c86e73126f393", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705862022, "uuid": "e58ea234-8fcc-4895-be63-e6197c0cfc05", "value": "3072:CM5tsJq+tS3m8+x6GTine96TNaLfZeqSt6m29WZX4FgMXEfYw:CA0Tx6nesJazet60qgMXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705862022, "uuid": "8fbb4905-9040-44ad-b295-2bea302b0071", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705862022, "uuid": "b17a72ca-2e29-4e3e-b7c7-14a542539782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705862022, "uuid": "642bef82-51a1-4686-998c-9de94662dfa6", "value": "SecuriteInfo.com.Win32.DropperX-gen.5130.14297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8918b527-b8b2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705878743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705878743, "uuid": "ad81483a-e5a4-4d5f-906f-09aceaf102c4", "comment": "Malware payload", "value": "b109e0969c3d7a652bbcf4fa9ea1e3dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705878743, "uuid": "348ac768-b440-4e74-a81d-e9489df9a19c", "comment": "Malware payload", "value": "9898a8b8a5cadc856f36d36dc087b13fd2ad93f853aef76d9c9f3b39da3356c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705878743, "uuid": "59f50cfd-c579-48f9-87c6-56c3d9ca64b7", "comment": "Malware payload", "value": "b93552d56079c6e24894c6bbaec0c63b0037fa01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705878743, "uuid": "043e9f47-732d-48de-a4cc-afcdbe5560ba", "comment": "Malware payload", "value": "20afab813a807593fa373e7d85cb028ee3c245cdec64fbfd7d72ca9da2725c595104e43a3ee45e6c888928c7bfd14a46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705878743, "uuid": "f4c846ce-5045-4e35-b504-0446da86bcc6", "value": "T11A4523EA5637F320D2133BB401420A45429BBE9F1084195A466FFB899BBC07F6776F4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705878743, "uuid": "d3c87b32-3626-495c-99bf-8760c1c4ba9f", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705878743, "uuid": "0e95e32b-15b4-41c4-a202-53e95ee3fdfa", "value": "24576:m7tiFvT/MyDF3eHTm65NmwQ+QyEvOUWu/vUEpB9FLB:SEvTkyUzm/liUWMVpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705878743, "uuid": "59ff6747-d784-40b7-b121-ba2f736169b6", "value": 1207296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705878743, "uuid": "39ff2b62-519b-4faa-a521-fae63005efeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705878743, "uuid": "9f2e61ce-63ac-4241-a912-cec1e500b0a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dda9464-b8ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705876604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876604, "uuid": "0abaf632-8f8c-4f3d-b937-c65934221351", "comment": "Malware payload (RedLineStealer)", "value": "08fb66b545df070a74af6cf34dad246b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876604, "uuid": "8c2d58b8-372e-4f24-8279-3a80851f8f9c", "comment": "Malware payload (RedLineStealer)", "value": "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876604, "uuid": "63c21f14-db83-43f0-b172-d96a4ebcb062", "comment": "Malware payload (RedLineStealer)", "value": "cdce7196baa6fd1d509a8283c2376c5f33ed5e77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876604, "uuid": "e7f8ecd3-1c56-40cd-a5bc-f4cbe069bf85", "comment": "Malware payload (RedLineStealer)", "value": "5e52898691f6c4e97ae5b1cc0adcc679ff3a461fc02d2078c2e545c6996c44615d9eb53a044fa10f30ed9b68fc945494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876604, "uuid": "3d1de682-fd4f-40d2-89ef-5b0412b5b8cc", "value": "T1A3949DE1B0B0E8BDCC4CE53B7346C055BC91796B99E6A3F634805A6628E275C6381FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876604, "uuid": "97827230-954b-4e7b-97b7-beb023974410", "value": "06eb4d13e1bb2dcafbe526f4a64db1ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876604, "uuid": "9d1c564c-4e41-47fa-be75-bfea6d6792cf", "value": "6144:TzvMJngWDh+Qlnjm14CNM75qRvu0bejPLP44WbRWVg3EKG1jsshJVI+zk7GWPvhP:TrMJjPLPRhQ+z4GWhC4s4nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705876604, "uuid": "5202fcc3-15c3-401c-bbd6-0a7276f7b457", "value": 427673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705876604, "uuid": "501d9f8f-6392-4187-b926-2f78db10751f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876604, "uuid": "cd241e4b-11b0-4580-a803-33a29e1f9d10", "value": "SecuriteInfo.com.Win32.PWSX-gen.8494.32429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289b351f-b884-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705858825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858825, "uuid": "9dec1af8-6b52-45b5-a199-e17c2d6c9e51", "comment": "Malware payload", "value": "801371fcee1dbbc9a320f61cc0e7735c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858825, "uuid": "49bd1e09-64fe-4820-9a32-c4483a7933d5", "comment": "Malware payload", "value": "9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858825, "uuid": "9aa7bceb-48c3-42e9-8d27-f47c62e6c49c", "comment": "Malware payload", "value": "02d9219a5431aed3853e4eca1abb785d828f86cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858825, "uuid": "0f0fd4c7-4955-494a-8803-768dd352e085", "comment": "Malware payload", "value": "bfb81ef4caddfccec7ca40ba0d43075c6f79bad122c146cde9ef6924b3bf5be7ac42e5d8338e133fb97f5005b6a463e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858825, "uuid": "bc50e474-36bb-43a4-b5d7-9a654c06e3c9", "value": "T1CF53390DB787A361C5640AB4C4E3D42106FAA38B6573DB8B39D417C50E237E6CA9379E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858825, "uuid": "d85c8139-1338-49b4-b654-cb08a5d706be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858825, "uuid": "49dbfc98-a89b-485a-a1ab-6c6c8c8039d7", "value": "1536:0uKzCQOYrknOD+gV5uQ+NSCFb4Pg9jH1/:UyYrknG+45wNnFrN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705858825, "uuid": "bb5e1973-26c5-4083-adb5-9209a3ee0a30", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705858825, "uuid": "3fcef3b0-d863-4fe5-9c2a-867cfd3f1b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858825, "uuid": "fd119ab3-9ba6-44d2-83b1-ebdb80aa56d2", "value": "SecuriteInfo.com.Win32.WiperX-gen.5892.31106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f23fd31-b882-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1705858057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858057, "uuid": "959777e0-d6e0-4f23-8d84-52ebb9353229", "comment": "Malware payload (AZORult)", "value": "e9da9cc727dcaa5cdeeebeba24fba794", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858057, "uuid": "4d0c6fde-d634-4ab7-84b9-b49ad007a593", "comment": "Malware payload (AZORult)", "value": "9b1a84b656f463c30a9e69bdd88c8e268354b3b3eccdd72725779517c016e464", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858057, "uuid": "1676ac85-012c-49e5-a42b-45ad5cb98c84", "comment": "Malware payload (AZORult)", "value": "55e1d678cf30fed4068908c092c2c36583af72e7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858057, "uuid": "30265614-e9bb-4c0a-9812-bf0c141c92a7", "comment": "Malware payload (AZORult)", "value": "3b74a36297483b0ddb238207dbb8e79af36047cfb162486d5e0d9edd2d7dff401301ef39b2261e309f6fc34abd030d0b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858057, "uuid": "0fcda6b0-3de6-436b-b1fb-e203c706ddf4", "value": "T153619D242DED2778E2F28E7158A576518F77BC52EA359B1D408007CA9852F00ECA5F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858057, "uuid": "3ea5e096-e0e5-4e16-bfc6-aa632a6ffcda", "value": "48:8JPkD3c/I8FiPMGnxSl5dkIPXuHFWU9qt:8JPXwPMGnuoGulZ9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705858057, "uuid": "88477ac1-ff31-4bc2-8b34-f2b614eb7635", "value": 3425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705858057, "uuid": "42a11ed9-fa48-4caa-af8d-47a4a22cf88d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858057, "uuid": "a9ff4b11-b13c-4a26-9d02-de9489d8d1b2", "value": "chasebank_statement_Jan_2024.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84250563-b8ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MysticStealer)", "timestamp": 1705876588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876588, "uuid": "38c6715f-0f2c-4ecf-a93a-540a869bbca3", "comment": "Malware payload (MysticStealer)", "value": "a7e4e478fbf4a1ff9a1be70ee8afd190", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876588, "uuid": "11a32e74-84b3-405a-8c89-92494e16eb7f", "comment": "Malware payload (MysticStealer)", "value": "9bdb51905b1eac04722007ffcc4a86f1bd84b618ca2610580e01acd21b98cdcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876588, "uuid": "f50c851b-195f-4cf4-a0c2-00bc62737309", "comment": "Malware payload (MysticStealer)", "value": "51f3d2658fd02b20979947a643ed1c1f66892ee8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876588, "uuid": "9db4f2fa-fdee-4424-8bcf-b9811c3b8ff9", "comment": "Malware payload (MysticStealer)", "value": "213e7c5b35366e3299babd8dcfac58c59b110f144a29e65748feb76b88412c102289cde974d070e1307bdd59eb9bfd92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876588, "uuid": "c416534b-335b-4415-be2d-4d1a1dc14a27", "value": "T10C854A11BB515128FCF706FB49FE20ACA52CBAE0076890C791C46AED8729BE1BD31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876588, "uuid": "6f04bd5f-38ef-416a-a4bc-e231449dc5e1", "value": "91f6eb56df945aba8e2cf7fe16f491e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876588, "uuid": "c3de6fcd-662d-487e-8a3f-7aa4240332ee", "value": "24576:+yZ64ndor0y8cvUfoPch+t62fXWbRTfZOwgh:1M8cxt6xNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705876588, "uuid": "026ead3b-fa37-49c0-bf37-f181839a364a", "value": 1750528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705876588, "uuid": "2e8ca2ed-e6c2-479f-a53b-772d5fc259d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876588, "uuid": "8d70e554-c844-4357-bd74-f0803d0b519f", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.37347.3977.32556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3463542b-b876-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1705852831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705852831, "uuid": "651e79a2-5bea-461a-a676-0c37f1e0ce3f", "comment": "Malware payload (QuasarRAT)", "value": "f5c1607e21a0f78df0a54518ebbdcdd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705852831, "uuid": "65665e4b-16fd-443a-8926-e981bef8829c", "comment": "Malware payload (QuasarRAT)", "value": "9eefa45ebc884b3b6fa4349d140963700c9f2c2543840d965b11c7f815346ab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705852831, "uuid": "e7b510a5-d6f1-4672-8b6a-7abe41057beb", "comment": "Malware payload (QuasarRAT)", "value": "bc40dc4455ff17ad16c898b4f45c19516d1c9a1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705852831, "uuid": "8e785d58-887c-4ff6-9703-93ea2d137065", "comment": "Malware payload (QuasarRAT)", "value": "1d563399182bf5c8b3d66557760b597d42ea8c0fcdaf2f8e70151052bdb512b89fc9830e0c769afa987066a8086faef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705852831, "uuid": "734fe6a2-7298-4a9f-a8b7-40750e635292", "value": "T1FFE55B143BF85F27E1BBE27795B0041267F0FC1AB3A3EB0B658167791C93B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705852831, "uuid": "c9283c05-a803-4f6a-b104-3872c8ed23f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705852831, "uuid": "82bc9f69-d2f7-4eef-a9ed-212a9dc4a341", "value": "49152:mvVt62XlaSFNWPjljiFa2RoUYIi+DWbRoLoGdPNTHHB72eh2NT:mvn62XlaSFNWPjljiFXRoUYIi+DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705852831, "uuid": "49574b32-3956-4825-aa53-d51fd6177182", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705852831, "uuid": "21352041-1cb9-4806-9028-c893e07ab467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705852831, "uuid": "ec427718-7522-40b3-bf2f-3444dc02d4ad", "value": "9EEFA45EBC884B3B6FA4349D140963700C9F2C2543840.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c74fe2-b7f5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705797649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705797649, "uuid": "77860b30-5d33-4e2e-8bb2-a162f01e9286", "comment": "Malware payload", "value": "2800f54b5767a2cf424040bdd84de153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705797649, "uuid": "0a1341b6-45f8-43be-8a9c-730443c5619a", "comment": "Malware payload", "value": "a174aa5308a202a3fff800eba8a74cc4699143b8f5eb46d5802d7f9f22285119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705797649, "uuid": "a01a3eb9-16e4-41a9-a999-797a1a171bb0", "comment": "Malware payload", "value": "ef0022bf55a8da695574b84621485c83c60b146c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705797649, "uuid": "72221a61-a229-48c7-a2c0-edc6cb9ac201", "comment": "Malware payload", "value": "486d603a9f30c9269003c2781eb09bc4574d3e2198f6169e679e30f89706322853f4f8e32892edbaa5900ad48fe1d061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705797649, "uuid": "022b9d84-756c-4561-be12-8b92d9a32c20", "value": "T1AE532F9C726072EFC86BD472DE982C68EB6175BB831B4203946715AEDE4C897CF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705797649, "uuid": "c58ed58e-eebb-4320-9fd7-d939ed2fb16a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705797649, "uuid": "2f0a5f4c-194e-44eb-8ab4-2fa923b29d50", "value": "768:WwXfWzKefhXuBLb5/lPq+li+fD0M6JS3eyiYUSyCufMF1vRewa17:XPWzffhX4NPbpfD0MheyYB41vRewo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705797649, "uuid": "c76c741e-aea8-416c-aed8-15af7878f413", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705797649, "uuid": "a779249f-870c-4d83-ade8-3dba520db8a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705797649, "uuid": "97592b18-661f-4378-9dea-a0109ac110df", "value": "SecuriteInfo.com.Trojan.GenericKD.68420414.16273.30783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca62a97a-b836-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705825595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825595, "uuid": "9a5f2d02-09f3-4489-bf65-60b2a28919ac", "comment": "Malware payload (LummaStealer)", "value": "db7fbb7eb030a592688aa7ab200ea7a9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825595, "uuid": "6b7dcc77-2fd2-44b2-8c3e-3fa62d051f78", "comment": "Malware payload (LummaStealer)", "value": "a25405017e4a8e0525d7ad3af2df6d928147d004df5ef65b8e1b1154bde6f472", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825595, "uuid": "5fe40f9e-37e0-40e8-a903-735b39777bc5", "comment": "Malware payload (LummaStealer)", "value": "c745bd9d7893eae2fe5cb77d6eb388fdf6a5589e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825595, "uuid": "bc9c3c2a-ddea-4faa-9f5d-091fed006837", "comment": "Malware payload (LummaStealer)", "value": "d9cdd78f4065be689abbf45a622a11a4d8b2c35dede7591785179bad80ccfc86d0293244f6bdbbce95d35d655083d80a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825595, "uuid": "2853c327-12f0-4e34-8012-b347037549f1", "value": "T1B0944B56F40B4670F9BE20713C3DB77D95A46158AB2881DB36B88D879EF53C02B34B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825595, "uuid": "6793df42-2449-4dc7-b278-4e82b1077f56", "value": "1e5d7e2502d825e2e0e4a1ad59da61e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825595, "uuid": "114c8654-9a46-4276-9bf2-49c3f740dd74", "value": "6144:wDwYxEtDtsCtETXuLTFHwaz/cb3F7gZI87Z:swAwiYHLTFHwaAOZIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705825595, "uuid": "5ee9e47a-56ee-477c-9276-d24d12f72297", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705825595, "uuid": "ca925524-1411-4890-a323-6217dadfb43e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825595, "uuid": "0c4cb0f4-beff-47b1-922d-e1838e273da5", "value": "SecuriteInfo.com.Win32.InjectorX-gen.31285.31803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b900ff-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829460, "uuid": "ca165df1-4c4d-4638-840f-a94854439ef7", "comment": "Malware payload", "value": "c34c4ea4e6dc601db126f01fc6eff1f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829460, "uuid": "813358a0-58e7-471b-9110-4b5ff4c8341b", "comment": "Malware payload", "value": "a314cf7fe74bbe5e609e40d5a9a02f4f2ed0a19f9483f38ae015e52733fc1766", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829460, "uuid": "142a334b-f865-421f-bb92-ef890daaa35b", "comment": "Malware payload", "value": "836a57f2977b6b8b7652030b32f47425981571de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829460, "uuid": "f997df53-ae98-4dec-a7a6-8cba9a3b05fc", "comment": "Malware payload", "value": "a905d22cd2497125b54981cffff6528596a6a752a1003a9bfbef98fe343d1a49eeb3e52f183ac7d047f0e20dae32488e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829460, "uuid": "cfe6a72f-b870-438f-8061-351361e75ec6", "value": "T17E058E11B7D240F6CB965570186627769A3AEE4A4B1C8BC3536DEE2C5F3724C9C3223A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829460, "uuid": "56034752-f4bd-4733-8290-8a5bd016ebed", "value": "04e8c8c7b461e7b0e77295875c5de1a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829460, "uuid": "2418b17b-f5d7-4656-aaed-99aa6c428b73", "value": "12288:KzNSXGLAI2rzbXFGxG6LEzUoR+ZjmE8lPmLH:K8RIMzTF4G+HZjmE8sLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829460, "uuid": "2d4c3d6c-adf3-420c-84c4-2ac5e3687c64", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829460, "uuid": "53a21494-280e-4d08-9d44-343ab88d6338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829460, "uuid": "98e667a5-9154-475a-80f9-df09dd1f123c", "value": "SecuriteInfo.com.FileRepMetagen.27939.10018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90feeba-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829432, "uuid": "b542aee0-b2b5-4ef9-9290-4c09578323e2", "comment": "Malware payload", "value": "358f3c3b41caeac205e5a9a4b77569ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829432, "uuid": "1052fd37-ca28-403c-bb1a-49c347a79d8d", "comment": "Malware payload", "value": "a60f2eadaae9dbcf7441f0b8c040cf75173a0505614f57b816db10cb9c29e60b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829432, "uuid": "ed212bfd-d092-4747-8393-fba9887c4729", "comment": "Malware payload", "value": "982204dd8e77fedf0abbaa01ebe62bb4aef2cd10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829432, "uuid": "0218f403-614d-45e4-ad85-7b7b5a3791d9", "comment": "Malware payload", "value": "169f083a570709dd0c4d7c294e962c830fedba0240f039a7bcca6e5af08a3d4c027e6739f922f3bd762f38871811e425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829432, "uuid": "c9637302-04d1-4709-8313-36dba9da04dd", "value": "T13415BF01B9E2B0F6C71555B108EA6737EB359A064F14CFC3B366DE6D1D321819E3B28A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829432, "uuid": "06ba8fe5-04e7-49cb-b732-4d83f1c41000", "value": "5fa8731405c84c5fb9d68bde76b53ff6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829432, "uuid": "63c6d40c-5428-4053-b244-9b5f45692aec", "value": "12288:C/a1gOZ9IXfSVAff33boPs96P49ahBWPwT96P49WhBW:C/alzIPSCfP3Ms98hBgwT98hB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829432, "uuid": "4f01ecf7-946d-4164-b011-0a967a765545", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829432, "uuid": "b59dfa28-49da-43ff-9bf1-9b579677e662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829432, "uuid": "cafeba0e-ee63-4fc4-a7ee-51c451a93e1b", "value": "SecuriteInfo.com.Win32.Evo-gen.6781.19329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9613dcd7-b877-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1705853425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705853425, "uuid": "03c13559-920a-4783-8c3f-67ef3a71b523", "comment": "Malware payload (RecordBreaker)", "value": "f674f52c3fc7bfd52872fbba26d85dab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705853425, "uuid": "c57c0c0f-27f3-4898-aef3-e3e83e0123ca", "comment": "Malware payload (RecordBreaker)", "value": "a6a4706b8efff748cd8fdb24d6421683baf448c9881f3ddcf621185bf70cbf59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705853425, "uuid": "3b7cbaea-e879-4037-af23-48f012394851", "comment": "Malware payload (RecordBreaker)", "value": "d1a315d93d2963fe375ae17a51577479a28a880c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705853425, "uuid": "03386da8-a4ff-456c-b0be-85c504b3fe40", "comment": "Malware payload (RecordBreaker)", "value": "69aef3520997a37740a5da8ac9b58de1712661ee408878b5d15ef06f6a4e227939678ca013b20fea7db0f57e71dabe29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705853425, "uuid": "55e6e21a-e31c-469c-ae71-5d8812952efd", "value": "T16375BF3FF268A13EC56A1B3245B38320997BBA51B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705853425, "uuid": "4b8bc3f8-6a10-4206-8ce4-dee27ddb0bc3", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705853425, "uuid": "450518a9-a89c-470a-bfe6-080c6b1e05f8", "value": "24576:s7FUDowAyrTVE3U5F/oppKic6QL3E2vVsjECUAQT45deRV9Rx:sBuZrEUKKIy029s4C1eH9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705853425, "uuid": "9a96c277-db45-4ff0-a4f9-757e5e5c05c1", "value": 1672037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705853425, "uuid": "5d18c0a1-18e5-4ff1-bd9a-036ef470107e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705853425, "uuid": "f43273d8-1b23-4ee9-b4c8-f719f8b4ed3d", "value": "A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916e960e-b80b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705807031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705807031, "uuid": "2b1b37a1-654c-49e7-8c63-af74ffcadcda", "comment": "Malware payload", "value": "b0677dbf1f8854cd398602be2a344c37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705807031, "uuid": "6ab731af-ad2b-4a0f-8049-308bdc51c952", "comment": "Malware payload", "value": "a744c6ef23abcd7c4f95a79fac754d8a49c05066723faa3c9233a19501e52601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705807031, "uuid": "575e6e4a-613b-430e-b80d-b1d7a711187a", "comment": "Malware payload", "value": "46ef9c1413a20bdbf11976c909f3b552ccc0c2bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705807031, "uuid": "cb2083ba-ebfa-4175-99d7-5e0661625568", "comment": "Malware payload", "value": "60b8733dcbd6f16f178175a67da15a1dc3e39b0cec8fa152c6d814613b500245bd3aea542420a28d6fced90aeea49507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705807031, "uuid": "669d7e23-6bba-4a7b-a1a4-5558a727b7c9", "value": "T16464AF5366EC3CE6D47A9234AB7743C1D72EEC1543A0D64F02E002A6DE3E593792ABD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705807031, "uuid": "f9bf4c77-8e01-4209-a43b-75f620c0fcf7", "value": "d2ed574bab0e1ad31e791e92385472bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705807031, "uuid": "07aa3855-c8c8-4f89-b8ef-909649180466", "value": "3072:2vS1Xpk+TxCmS1D+dCBwzsufXDbuUhScGVSI5hw+SsUhsmMvKGgC:DkexCmS1D4CB9ufXvaB01A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705807031, "uuid": "d4daff58-56da-47b9-9bb1-22698bc83eef", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705807031, "uuid": "a5addc68-3f2d-46f7-a905-e835086e052c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705807031, "uuid": "9979dd4a-542b-43b0-9071-100b77bf2151", "value": "SecuriteInfo.com.Win64.MalwareX-gen.31487.29053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8823de3a-b83a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1705827202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827202, "uuid": "b3923422-81a8-4b1f-9068-edae3c13e5b8", "comment": "Malware payload (GCleaner)", "value": "21bd6822e1322b5215ba32d036667dd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827202, "uuid": "4f14d636-c547-4b36-a84c-797045a63be3", "comment": "Malware payload (GCleaner)", "value": "a784816fb18be5d83bdb248246092568a3bf975f7bab87108905c964780deb56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827202, "uuid": "fe78502b-3265-4340-a283-d0933e0301da", "comment": "Malware payload (GCleaner)", "value": "56bb5acfc28df8a2e643962a0b83681c1073d405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827202, "uuid": "8a852553-6f34-4b5d-baf8-8b4e67a2c442", "comment": "Malware payload (GCleaner)", "value": "9959a403cf70e4ec412ea07f7e4e913899eea18cff2a6227bfc6ea06a11f08cf7ed1dc1005e0bf7922b6edf075c5471d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827202, "uuid": "64a746b2-e066-4a7a-8eb6-2010f64162dd", "value": "T15D548E1392F17F11EAA64B329E3FC6E8765EF2118F1A7759223C9A2F29710B1C163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827202, "uuid": "ae6f7bc7-46f3-433f-9b1c-9f8054ad1172", "value": "e0e4d350eec84bd11f6f18b6d0e645d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827202, "uuid": "5dc2aa3c-df31-4cc8-af5b-20369e44c141", "value": "3072:ugdg2QLpMwzvs+gErVv9RVF1N76fnP6x77VBII2uaDfbfl6cKhGI5Waa5ip7cEcz:ugQLOwMoDnfmH6xHbBaDTfM1xp7Ncfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827202, "uuid": "d7a0c1c9-76b9-4955-ac7d-c44bdbe6fa24", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827202, "uuid": "be28dd3c-1c1a-41d0-a38a-f862430aabd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827202, "uuid": "36722fd3-6d41-4d15-9c06-0d91ba58bdd5", "value": "21bd6822e1322b5215ba32d036667dd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056afbf3-b835-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705824835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824835, "uuid": "248e5d0a-66e1-4df1-b223-25b7b3a85e9f", "comment": "Malware payload (Mirai)", "value": "ecb2e809526e9e56e3b1a792705d53e0", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824835, "uuid": "f65f73c1-a8a1-487d-9d7a-cc0c7bf7ca58", "comment": "Malware payload (Mirai)", "value": "a7e44a971c5d9f6538e214146dff80c57cfd00cfdaa7794cdb90156f95f31eb9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824835, "uuid": "5337d895-a5e7-4c01-9ec4-c578694734a2", "comment": "Malware payload (Mirai)", "value": "9f874b5993f7f065a427726a765e0b6c3bd2c2d0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824835, "uuid": "0e5879a2-1b9e-4454-99cf-4833cff66444", "comment": "Malware payload (Mirai)", "value": "fe655d484efbe3dcba7614031e87f5f85598c1c57f9a7b4c156c1a0054f09bfe96ac5f7bdd34aab241bb6a28b285acf0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824835, "uuid": "4b2148d0-8301-46d9-aa0d-e68cf3889602", "value": "T1E0D2D0D945E7F1BCC0AAA6B9043D07C5FDB67216C1291BB708E83166DE571D80E30EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824835, "uuid": "0a6bc712-c326-4ea8-9181-8d1b86509d00", "value": "768:NYSoXdJZETc51aBfdNRQkHy3xWEMcw6qB/iQ7XSx0sd:NYJdJZiy1aBnQfTqB/irtd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705824835, "uuid": "ae752c7b-5941-4e25-847b-556374eee500", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705824835, "uuid": "05bc36f9-60da-4ef6-840b-76089e2bd1d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824835, "uuid": "cab12478-a5aa-46af-b554-3a21af70bd71", "value": "ecb2e809526e9e56e3b1a792705d53e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858ff844-b83a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1705827198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827198, "uuid": "3c8c2595-c535-4998-be1f-3d96493efb83", "comment": "Malware payload (GCleaner)", "value": "150c7a8529a029c7b841d19c30b366ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827198, "uuid": "bc1c57c5-a319-480b-bef1-184d38390d12", "comment": "Malware payload (GCleaner)", "value": "a94a5be50df8ef8edf058cd8b171cd9454e21b683f47b60370df198f3c9bd92f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827198, "uuid": "7ba9a5df-11d5-430f-90a8-859c7f1a5093", "comment": "Malware payload (GCleaner)", "value": "7eb0890fe4d6a106e46f14da7e4e9c3113294386", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827198, "uuid": "decd7b38-111d-41d2-b786-0d3c0d359af6", "comment": "Malware payload (GCleaner)", "value": "7eb17d9e758ab54203b651a2dc92ad3e983f0d32768acd8775aaae830b8cb2cf440091ffde10bce2dc97d862d9d76b6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827198, "uuid": "77fec77b-34b0-44e8-8165-9e5cf42c8059", "value": "T122548E1392E17E15E9A64B329E3EC2F83B5EF2118F1A7755227C5B2F29710B2C663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827198, "uuid": "8e36d7fa-0068-402f-8fda-7ed6eec63ee0", "value": "e0e4d350eec84bd11f6f18b6d0e645d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827198, "uuid": "fb1a28ab-209c-4804-b6dc-21475585dd51", "value": "3072:Ag0g2QLpMwGZvL26SPEfM9NXoxZ8vTXcOelRLNewECsAIZ0aO5i+rj7CyI4:A5QLOwGZy6SPo3xATXcOerdUv9+eH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827198, "uuid": "010769c4-09fe-4df6-bea6-882cf8f87b34", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827198, "uuid": "73806dcb-b0cc-446f-92a9-6edae63645b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827198, "uuid": "c8f1083b-e263-44e6-97ab-555f44a17469", "value": "150c7a8529a029c7b841d19c30b366ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cec41c-b88a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705861657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861657, "uuid": "5a1d78b1-61f7-4c87-8eeb-f5f6e9d14761", "comment": "Malware payload (Mirai)", "value": "a1b10a659cf158c51820e6dfb4f20418", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861657, "uuid": "124896bb-3578-49fd-a5c6-bab7f9a335c3", "comment": "Malware payload (Mirai)", "value": "aa35a43d7a7c71f4b12b4cad5f89ce3116ffc71f76a2759ab3c4c74950dc427e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861657, "uuid": "81fe2daf-e45a-4ac2-bd4a-9f324761ed1e", "comment": "Malware payload (Mirai)", "value": "7b7ff1047745a8f4f41d9d44f54b5938deecc92f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861657, "uuid": "3d5e0c5a-1b06-48ea-a39b-f7ad5ddcfe7c", "comment": "Malware payload (Mirai)", "value": "05cd17d815e9e4c383e3d8a19344e3a15c4e1862271a4ef25474b0a8705dfbb5557106d1b619edf8af1099897deb9449", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861657, "uuid": "a578568e-a826-4cdf-8776-f2bcef6e4a5b", "value": "T196C34B53E319474BD56B0BB01DF75FF043AEA9A133AB7508942DBB8497336B42112F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861657, "uuid": "ae58ac7f-d21e-4f4d-b308-916f92fd8ff8", "value": "1536:9aiIUMnKMZ+Bm/zQNadQO9GlVn6Ziqi4vozU9l1If/Qk2Wm7WezXAkNRoc:XnD2Qxtlw7If4k2WmiezXA2Roc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705861657, "uuid": "7daad686-2117-4d2d-957e-aeb6fcd6acd5", "value": 120114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705861657, "uuid": "622c86d6-7b7f-4ac8-af8b-21c8886a3fca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861657, "uuid": "5f3c90f8-1c30-4bb3-bfb1-e98edfcc3f5a", "value": "a1b10a659cf158c51820e6dfb4f20418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf9f5e6-b89d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705869514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869514, "uuid": "b6b49f3b-9e91-43ec-af00-ec537ae1d768", "comment": "Malware payload", "value": "259af289ab335dba1cf4cc2b3225e79f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869514, "uuid": "fa1c8fb7-d5e5-4d95-a70b-5ec1a99bfa56", "comment": "Malware payload", "value": "aa6520d2054b717da1a0da30376e9c20c4cbf3baf217c12a4e46428c5d3b86ec", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869514, "uuid": "9c8aeedf-ef09-44b8-ae68-eefb937b955c", "comment": "Malware payload", "value": "7a633f00940422635405ca48b310d4720ffb5cd9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869514, "uuid": "007b4bf8-3c43-4765-b413-23824f9caa6f", "comment": "Malware payload", "value": "ece3a063d423983ee3c082040cc67b328b95e84571ddf615ea88fff202417ee19c9f9f4773bf2498bbee1edda741438d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869514, "uuid": "853a1a09-302d-4d8c-909f-3773b710f9ac", "value": "T18A058E09F3A453B0ED2290F90AE5D79D5E5FEB3E870A21CF6F641B58F251E383A18512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869514, "uuid": "f6911f06-8301-4765-9ecb-150bbe2368d2", "value": "2cc68961dd8a09287e908343d46b30d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869514, "uuid": "d5a28900-f769-49b5-bdea-db18b68baf23", "value": "24576:YelOxSXHC0L+2LuGJEb64H7j2kyE10DCSB5Eic3r:Y2OxSy0LPLuGyb64H7j2kqDCSB5qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869514, "uuid": "dc7404a8-a574-442d-923e-2f9ebb229c0e", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869514, "uuid": "a4ce891a-20da-4750-af15-e6bfb74b4860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869514, "uuid": "d51b0f75-1c89-41fc-8f38-ca9c327563a5", "value": "file64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0928572f-b803-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705803367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803367, "uuid": "5bb961e5-de7d-4389-a855-1afe5cf3db24", "comment": "Malware payload", "value": "2ca4bd5f5fece4e6def53720f2a7a9bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803367, "uuid": "d875691d-c4e6-4889-b650-2cc49b241b49", "comment": "Malware payload", "value": "ab55d9b53f755a232a7968d7b5fcb6ca56fc0f59e72b1e60ab8624a0ee6be8c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803367, "uuid": "f8f2c3bf-3e45-41de-99af-ace445d6c935", "comment": "Malware payload", "value": "04b49bb6f0b9600782d091eaa5d54963ff6d7e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803367, "uuid": "d278870c-fb45-4d88-abc1-6e73b36a225e", "comment": "Malware payload", "value": "ce485fb53427461c5b6de843727ede5bd9c1b0ebb5b934ac48a58f230d9a14e9912d4e6d916dde61e5a3c9d5477699d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803367, "uuid": "27092cda-cacc-4c41-ae3e-cb19fce1c730", "value": "T1AD624C5427E84237DEAE17795A7262054BF1EB428C62EFCD3C8C215D1DA37828513BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803367, "uuid": "257bb8dd-b321-477b-b77b-b787e8639a51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803367, "uuid": "38f09fcc-7132-4e04-b69a-91fa2c2a6d7f", "value": "384:QKxM0updxsfGrzbYB1BcUydCQQAVsyhLWPApx2frbsW:HMzx/PbY4rGyhiYHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705803367, "uuid": "660f93cf-2d3a-4cc6-89ac-31c2d2b3f246", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705803367, "uuid": "c6ae67aa-0e7c-41d7-b955-503b3779f186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803367, "uuid": "2506dccb-81ee-4b22-b266-c1c45ea8f071", "value": "wefhrf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b80c550-b86a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705847770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847770, "uuid": "2074cb23-c830-4ce1-9957-bb3ca3d1046e", "comment": "Malware payload", "value": "a239d2c2ab9d3ba33a5c1dc27021f014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847770, "uuid": "3cdb6f4b-745c-49bc-8a4b-22d0d275c97a", "comment": "Malware payload", "value": "abac8f08d91941a3cad931dcb556cbce5576b0962f2547732d45c8bbb25aadf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847770, "uuid": "564b258d-2f12-49d5-82ea-c61315944e1e", "comment": "Malware payload", "value": "87623eea534af7395498aebd9beed51c83f96d13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847770, "uuid": "4a7caff7-6cba-4021-8391-14e38905c3f4", "comment": "Malware payload", "value": "2ba2e5c8d12ed102fd5060a58c3f13cc60ea88b85c9fc4593f9325265c5d241e3a9927c9dc1e4cacb93d4b52fb4d4e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847770, "uuid": "f6d2fee1-7475-4efa-a0da-9f57c1c9f2e0", "value": "T1D7B623BD7288375CC01FC4309523FD09B3B1512E57DE68AAB5DB2BC07B5B821A686F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847770, "uuid": "584606d1-d69d-41c2-81a4-773fdd1db7a0", "value": "03ee9baf00615154f394ceee9370524e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847770, "uuid": "857a1bbe-25a6-4a10-9ed7-0d9cd752d278", "value": "196608:k6VIdHDzfWQ3s2o3lS3B/kg7IssV2NY9O/e6AwC4asN+s+QcbRMeiqXwf7V+4RZG:k6Vujzz8Sx/1IssV2L/e6NC47Us+WOmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705847770, "uuid": "d1012a5c-c092-441b-a3af-993bcd9ccfa2", "value": 11382784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705847770, "uuid": "a8f708fc-a814-4681-9a77-66aa20b9bc13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847770, "uuid": "23e20264-2d6f-4cb7-b60b-711acb51fd66", "value": "SecuriteInfo.com.Trojan.Generic.33518056.13559.19465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a120a303-b83d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1705828533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828533, "uuid": "a1a95027-2026-4a7a-be41-18c013984126", "comment": "Malware payload (Loki)", "value": "bb60a90e4b8e849dd99e52a286f3e942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828533, "uuid": "2e37fc51-fccc-43bb-87d1-0fcd4a25f778", "comment": "Malware payload (Loki)", "value": "abbd00baef4f4b357f5f03ed54a937c692fbd297d01ea1bfe06ecc4bedcbfa3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828533, "uuid": "0737119a-5433-4a4d-aee8-6ee8a6c213c1", "comment": "Malware payload (Loki)", "value": "cdb9b96d8888078129bea1c3bb6192e157189784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828533, "uuid": "ec139049-6e94-444f-a3fd-c1d99fafc79b", "comment": "Malware payload (Loki)", "value": "f89fe2f603bc9ea300f279f653f940031fce78215dea1760d018b46f50c68d62fcf78cdaa2802a314d28cd63414e4ab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828533, "uuid": "fa4f8d90-8e64-4279-97d8-47ab58327ed0", "value": "T128A4CF8067D1C7ACEBE55235BDFD41802730EA885441B70EBAFC171DBA937284DABA35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828533, "uuid": "eef9cf15-6e72-476d-832d-a12ad04798ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828533, "uuid": "b1703d53-6070-4a75-8df5-9cddbd227784", "value": "12288:eByg8fGS09wNfEOO9l134XfUGbNi5DeqAfmx:QmfGS7NfEOY94PNNi5Def", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705828533, "uuid": "8741b0f7-5efe-4504-bd8f-8bcad2941dea", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705828533, "uuid": "66f76ae5-31ea-4ec4-8d52-5c8215290600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828533, "uuid": "4db81959-0619-4b87-b7e8-749babfd5cd0", "value": "BB60A90E4B8E849DD99E52A286F3E942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931c2da7-b83d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705828509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828509, "uuid": "a0b6f800-60f0-4ce6-99d8-09e96f6a1c86", "comment": "Malware payload (RemcosRAT)", "value": "97e8632d1a9a41aa37c6c90d8c39f9bd", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828509, "uuid": "6ee65a2d-ed8b-4f83-8405-a6e1e4935bf9", "comment": "Malware payload (RemcosRAT)", "value": "abe218f960a91262566205b56cb990c46822e5ecb62a7ea54e1ccb008e63ac69", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828509, "uuid": "1b384050-2211-4125-9580-d1ea909a3bcf", "comment": "Malware payload (RemcosRAT)", "value": "2731fddd9e1fc47a5aa8b85e49a02849d1cfd56f", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705828509, "uuid": "5e9a767c-f517-4edb-8043-ef3abb7f8709", "comment": "Malware payload (RemcosRAT)", "value": "369a035922ba54c5c5f3869d525c1acb8d5aed454ecd4984a377da544a75136ba12d8bbd643e6cd5c8a38e25499c9360", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828509, "uuid": "7d6fdfea-2450-4abd-912b-df6653edab0e", "value": "T1BC3412C92A2AFC5DE0A1C8F84C11F4B462B91CB61E9D7A1B2BF9FC437876944B716112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828509, "uuid": "e35422c6-c07e-4c76-8b3b-bc4bd026b3fa", "value": "8b35eb46454d6363341f0fc9c9c0d10f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828509, "uuid": "f5b7a501-ce8d-4172-8057-9eff2e245ca6", "value": "3072:jY+nUGacGYMUrfG+jBQKLqx5tIopnpjTRHqUmnP9qXLYfu5Cno2uIVvuSNXKzUs/:/5aclzNBDG1BTpqUml2LkuInoJmVXKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705828509, "uuid": "ea5e838d-5057-4aae-bb5c-b26248ad231a", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705828509, "uuid": "42297582-0d48-442c-9ca0-f50a0c5548db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705828509, "uuid": "e5f602e6-2128-4495-825c-41a691d77eba", "value": "17058285076c37a7073b87ecdd13242beec1b9459e2f79782c6bee6be8ad8e0ae732d6cb0f664.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "014ff49e-b835-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705824828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824828, "uuid": "ef48f9b2-6d51-4855-86c6-1b781408aa45", "comment": "Malware payload (Mirai)", "value": "5a69f2993a31799e6cd36efc4bd3c8cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824828, "uuid": "cc80ad72-f76b-459a-9faf-f85f00592e2c", "comment": "Malware payload (Mirai)", "value": "ac72f748b5e4bd92346733cc4c137f8b55f220c6d7b10dfdd0ca7b5a07ab62a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824828, "uuid": "9da8116f-34a1-4e05-9d82-a0146d90aa6c", "comment": "Malware payload (Mirai)", "value": "0d109dd9bee71ccccb8f7e3bff5c8884a1bc13c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824828, "uuid": "bc1e573c-ad51-45f7-bb4e-dd181534150e", "comment": "Malware payload (Mirai)", "value": "3abd649d646579abecd3f859dc27edaf918c7041096dff8ba7031fbed2220213e71263253424d95ad05feed37a6861f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824828, "uuid": "7c37089f-2c97-41b5-8721-382e2afd0b51", "value": "T12D535921797A2F17C4E8A07A25B38325B6B5768E32B8C65D3C732F4EFF14640A0075B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824828, "uuid": "42574d8a-aea5-4711-998c-c38b75274f44", "value": "1536:k+YY8/acYmgBOwicSYmnWLI1fz/A0LzpHpdYm+K:n2DZYmnFxoYpjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705824828, "uuid": "9c093228-6e85-4d06-b80f-7620b87493f3", "value": 64400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705824828, "uuid": "8b428001-6002-49be-9e21-265f9f14db19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824828, "uuid": "b00179fc-6dd0-4af3-b7d9-f2602c66fb79", "value": "5a69f2993a31799e6cd36efc4bd3c8cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b572c02b-b882-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705858202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858202, "uuid": "2257be2e-14ca-463b-a97b-2853cec140ad", "comment": "Malware payload", "value": "f05df7c16d8c236fab6ee2b2a1997ce5", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858202, "uuid": "b22cf3b2-da29-4d1a-840c-3e9405f99b81", "comment": "Malware payload", "value": "ace2a7812874a84b32590f440f9c4d9d99567e12cb86f0ba598e5e65aa4948c0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858202, "uuid": "3224f4a8-6e0b-4b2d-865b-f74824935445", "comment": "Malware payload", "value": "c907067a207eb47eca8bdca81c18caddee133ff5", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858202, "uuid": "049d64b6-94a3-4b15-975b-0f94d66ba5c9", "comment": "Malware payload", "value": "6ee23928610009b91b0ec2af8eeae3e7628b5d3169f96a410e59453e7d843f51bdc2edd7c252b46a01a5825f54a4c25f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858202, "uuid": "bcc1caec-d672-49be-9cef-1168c18b13fb", "value": "T162C0123C180195B7595774D7B165706DFD8DB954364450397AA3B15E919401E2D18250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858202, "uuid": "e7f9db25-37a4-44bb-aa56-94f823d70e65", "value": "3:L+3A/HJ+a31VKFF5fkJuI5VeYBMRjCsQHJ7fwYEK7RCGsTHkHMFY1e:BH82jKFF5cJuI5VeYSeBJ7fjrCrHOMFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705858202, "uuid": "b2e94ee6-22cc-43c4-b8ea-7e8001de166d", "value": 179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705858202, "uuid": "ee90c3d2-ae6a-4416-8b40-c43573217b6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858202, "uuid": "2da82f9b-1a29-42a5-9c81-6159af8d7b50", "value": "agent1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d009ddd9-b88a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705861683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861683, "uuid": "7fd9b11c-d84c-49be-9e72-2047651ec061", "comment": "Malware payload", "value": "ebc969c33ad801b78451920d75788534", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861683, "uuid": "71979b24-16f2-46d0-b57f-69bae155a3a1", "comment": "Malware payload", "value": "ad127e7bcc6293bdd0977581f80a95ce206e626e81f743c3972064c46dec1d57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861683, "uuid": "ada88f63-b63f-4be0-991b-cf00eb29b612", "comment": "Malware payload", "value": "97e8b262ec4e2e1497bcc3a063e43069af2c37ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861683, "uuid": "ec648694-8921-4821-962b-42b28a1f86ec", "comment": "Malware payload", "value": "58acb7a860a22ef32ea844151e3772e5ea5d577ad834ab2750ba98fcc08e143bc28ff4498cced3653e69034f783001da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861683, "uuid": "9dc62917-9a17-4609-9aed-e19fc0ca084b", "value": "T1BEC31841F544C317C2E22B76A79A8A5D33361A54B3DF73189A34BFF43B837982A36205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861683, "uuid": "f6d11890-53f4-4733-8c04-4c5eb2b4d765", "value": "3072:81BOCPZvQmUwVotFxnJBgctXU10IXHDDNbWWmREKNSQieXAZc:axvhXVoBnJKctE1djDQWmREKNSQigAZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705861683, "uuid": "12c2fc94-f057-4e4e-bf82-fdd7175f9047", "value": 126479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705861683, "uuid": "c94bc091-4e77-4f8c-9338-f1a430a9fdc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861683, "uuid": "8e7e9b33-d499-4738-86ca-eaf8cd96b921", "value": "ebc969c33ad801b78451920d75788534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2652dfad-b865-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Lazarus)", "timestamp": 1705845506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845506, "uuid": "bd725cd8-9920-4406-a0de-1c591f27147a", "comment": "Malware payload (Lazarus)", "value": "d8a8cc25bf5ef5b96ff7a64f663cbd29", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845506, "uuid": "ba8db9e8-06c5-4891-adc1-f6cffb756d44", "comment": "Malware payload (Lazarus)", "value": "aec915753612bb003330ce7ffc67cfa9d7e3c12310f0ecfd0b7e50abf427989a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845506, "uuid": "f5015bf7-b8dd-44e0-af60-d5d9e966e70a", "comment": "Malware payload (Lazarus)", "value": "d1e5e29c162566ce1d8a3d9c1a758fdbfef74174", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845506, "uuid": "ee1318ac-8e9e-47d4-a804-3d8bd1950ee1", "comment": "Malware payload (Lazarus)", "value": "1dcf81ee555bc05a1a659c2b58bfb52ec94eeb87176a24dd1f1119a356d6d201501d954d72b5af308639f09fb9408682", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845506, "uuid": "f4ad4a82-c583-4f31-adc7-4e62e52ab648", "value": "T1F664124D53692079E1269239C9E3DAB0E3B2740AA337D78E10D440AD4FB6FC6553EB36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845506, "uuid": "dcceccb2-5a28-494c-9154-f32997544ec5", "value": "6faf0aa45f2399d434f7346ab64c7697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845506, "uuid": "1f000589-e1b7-4912-8f70-7f78e75a2418", "value": "6144:mYu+TNVHFjt0W8zPtkpYrKms8YlTl+0TMKJU/liMTXYBcr4w:I2L0W8zFkpVzFl+08/MMj1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705845506, "uuid": "9eb7b19a-bc19-4747-afe0-5ef5c1ec55c1", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705845506, "uuid": "d8cfeac2-7bc6-4c50-b704-205674047ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845506, "uuid": "8036b305-1261-432b-a8de-0b4412abd422", "value": "sql.tmp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be19f2a3-b805-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705804529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705804529, "uuid": "c87ae500-e4c7-4e4a-8c07-69eda923b608", "comment": "Malware payload (RedLineStealer)", "value": "ad236870379e4c9c5177d090276ef29a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705804529, "uuid": "d5f6f7dc-585f-4a28-ad0d-bb4086455fd9", "comment": "Malware payload (RedLineStealer)", "value": "af1833567f6fb7143926ecb1611a85e288a268b60106d44a70ad91595417eccf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705804529, "uuid": "0690a508-65f0-434d-84d7-caa4ba229e4a", "comment": "Malware payload (RedLineStealer)", "value": "ff0b4f872551a5aaae5705c985dc6c49a0972cbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705804529, "uuid": "e640bd28-c1ed-4f15-bec8-2aba9f67d748", "comment": "Malware payload (RedLineStealer)", "value": "6a177a0bd000d1f62b234a8a760af657e50eb55a6b4b8b4b18e391af3a21988a5fe984326928943ed185070042b219aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705804529, "uuid": "8587216e-836f-4ed0-8cc3-7866438fdd49", "value": "T155645B1877ECCD16E23E4BB594B0E2B15775EC53A452E70B5ED02CAB7D22380EB012B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705804529, "uuid": "e1fff875-e38a-457d-b8e9-3fc936b579b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705804529, "uuid": "ec80ccf1-45fa-4259-a0ab-72d4cc08cf05", "value": "3072:7c4FlnBFrILuRyawIK1IyA7FadwH9pViLaPaDFfJH3Qmnnok3Ox3sEcadS2gMRqd:w+JTTadOx31caAXMRqTjD4RL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705804529, "uuid": "158e0400-44b0-4c05-87ed-b46bcda6543c", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705804529, "uuid": "e7a081d2-7654-40bc-8fd2-294d2bf9d0ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705804529, "uuid": "fb4b6f68-55f9-4995-97bd-9105e632bc47", "value": "ad236870379e4c9c5177d090276ef29a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a366b3-b89d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705869800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869800, "uuid": "db9787ff-b3f4-41de-846d-db5d143f9c6b", "comment": "Malware payload (njrat)", "value": "1993109480c1aa89a053dc451b5a8856", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869800, "uuid": "9c7797b6-107c-4c67-bc56-4d80f51e623b", "comment": "Malware payload (njrat)", "value": "af2d5ae5ed7a72a3fa6a36cda93e163b84d8ad70a78afb08bcd1afa63d54f61e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869800, "uuid": "9d8918f3-bc8a-4f83-a27c-7090bdfeff4d", "comment": "Malware payload (njrat)", "value": "39d2015180cc156651a7119f1caebe3eb9646ed6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869800, "uuid": "92017949-e7ca-43f6-afb0-50899b8bccd9", "comment": "Malware payload (njrat)", "value": "3a175862231de508dc56e4ffeb08ae3e9e717deb71171ff352bd3b629d72ff074922c7a32c420b17b0b65244a840f998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869800, "uuid": "529b7c45-928a-42b8-a1b8-6b518f73cfec", "value": "T119C2E82C37B68232D2EE067E5962DA5043B5E04BE227FB0E4CD954DD4B5B38A0B41FE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869800, "uuid": "ff1e6382-7ee9-4f75-80ae-cc980703c633", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869800, "uuid": "9611bbde-4fb7-4c9b-8983-bcd857824dc9", "value": "384:eLKFBjKLtFGodHntUD0g9WPMy2QqMRAQk93vmhm7UMKmIEecKdbXTzm9bVhcaQ63:IyBMkGSAfRA/vMHTi9bDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869800, "uuid": "75bdf91b-fa7f-48dc-9989-f0af8eaeae68", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869800, "uuid": "39d856f6-6b07-486a-ae36-4fb01d3cd17c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869800, "uuid": "cb351e9f-3268-45b1-8a01-01b33e4c8151", "value": "af2d5ae5ed7a72a3fa6a36cda93e163b84d8ad70a78afb08bcd1afa63d54f61e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d14cca9-b8ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1705876603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876603, "uuid": "92144110-de18-4f30-814f-2dae90c3aa67", "comment": "Malware payload (BlankGrabber)", "value": "c90b1dc196b50dbab7584a18f47341a1", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876603, "uuid": "a20b2662-a326-44e8-a29a-86c53fd3cb98", "comment": "Malware payload (BlankGrabber)", "value": "aff7b3487973f1fda81379484df1be5c04e4ebd15d8241534d81db07ebd766f0", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876603, "uuid": "0d1ca6c3-5a8a-4884-8872-378bfb98eb88", "comment": "Malware payload (BlankGrabber)", "value": "907da26f22635ac7d7f57d82b035f9fc32877bc2", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876603, "uuid": "9d54b395-3c1c-4472-9364-05c4aefad39d", "comment": "Malware payload (BlankGrabber)", "value": "7a5b9aaa34557ce420121d74f608dc896844ea4a0a86969183235f07b3c20a1fc042e99f169775dfed3579ca2842ccf5", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876603, "uuid": "0ae2b23f-eb73-4568-bffa-36c299746c2e", "value": "T13A763311B3A858EAF991923DC5CAC626DB33395123A0D6CF079847721F271AD8C3AF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876603, "uuid": "c9407bb1-ea55-4488-87ae-c61bbe2e80d9", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876603, "uuid": "b0be2f5b-e460-427d-82e8-840af006b12b", "value": "196608:GaYS6COshoKMuIkhVastRL5Di3u41D7dJF:tYSROshouIkPftRL54VRDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705876603, "uuid": "52a20a69-fb36-4617-9f77-8368595cfc4d", "value": 7678247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705876603, "uuid": "e712ad7b-be6c-4e22-8797-b4ad4f68aa70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876603, "uuid": "16452552-e2b3-4446-bc86-b4d3824de14f", "value": "SecuriteInfo.com.Python.Muldrop.16.8663.20002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f73008-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829455, "uuid": "f9042e2e-1860-4a53-8871-7a9e435f58e1", "comment": "Malware payload", "value": "3861c4bdbc8c82575176d07423f5e5af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829455, "uuid": "43aaf21a-5e7b-48c5-9a02-a9e2ee1aa58a", "comment": "Malware payload", "value": "b1e528a3110cdd258aae7a905b62161942b1dd6b51dc1a55b8b6eead592c4dd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829455, "uuid": "72201e76-a0f1-4e3e-99ff-7f4be0de64d0", "comment": "Malware payload", "value": "cd6afc207a136ef3b8d3bc8582a28d48c0816827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829455, "uuid": "f31af059-0f92-48f1-9133-4dbc3410fdb6", "comment": "Malware payload", "value": "1854da08b1798a3675142155bde7efecb8584a43be70b01995a914da1a6f348fb2d12ae98d00524f02ac0d90b56ca101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829455, "uuid": "bffb6524-665b-40ce-a2ac-0f58dfaa29cc", "value": "T15E458D27F66104F7D656603318B707397B79AFC20A22CFE39299CDA55E33362AD32251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829455, "uuid": "38cd4ff5-18dc-4b64-89c3-c8a57422245f", "value": "24576:jzFGKUC/WbACNu9mxjqWUXLYL1L0LKaMZtNzMB:jz8rayz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829455, "uuid": "062d81e0-ee2f-4fc8-8b3c-aea7b3a29225", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829455, "uuid": "8950b90e-1914-4c7c-8b58-a2383ec39dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829455, "uuid": "05b21458-bda4-4271-8094-04a19650115c", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.8800.19663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844d6620-b83a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705827196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827196, "uuid": "4dd27899-59e3-4d9c-aee9-35bc7cee80ea", "comment": "Malware payload (Smoke Loader)", "value": "ca03d9c357da9657e87bc78fb628ccd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827196, "uuid": "9805e427-f235-473a-af30-8e87e3bde065", "comment": "Malware payload (Smoke Loader)", "value": "b2296b0d8a305d1177e12d6746b9a4f341f3ac69b6381d79e8e6a5006d652651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827196, "uuid": "367b40cd-4df2-4de0-bff6-662ef5751fc4", "comment": "Malware payload (Smoke Loader)", "value": "c076e978c284faea1baf10d929f4f2de074ee24a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827196, "uuid": "e2ba035a-1fae-472e-8d58-3e8738426cef", "comment": "Malware payload (Smoke Loader)", "value": "4dfb52c6fa1bd8e14285c83cf0765d96151ffbc71aff97c2c6de8dd654beebc93227f6f8171f84cd66c55a4deaa522e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827196, "uuid": "9dc1c91a-c388-4a14-93f9-9a25f6df102a", "value": "T1DD343B13FAE07E50E5A64B328E3EC2E8765EF1518F5A7765212B9B1F1B711B2C123720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827196, "uuid": "9a2b6e86-822e-43d3-b43b-c273a3f346ed", "value": "e0e4d350eec84bd11f6f18b6d0e645d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827196, "uuid": "54af72ce-b5a7-4363-9829-0f4d508fd1a8", "value": "3072:FILY4JowyqXL7cBjxilycJQ66/TkFbPG+AKCBKqHiycRfzJk5HxAIr:FGXL7cB1iI6gYbPGtKEHuf0xVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827196, "uuid": "2b1aa228-1b52-403e-a2d2-f89842d01cb2", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827196, "uuid": "d7c1433b-a6e5-43f4-9e84-ee5562d0d64b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827196, "uuid": "9a3ec919-c56f-41ca-a03b-10ac8db6764c", "value": "ca03d9c357da9657e87bc78fb628ccd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165cec31-b893-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705865236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705865236, "uuid": "cbd5ab75-354a-4b29-a37e-bbca5b9f6348", "comment": "Malware payload", "value": "d55473d3607edeb4709e5688f6859fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705865236, "uuid": "f57b9833-267f-4df5-8ff3-19992f29d393", "comment": "Malware payload", "value": "b263b44ad31166ccc4e18d59cb2d828d2d7d56b7217569f9e61e872a6de50018", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705865236, "uuid": "7317b3bf-85d6-4551-86d6-a0132fc929b2", "comment": "Malware payload", "value": "acc6815826a753dbd607ab23d338e3d52bff326d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705865236, "uuid": "e2d8b7bc-6db3-4363-8064-f78430e57b14", "comment": "Malware payload", "value": "7146e377daeb424ce1d4effd7e164965ad342c55fb6f27051f2b7789af9c1cb621b5a192ff92d850f3090b21c6406428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705865236, "uuid": "84e14c0b-0d7c-4c92-98b0-aa7443f20088", "value": "T1A9534A0973C7A325C5290AB680E7A43103F2A3876B73D7993DC812E50E56FD1DE8776A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705865236, "uuid": "275d34fa-2f7f-48bb-bc81-ece75dbb1a7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705865236, "uuid": "71e9706e-842e-4b66-b097-82beb7f60ab0", "value": "1536:D2iZKClJ8nT4x/sF4EamuTwrhb3CqN6uERGl3Q9hSId:zT8ncp04Quwhb3XN6uE5X1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705865236, "uuid": "1ee110ae-323d-4543-9cc4-8dcbb5e57af5", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705865236, "uuid": "d02a4464-e53b-4800-8d6b-6968d40c81e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705865236, "uuid": "ba021a22-17e3-4672-9b31-b1a671619eee", "value": "SecuriteInfo.com.Win32.WiperX-gen.2216.16985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a943c6-b814-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705810880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705810880, "uuid": "0fe646da-7825-4018-b7b1-d60df18db51c", "comment": "Malware payload", "value": "3e3603d5523fea7b8e26c1454e3a0bb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705810880, "uuid": "263dbf8c-5af9-4116-819f-91e6ae1319f6", "comment": "Malware payload", "value": "b2b35b3aa8a68403bb4923cf349cb0fedbcff1b8dbd4a939c99a377ccdf16d2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705810880, "uuid": "45d3312f-a5f6-437e-bfdb-feaa8d909c35", "comment": "Malware payload", "value": "1fb5a04cb80d553afeeeedfcc7fe9c200a042ec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705810880, "uuid": "7dfa0449-79a9-4c31-a9c2-344936c8c07f", "comment": "Malware payload", "value": "44cb8ade6c35bc40237a30babfadc54784c7ee39017196114e118cb6356684d935ab9b79bc7ca1009c9cd7a591041086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705810880, "uuid": "5661c792-9a4d-4896-9571-6c6f3d6a0a52", "value": "T17BB57CA671D953EEF116903D5488864FEB113C3683B367BA3350FE729BBA6505F63A00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705810880, "uuid": "0315f117-73c3-446f-ba6c-bc633cd4bcd5", "value": "aa8025e0ff674e112eaafe12a2b8f849", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705810880, "uuid": "06dd2a55-c0bc-42ec-9bac-71e7d1a38c32", "value": "49152:GIRdnNDm25DSnuVj0qh2P/Yu44NWyZwVLbbuyCi4GdVWxS:G0NDt5+nuVj0qh2HYu44NWyZwV3buyCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705810880, "uuid": "7dada7d0-2e1a-4b04-97c6-b31b8fdce0ce", "value": 2377728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705810880, "uuid": "6358bb24-b0f2-406d-94cf-375bb35916b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705810880, "uuid": "7704539a-9baa-4982-8a79-f869245c27c0", "value": "SecuriteInfo.com.PUA.Themida.32395.105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85f408f-b836-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705825592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825592, "uuid": "e92c9873-43fe-4b31-872c-43eba7915d35", "comment": "Malware payload", "value": "a77286daee56dfef52b8e9b2431b9db8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825592, "uuid": "00cd9b24-631c-4f20-a211-9a978b405e84", "comment": "Malware payload", "value": "b2d2725723cceadaf7fa5a196374a398bdc9a2623689bca4a59de4c505921f98", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825592, "uuid": "a734355d-10d6-4024-9ed0-938aa65cc0ea", "comment": "Malware payload", "value": "d9088995b6a7d494f5c0656b6bd3849d5008b333", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825592, "uuid": "2ba4a802-5317-44b7-bc6e-7781f09c68a8", "comment": "Malware payload", "value": "0aef6da3f6115d2314f8b45e69d5507ef416fa6b1172da408a2eee08b38ca81bd99022eae7e82dd59961597c2f535832", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825592, "uuid": "96c7d2d7-95c9-45d2-8046-91a459921f3d", "value": "T149A4543075DA4990F07FED602DF8FA7141B234635EC68D821AD0B186CA7BDA0BB46D5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825592, "uuid": "2a267d6c-8e95-484f-bf53-877bcabf8a7d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825592, "uuid": "a6c41bd8-55a5-4a8c-9ea5-90371bd1334b", "value": "6144:K/QDyPsryPNAWyPsmyPsJyPNbyPN0yPNEyPsfyPs7yPNYyPsJyPNpyPsFyPNhyPw:K+p3q3V353E333pMs/5CzHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705825592, "uuid": "8160e9a9-95eb-469b-b18f-256bdb1c15eb", "value": 483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705825592, "uuid": "7e51e497-26d4-4e92-971b-64c4318cfb50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825592, "uuid": "b3aba68f-2caa-4c40-8b61-cb666c7efcae", "value": "SecuriteInfo.com.Adware.GameHack_AGen.8850.19491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10112366-b89d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705869521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869521, "uuid": "aecc424b-1fd6-4424-ad8b-1d58b3599846", "comment": "Malware payload", "value": "b5b253c5683808fe9f186272f3261549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869521, "uuid": "51a07e8c-db0e-4cf7-8992-9d17699e6dc0", "comment": "Malware payload", "value": "b33c768a9b6215733de13570a3049e4abaa787944d099bd8f93215df7abd5d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869521, "uuid": "0e44e994-0e49-4ac5-9762-8f8d62db6078", "comment": "Malware payload", "value": "8a2bf7d20a2eca35342cb5bd9ca59a4fc7119fa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869521, "uuid": "27962fd1-2eff-4619-8d10-58ac15ffb0bc", "comment": "Malware payload", "value": "48b0468bc42da0ff57d7a7c1e2b016a057f8e04f65866abe283a3830e9d3503d57c5f663a5f04a0bf454e80cec15a3fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869521, "uuid": "f7ccd0af-cf78-442b-9485-4c129e604b72", "value": "T1B9532B0973CB5321CA280A75C0E7D49506F1D3472B73D68E3D8422E55E93BEAC986B8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869521, "uuid": "9e58e8a6-9985-4d85-8b1a-fda064727cbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869521, "uuid": "ba11032e-9ad7-4d94-b622-2485ec732931", "value": "768:JiDt8/1YViYW2V02FQWL3ILtE79qwObQA+LjuHscot3umQM6IVTM2fuc:AKsn9FFQPtEhqFQASiHsL++Oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869521, "uuid": "3f825984-da40-463b-b16c-8383e865a4e8", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869521, "uuid": "bc7a47bb-330b-44cf-9be1-a417cb282413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869521, "uuid": "b45a1a63-5e34-4bb7-a099-82bc3b76ade6", "value": "SecuriteInfo.com.Win32.WiperX-gen.8857.21147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb04f81d-b836-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705825596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825596, "uuid": "38b69971-df7a-465e-9e5a-1d5cf7a4f6a5", "comment": "Malware payload", "value": "b7a7b606861b4188fc18c86f25a2127d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825596, "uuid": "a6f16de5-78f7-46c4-8c6f-fd69cdc88e2a", "comment": "Malware payload", "value": "b3d3506ca2087556e2aecda32f0902d54ecc1f8ab347cbbb8b558fd90ba6ceaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825596, "uuid": "f2d5abec-235e-4ccb-8f79-0704bbd4d80c", "comment": "Malware payload", "value": "6e14b5a1eba24521980ce011dedf837ecfa42c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825596, "uuid": "9c727bae-c0bd-4409-beff-2d48e2b91fd5", "comment": "Malware payload", "value": "3728b1158ac59e00f479112afcdbd163dce800f1fce10a1a4295f446025d7c1729045ae93e899bde525f553a15332dca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825596, "uuid": "2adacc1b-435e-4f29-95a3-15c339eb7273", "value": "T12FE3295763A510A8E6B7E2BCDAB20612E7B27C150735D3CF1360417A0F627E16E3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825596, "uuid": "290442c7-a1a9-43d8-acd7-cac624d53157", "value": "9aa7e87a8a758cf2a002bfc1668c2b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825596, "uuid": "8328b897-f1ed-4f69-9a3c-1d87c71bd13f", "value": "3072:r32oogRpAZX2wcwvc8wAWl9rhmJTQSaMm5/6JgwhdZtMM:b2LgRpkJSv2WltcdTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705825596, "uuid": "dd7bac80-e6e0-4382-9fc5-3a8b6f657444", "value": 143872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705825596, "uuid": "28ce0494-58ab-4933-9f68-17ad732b01bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825596, "uuid": "17ffea72-00df-472d-8046-cdd80a38fa03", "value": "SecuriteInfo.com.Win64.HacktoolX-gen.27334.27327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2eeb543-b88a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705861687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861687, "uuid": "2a5c254c-34ef-49ae-a81a-82348bffbfba", "comment": "Malware payload (Mirai)", "value": "410c2910e994e38f065c007c10436cdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861687, "uuid": "3444ba31-966f-4ede-b740-4924b339b10e", "comment": "Malware payload (Mirai)", "value": "b408a9e7d841b2672e8a93069093b29143065edf5356f01ab301d7600409e20a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861687, "uuid": "2df404c0-10f7-413e-9f6c-86a6287117cf", "comment": "Malware payload (Mirai)", "value": "750a2e24a824c40722ce1dc60ee8aeae3ffcf8ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861687, "uuid": "98dd7661-245c-4d7b-b4b8-af231447e015", "comment": "Malware payload (Mirai)", "value": "82ca0ef3d3947c26460f09aa0c22046a8b80b7e1be7ed34d606b54c12b1799ce00ac1900de6898512278ec96ee94d860", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861687, "uuid": "5c4b4548-7fc6-40fe-946f-ca433ce3c023", "value": "T164A308C2E361C2B3E5970B7502A7CF390132E977275F6E29E3683EB4AA26144752731D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861687, "uuid": "04ee56d3-db6d-4331-a50a-655639245701", "value": "3072:vKsBzU4UtU3fqVU5xqO0ciwHZ554NZJw2ZwdNWmEezXdKCYdoq:y4d8wMU5xnHZ55ilZw/WmEezXdKRdoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705861687, "uuid": "21df82e3-f1d5-479e-a6ac-e68795402de2", "value": 101114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705861687, "uuid": "ddada1dc-a3c4-4fe2-8baa-dbcd7a8e630b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861687, "uuid": "e3d4d455-cb8f-4c1c-a8e4-cb68857b85c9", "value": "410c2910e994e38f065c007c10436cdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c032643d-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829444, "uuid": "6e60a5cb-5dbf-4afa-89c8-908d08e3e614", "comment": "Malware payload", "value": "5c227f00f466f01f2ac19614493fa143", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829444, "uuid": "bfe49778-f368-432f-b0ac-41d7c1d18892", "comment": "Malware payload", "value": "b466f476f19fcd1f9837e08558d090e0b05a618c8bff5f74ce773eae732a24e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829444, "uuid": "33b1d96d-8f48-4fcf-832d-f3bfe1d6de7d", "comment": "Malware payload", "value": "b3e790ade09528f1cb86b7c49093afb452efb4d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829444, "uuid": "9159d04b-818e-4be5-8366-ad181e12f977", "comment": "Malware payload", "value": "90d354c0e7b3f87d7e097d898b477fba0f21f45b78a53cc08050a1a3b3884e12fb2afbb8456b7b7b30af9fec4b11303d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829444, "uuid": "aa9d354e-61a6-4cc3-b142-5ac7bd7e2a55", "value": "T110B273237A689973E558C7F148D386D7A9137C716A909D0729CE9F6E2D312027EE130F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829444, "uuid": "344b3a2b-2992-444a-bb60-ed172e85e27d", "value": "0b84088c62b32e9813e770e38150bd0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829444, "uuid": "ae7d7a09-5d96-4833-9d44-0ac2efed893d", "value": "192:TMb7UOkh1mtjlA+831ozzoWvcKCEAxK6Kd4nBWd:Tc7hdM31gzvspKd4BWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829444, "uuid": "ef73a5de-0454-47bf-bbec-a5d02c468011", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829444, "uuid": "71301479-6550-404f-bf3c-c3f0a2365f70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829444, "uuid": "0b90d804-02a5-4ce9-b2aa-65d5def82519", "value": "SecuriteInfo.com.Trojan.DownLoad3.12809.12806.18629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14319a17-b865-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Lazarus)", "timestamp": 1705845476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845476, "uuid": "5a2b2a18-9095-4a0d-bea0-c0543e2c0d50", "comment": "Malware payload (Lazarus)", "value": "46127a35b73b714a9c5c58aaa43cb51f", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845476, "uuid": "4bc14f65-46ac-411c-9d06-a5b91606939e", "comment": "Malware payload (Lazarus)", "value": "b4c8c149005a43ae043038d4d62631dc1a0f57514c7cbf4f7726add7ec67981a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845476, "uuid": "74d0d7be-2a5f-4a7c-93ac-f60bdb403d76", "comment": "Malware payload (Lazarus)", "value": "2fec035370124bc081185f16273f866242cfccca", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845476, "uuid": "0c9c873e-086b-4f24-bbae-705cca032743", "comment": "Malware payload (Lazarus)", "value": "3b28596117a324b3ed130c080b352526e810bf5a3de7a92b802a9c54b8bb7e5e7035407877ac8ad122f3877495ba8b58", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845476, "uuid": "5f43ee2e-057a-4607-b17a-1c9fe0fffb36", "value": "T1B9740209762545BDF0B75736C9A70A38A731F90A5339C38F2268526E1E673CA07BB731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845476, "uuid": "c579f5e4-8dd7-41c3-947a-c858250e58f3", "value": "384791714fab3f66e38d060d2050082f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845476, "uuid": "9f18f0a1-db52-4eca-b2a0-a0cae22035b8", "value": "6144:kxTnpriCY6ryuAm0q7EDK9IGA46J0kKThdCB39TOYK9YcDCmr9qZ/VZA:wE0yzm0qgD1GfUKT383pPSYcDCkqZ3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705845476, "uuid": "ba7b206d-2e56-44fd-a280-a54079c3328d", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705845476, "uuid": "c403efbc-4295-4194-8833-fb2c29f156ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845476, "uuid": "33f9ba75-914d-45ba-a764-18f9ff0fe1db", "value": "46127a35b73b714a9c5c58aaa43cb51f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca696501-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829461, "uuid": "ab857555-b1b5-430d-b965-b86e8492879a", "comment": "Malware payload", "value": "8326ae9284ac31ebbfa0158fba27160d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829461, "uuid": "798e16cb-0caa-4c71-947d-a17f14d8828d", "comment": "Malware payload", "value": "b58f4d6175d6d3ed4faf3ddc056b98172bb086df65ee02ef9e174cf403e9b3ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829461, "uuid": "33c23276-0493-4fff-bee1-277c200c0e07", "comment": "Malware payload", "value": "b279354d0ec6eb468d56987887ceab0d287921fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829461, "uuid": "eded83db-273e-4d1a-b885-8b08e6d786c4", "comment": "Malware payload", "value": "7f912c9a6feb8b37c113333e1b78d72f75c126c63f974bf5f242b40fab25a65aa6cc699e3a42e53b4788a9a6ac079bfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829461, "uuid": "a01d277e-5b89-4e01-b611-7c75ca2a654d", "value": "T10BC49F26E2D05537D1271B389C6BA7789C25FF003A29DD476BF81D0C4F3A6913D2A2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829461, "uuid": "c485d914-2204-4ce7-9a53-92c1c565aa90", "value": "69932e10d93add129f2b9cc4ca6321a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829461, "uuid": "83ca38bf-869a-49a8-ace8-9c93d0225d11", "value": "12288:GvwCYTKt0pCo3s8094YXx312bZjCVfSRCd6/8w54:9CZAaYbJCSRbDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829461, "uuid": "a8b90a4b-9841-4072-adee-640f0ba15b0d", "value": 579265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829461, "uuid": "dc92a9de-5b38-474f-be65-490363233869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829461, "uuid": "770e8650-d769-4747-934e-b2c5b386d51e", "value": "SecuriteInfo.com.Backdoor.Win32.NetDevil.13690.14010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d191f35c-b84c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705835056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705835056, "uuid": "e54f4b0e-0fc1-447b-9b6b-cb0f99f06ec5", "comment": "Malware payload (RedLineStealer)", "value": "a732d7581a327781accd7d53d0c6bac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705835056, "uuid": "d92e460f-59e9-44bc-a7f7-26edc251ba15", "comment": "Malware payload (RedLineStealer)", "value": "b70d2784c1bc024d0356a71fe82761be321649d182c6cec390d7f35b23217fa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705835056, "uuid": "0b4b7151-0848-4175-8f9b-541b51e104c8", "comment": "Malware payload (RedLineStealer)", "value": "b7835ca9e09acad34eac5e1196fffd5967510502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705835056, "uuid": "180220eb-3575-4c64-86da-8f533b233b98", "comment": "Malware payload (RedLineStealer)", "value": "75486be69a9abd9402350114e90fba4483054ba93ea9b8ca117cb507659713e3e6f7b125aae7558a661ab7f581bc2856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705835056, "uuid": "70f8c481-2510-4a9d-9787-15857fa38c74", "value": "T11B549E5B32A068F2F45F0E31176B062CAF18F3A05F6E5A8F1717586B5FB6180E824E95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705835056, "uuid": "7d7bd065-52e6-4074-a037-04c743b69ddf", "value": "1fc50212a54cec4a1fface4355b7333e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705835056, "uuid": "8abed38b-5a18-4364-b062-01af7c4768f4", "value": "6144:ZgEOW9NvKlIIg31EmYQGHoKhzzA9zZ/3VCCk:EWq6Ig31ECOzAhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705835056, "uuid": "6aeb57c8-677c-4eeb-b93c-9c7986902621", "value": 298769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705835056, "uuid": "bfa30cd7-833f-4a5d-8366-2d8bbbefb234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705835056, "uuid": "fd1e1473-171c-4058-be31-fc7f0dd0be1a", "value": "\u041a\u0430\u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbd680f-b89e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705870218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870218, "uuid": "03147d9a-d44d-43e0-95a2-8bfe16f159ff", "comment": "Malware payload", "value": "f85ac4fc2e66845cfb24fe3d8a6b8462", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870218, "uuid": "a9de601c-5597-478b-a9cb-b88b17621c4d", "comment": "Malware payload", "value": "b76cd92e2380c9ec5e1a860030409898e27a285120dd14c70d279dc82b3b15e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870218, "uuid": "d9eaf4ca-3357-4725-9316-488957c79b8e", "comment": "Malware payload", "value": "93afe04379466d024aeea30ecdb2b80f7424ffda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870218, "uuid": "0f8f78e4-e075-4786-8a70-e3eea3649279", "comment": "Malware payload", "value": "c50d14510378be5fc9d7801b01f39968d6d14f8c2eddb60f87d7de404c250bcfd46ed39d30dc0dd9206e0fd9fb420d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870218, "uuid": "9e49bba0-8c7e-48db-9913-bd044bf1134e", "value": "T186F4CFAAA7150962CB726331C9F396010611F9B69663E30763C9667EA0073FF5FE2707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870218, "uuid": "b05b3cf2-6bdb-43bf-9534-32c5d0cc7757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870218, "uuid": "0d26e354-1fad-4ccb-89c4-9b32911d1edd", "value": "12288:fuDWlUlTiYjPNcDzgoaIvtM5lv/qkpvCqYxyrarmha2I/0Ms9edt09uTy7mw:pCfas4vafvNvCqYEGrX2YhnDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705870218, "uuid": "2aa69f37-7236-4695-92f8-002525d47393", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705870218, "uuid": "18497fb6-ded5-45a6-b9e6-9bf019ec6914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870218, "uuid": "8085c8a7-2963-430e-b612-5bd9aefd70bf", "value": "ApplicationFreamwo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded75055-b88a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705861707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861707, "uuid": "45fe9a51-05be-45d4-b539-7bff17386b2f", "comment": "Malware payload", "value": "62236cc361e772b978ed29a67b64d102", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861707, "uuid": "350a48bc-46ad-4047-9270-e34f800fd101", "comment": "Malware payload", "value": "b76fe596e9908ea834606bfe8ac47a11ca4e81e0191298e731f2f86d236e25d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861707, "uuid": "334d7dde-0323-401e-b441-3f8ab5a4ed94", "comment": "Malware payload", "value": "a85330edc0e73efc19943ab7e8f8ef5acc31e61e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861707, "uuid": "733db098-0d30-4e4d-9166-1d0a1949bf45", "comment": "Malware payload", "value": "ccc09e515d09880c6d36f85d85d074aacab6efce32a48f4095083537fd255d42ef05e1f69daba32412b5abc3eb9f41ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861707, "uuid": "c173d312-5771-4be2-abf7-67c684cb3143", "value": "T117159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861707, "uuid": "b714add6-b1ea-4744-9c0d-99accf0bfdbe", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861707, "uuid": "3be7285f-6f09-4da1-815e-e7c691af3912", "value": "12288:HqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaaTr:HqDEvCTbMWu7rQYlBQcBiT6rprG8aqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705861707, "uuid": "207af5ae-1087-4b96-af40-cb2a9b70515e", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705861707, "uuid": "2e7bc994-8967-4685-903f-bb7d8a3571b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861707, "uuid": "778c697f-32be-486a-bc3a-48b74a72a23d", "value": "62236cc361e772b978ed29a67b64d102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c4e34b-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829451, "uuid": "778f146b-5dcd-4b8a-ac8d-522f07e1cbe5", "comment": "Malware payload", "value": "0af89c86bb4b9494debfd63af49fe612", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829451, "uuid": "93cee4ec-6543-4218-bc1d-771e8652f944", "comment": "Malware payload", "value": "b817007f43d09ff1bd8778417178fedd3238bba85912b827310dc71f9ec2b2a8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829451, "uuid": "63666af4-6337-4a46-9cd3-b9665e6241d8", "comment": "Malware payload", "value": "5c443de36d9542247b626df48bbedc107d8b2f99", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829451, "uuid": "57548002-c3a8-4aa0-a921-221b6003e9e4", "comment": "Malware payload", "value": "d8158abc35db91ce4f21d325397a8f52de2c096b3a022bf96e2d8bd999103f6860725a220b66d2a88b521c3da50498e4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829451, "uuid": "c9cd1786-d69b-4acb-90db-da304e6dd06c", "value": "T10906E002FAA1C86AC8970134D97396FEB3729D51EF54CA6354883E197C724963E3E3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829451, "uuid": "2847724f-2c72-47e5-853f-35c920da319f", "value": "c05597ec9d1ddc3fe5ea1d6cd6d6030e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829451, "uuid": "8b3219b4-2dfe-43c9-b2b0-eac4ce0084e3", "value": "98304:KCaDZO0mNI9F5funmsTsBnUsIvG5i40Xgbhz8DLjP:n4E0GKenYys+GSKz8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829451, "uuid": "cf03e4a9-af7f-49a2-a178-6b4eb766f9cc", "value": 4006243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829451, "uuid": "fc8c87a0-05aa-4200-a18c-1339ed56738f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829451, "uuid": "1a44efa1-8d0c-42d5-b9da-2429d8c0c648", "value": "SecuriteInfo.com.Trojan.Crypt.2513.15286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426d9031-b848-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705833098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705833098, "uuid": "a95833ec-bcfd-4604-83e3-94b2ea95972b", "comment": "Malware payload (Smoke Loader)", "value": "16ea7f0ecdff9eac933dbf9babeff1ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705833098, "uuid": "4d3d9608-4b9d-417a-8dbf-9c241877f303", "comment": "Malware payload (Smoke Loader)", "value": "b996a1613f4254a630d0b3889c71e1c500be05a9c7a03ec97130ca0998009b70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705833098, "uuid": "9d882015-6442-4247-b148-a92290bffeed", "comment": "Malware payload (Smoke Loader)", "value": "2816c942dd3e0f2ed3fd19fae7f193273a39e81a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705833098, "uuid": "637d3357-230c-436e-bac6-56bb09ce8998", "comment": "Malware payload (Smoke Loader)", "value": "719b9de6c444a08d9ce5d012ee1c3d944cac57d37793a79713fd86afcb98246d767e4435a77d913abdb3e61656c6d368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705833098, "uuid": "58b9d971-9e58-4848-b194-a3c29810b5d0", "value": "T17E247D1036F6C035E3F766304AB4D7B00E7BB8633671A58E1B9516394EE76D18A26F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705833098, "uuid": "25e0585e-6458-4cca-a46b-b37ee81fb9b3", "value": "746daee29236627ffe8f168625f0fd18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705833098, "uuid": "f42b0b24-0762-47ae-9965-5459de0b9878", "value": "3072:DDp1Df/El6jtmnmOU6YtwjwVWKOrLq62gZNNfv3UsPlroAGeHY2tw:DHL/C6OhwDOrP2gZX/UsPlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705833098, "uuid": "7b0303ed-801e-4d09-807f-59141313a4a6", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705833098, "uuid": "bc9469da-3f80-4a48-8707-9e4c39583271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705833098, "uuid": "a03e1491-399a-4e04-9921-e9240e310e25", "value": "SecuriteInfo.com.Win32.PWSX-gen.27268.14094", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41dd122-b88a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705861663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861663, "uuid": "7a0204e0-3b27-4b70-9085-39fe47a84a26", "comment": "Malware payload (Mirai)", "value": "44aa5f6a6ba7e35064dbde8a538ce010", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861663, "uuid": "11d1f953-0987-4a2f-b009-a2da1b2e26f5", "comment": "Malware payload (Mirai)", "value": "bc60466878ac1a81a15d4d1e967f6015dc8082a38ef3e0e28e105231cfe62872", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861663, "uuid": "ba7a892f-f8f5-44e1-9d97-4153a6560f55", "comment": "Malware payload (Mirai)", "value": "08ef416ffa55ffd9aef294b674a4e8b05c4d9248", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861663, "uuid": "f3cfcc01-a10e-415b-853e-1c084a195166", "comment": "Malware payload (Mirai)", "value": "19f74e7c38dde66070cf818f61d19f57aebf0246652d839b6956abc82f4a556c998b59895498bce859891664330e5957", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861663, "uuid": "a2e9fd81-b48c-42e4-baf3-a4c3873f65a2", "value": "T165F33905F640C747C1E22776A79B865933338B64B3DF33199938ABB43BC27991E36606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861663, "uuid": "f8632ff7-ca51-40f0-8eb9-c6800ca7fff9", "value": "3072:wC2qIZ7a76orzbfdnbx3Aj1PIeoHeM2XxV2WmJhny2qAQYzc:C7a76orPfdRAjTweM2XxV2WmJhny2qP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705861663, "uuid": "a28ab365-3e84-4e82-8c26-9151acf74066", "value": 167599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705861663, "uuid": "6e1c5eff-1742-431e-93f0-19da72421d51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861663, "uuid": "fa5ed6a2-6184-42ab-9729-d181e4f37eaf", "value": "44aa5f6a6ba7e35064dbde8a538ce010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c07a4e-b865-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Lazarus)", "timestamp": 1705845455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845455, "uuid": "559e1254-73a5-4da6-84e8-71eea42db826", "comment": "Malware payload (Lazarus)", "value": "da505bb6a3d54c2a0778c4a04179da0b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845455, "uuid": "e5911a41-ed4d-4890-93c3-ec726ff7bc60", "comment": "Malware payload (Lazarus)", "value": "be738fec40c2f6e6a818797c55819e3b01147b0a5e8dcb4c5e1238cffcef95cd", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845455, "uuid": "c63a87c3-28a9-4234-b17e-5dd0d1cda457", "comment": "Malware payload (Lazarus)", "value": "28dbbafcde8ad6e260300752cc2b879e970ecaf8", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705845455, "uuid": "bcbf8859-f80c-41a5-aef9-6f216730e347", "comment": "Malware payload (Lazarus)", "value": "9d12d1c47c9e22c8b70011838c5cb46786596cbffeed91127020eafcab9aba417bfbb7f04270e44b2837aeac119a34fa", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845455, "uuid": "82119b84-d457-44eb-87fa-0799ef559123", "value": "T1C3546C0672000479F36907348992E6E596B27C3916E4E38FE278B9762E332975E7731F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845455, "uuid": "2860436d-e061-4ecf-8c75-e06e27c51aae", "value": "23a1e10b5cfb66416d6123ba340f36f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845455, "uuid": "e812cf7d-3e88-4f95-99e3-5e033ba4ae24", "value": "6144:wImWT4GPTngApLJ+8q0YoYmgWazsF/0JkWuu4UyKh+DCAi4KdhOlp:wImWT3sAvpYlZIu4NKh+eyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705845455, "uuid": "4617950e-1de5-45e0-8221-b130cd405229", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705845455, "uuid": "33c317ff-8337-48f9-a7a3-b33ee473dda3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705845455, "uuid": "1e893779-09fd-4b03-a56d-9ee741a43a96", "value": "dumped.exe.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6596f4-b7fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705801039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705801039, "uuid": "48753471-7c76-454b-a078-cb48223e32e0", "comment": "Malware payload (njrat)", "value": "51080a141f889a8f20b61371750e1f33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705801039, "uuid": "6aaf6c8f-8339-476e-8bbd-6a3b6278b6bb", "comment": "Malware payload (njrat)", "value": "bf46587c341de6c7d389cd4980158f0defe2ec4c811f582d89b18d2b22e3bfa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705801039, "uuid": "e660e2ed-c681-4718-85ea-6594ec25b27c", "comment": "Malware payload (njrat)", "value": "022a6c62691f23c63eef0d1d99979121b398d514", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705801039, "uuid": "8ee14082-2ffc-45c5-8c06-fc160a1dad0a", "comment": "Malware payload (njrat)", "value": "db22acf59b74758cccb15de64d31d98b042353fc626d682cc2b7186be2c18eeb0f0d2dade067cfc76477a2f5a7f37941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705801039, "uuid": "9d05ba5c-3620-40dc-aac8-888b6e3fd4c7", "value": "T1D793E84977E46424E5BF56F39971B2404F34B5871602E39E48F218AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705801039, "uuid": "e2d1067c-3818-4e22-aed5-18c2a6a60735", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705801039, "uuid": "9ab23831-7d94-4302-8b67-7ac1aa611dc3", "value": "1536:2e1R8lZc+/2HK1j+fzdljEwzGi1dDWDNgS:2e1Kc+/2HK1IzdSi1dga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705801039, "uuid": "ad50586a-f545-4f77-ac94-8de775b060c8", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705801039, "uuid": "81e3fdbf-35fe-49fb-84ab-739ef8a2d051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705801039, "uuid": "868ceb6b-a633-459c-806e-997caa052b32", "value": "svhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb96d4fa-b87d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705856092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705856092, "uuid": "9816e9a7-4410-47f1-8785-9f9ca6fb7042", "comment": "Malware payload", "value": "95cafc971636926fd0ff03bcfc16dcc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705856092, "uuid": "d941ac29-8ad4-4057-9b0c-806dd0e7521b", "comment": "Malware payload", "value": "c09efe0ce7d75a5e686a96010163ee1286713ff43d9fa4f32fcff124b1c4e9c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705856092, "uuid": "ba84be6d-575d-4306-a534-2969dcaf8ef2", "comment": "Malware payload", "value": "f6b5e2a9800cb490602dd3dea2fee875e990278b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705856092, "uuid": "7c68ebf4-2c7e-41c4-896e-c9c7e1c79d81", "comment": "Malware payload", "value": "a0ca499754490f86ef357ed890097a2eb3ff0c04f5cde77ad6fa03cbe56e592bb45894d6161db739f6193f6cdd33b2f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705856092, "uuid": "6f6a4d68-5158-4b5b-bdd2-539681077f42", "value": "T1AF532749B7CBD221CA555E7A80E3C41103F6AB4B29B3D69F3EC412C55E12BE1CA8275F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705856092, "uuid": "d368bf87-b0a4-46fa-8144-162d8d509760", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705856092, "uuid": "5cb85f87-b653-4b2d-92af-1f2214ffea0d", "value": "1536:SxPRbKshTBJAqqiEhjyAFS/LsfY9gJtefyrli4v1gsI:Sx9hTBJ3qiEhjyAwVeMQJg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705856092, "uuid": "fe416ed4-4e0e-4ea8-b6f6-079e9e350821", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705856092, "uuid": "28f14a02-5a85-4a6f-ba63-69593e096255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705856092, "uuid": "141ca0ef-351b-4409-a5f8-a6c1f418b9af", "value": "SecuriteInfo.com.Win32.WiperX-gen.2553.15463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76717ae3-b89e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NetWire)", "timestamp": 1705870122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870122, "uuid": "d32a18b5-e9eb-4554-bdc7-d175ebb9fbd9", "comment": "Malware payload (NetWire)", "value": "3b25677fa8107108e47bf97e9df675a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870122, "uuid": "ca7e38b1-df99-41b4-b37c-b2f121aada70", "comment": "Malware payload (NetWire)", "value": "c14f7a70a3083113154ae0242fd0e14b4c54056cfdb419ec46f3e0471bf0827a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870122, "uuid": "6447485a-d05c-4a65-8bcf-5da426df1de7", "comment": "Malware payload (NetWire)", "value": "fb4c79542cf166a2f7b099b65c43db58b6a01e68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870122, "uuid": "ca35a1c6-9e75-4b8f-acac-c9c4ef28433d", "comment": "Malware payload (NetWire)", "value": "c705bad4b8ed0364b70048ef493638b8c06d95104ae2e5d6b96805395f152f285ba96380de30d8c66ad7d941b57d0fe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870122, "uuid": "be511762-d2d2-40d2-ae08-914777228b7a", "value": "T15D24BE849547A58DCC07217041E9A87C8E870C179A24C83FEDE2B97FF7FA6959E50BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870122, "uuid": "904b3402-eea1-4866-81f5-c9574bdecda0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870122, "uuid": "609a1ffa-7418-4641-aebc-6da8e9ba45fc", "value": "3072:2H4l3KCxknsqA36giLi9YiE8qoX4Ot6QN05XRu+/glGMs4u8jQHVVy0b:2HCLqs12Li9YhqthN0RGFs+QH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705870122, "uuid": "ca5942c0-0522-4e65-b7dd-7d39be761a09", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705870122, "uuid": "c551aa3c-9008-41be-ab5d-08e3fd641da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870122, "uuid": "8d9cab8f-4ea6-4fd2-9db3-f7b50993d233", "value": "ZtYZsBiAkiYv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cb9905-b88d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705863029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705863029, "uuid": "fb0ae0fc-4ad8-428e-80e0-f6d42ab0ea77", "comment": "Malware payload (DCRat)", "value": "3bc0efb0e42a08a33e43ba5536332239", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705863029, "uuid": "b38156c5-7a59-43cd-bf74-edbcf5b4a240", "comment": "Malware payload (DCRat)", "value": "c2958b80b0f33e4725e2c8aed24dbb259d68198a970385afa3ed2e8df0280a08", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705863029, "uuid": "8abc4715-f88f-4398-995f-0d53b3308b8c", "comment": "Malware payload (DCRat)", "value": "0749fe8107a5a930debf1472e4e7b4dfcdbfffcf", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705863029, "uuid": "a5cdb443-5ed1-49ad-b678-78ccf0b74472", "comment": "Malware payload (DCRat)", "value": "1728df7384383d0510642245f59229edecac7f16af0468a2bef971fd7522eea7a140532b705924e8f640aad688e9d029", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705863029, "uuid": "bfbec8cd-36bd-4822-9c1d-767c3fd4be8a", "value": "T1DE852302BEC29672D4A2097726B967109A7CBD252F71CEDF63C11A5DCA315C0CB35BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705863029, "uuid": "c73e6a14-896a-475b-a4c4-d251b19315eb", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705863029, "uuid": "1b72fe2e-da02-4b2b-9773-ded2c68cc898", "value": "49152:IBJ6KLFSLCOo91Ozc3nDZb2104g1Wwhgb:y3FTkzsNy0XWwhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705863029, "uuid": "560d9ea2-64c3-48a3-90f7-a24c06a331b5", "value": 1865259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705863029, "uuid": "9210b8d7-f9c2-44cc-8076-e2b3282de1a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705863029, "uuid": "7e6d3cf1-2091-4593-a099-3092f4df9646", "value": "3BC0EFB0E42A08A33E43BA5536332239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0d9f92-b89d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705869808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869808, "uuid": "efcd0118-48ad-4a64-b2a0-e3e9345a5075", "comment": "Malware payload", "value": "9b053fa2892086f089442e7a11911cd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869808, "uuid": "62a66dcc-3147-4b4a-b704-23b3788b1f62", "comment": "Malware payload", "value": "c471b2d1d86cac31a117363ed55a71714aeec937f9a73977d2f2329914252f97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869808, "uuid": "b8b1a728-b815-4144-87ca-3d916e3ecaef", "comment": "Malware payload", "value": "ca342149bb3b5b09ab7fec5e5702fbbc553060a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869808, "uuid": "0261d362-d02d-4752-9f7d-e05509bb84ca", "comment": "Malware payload", "value": "318019443b97f02fa2c8da4471a52a1009599dc94c72ec5d2329dc88df642ee24e5eef9e379e7ede4c51cddf5a61803d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869808, "uuid": "8a041a3e-4967-4869-b169-a80ece2b8e9f", "value": "T13293E74937E150A9E2FE8AF3A971B2404FBAF0471742934D49E168761A33AD84F44DBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869808, "uuid": "a8b30bb6-de04-4685-a4b3-e9361fee3bad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869808, "uuid": "bd178a8b-0dac-4014-8369-511b6972ae0f", "value": "1536:FYTRkWWWipj69MME0n2ZXkaEkqVR17p5v:6TZqj69MICZJqVRn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869808, "uuid": "98b3a0e0-8d2e-4795-ba58-6a8f1a44b558", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869808, "uuid": "c9eba225-f913-4576-9836-5b2072df5e89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869808, "uuid": "902730b2-a5df-4c47-918f-5d72f549fabe", "value": "c471b2d1d86cac31a117363ed55a71714aeec937f9a73977d2f2329914252f97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ca4da2-b8a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705873188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873188, "uuid": "9f8997c7-fdad-49a4-808c-c0191a321ab2", "comment": "Malware payload", "value": "8937ef65e5179865f856230ab0f0d415", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873188, "uuid": "887a773a-ae74-4ba0-9d2a-d8f94345ed61", "comment": "Malware payload", "value": "c4ba24877832431d4a7a43f4376bc6bf305e492005c953610ecdc583cfdc4c6c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873188, "uuid": "aba98683-be23-43a8-9e77-d3c53ba4c8b3", "comment": "Malware payload", "value": "a5e6641eaafacff838c219d8ccde43b5982dea5a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873188, "uuid": "773c6601-4492-4111-a995-a226dd427b01", "comment": "Malware payload", "value": "f0f5045f08345240ab1de00f9e96db09f010878e074e29e6b2b4b555fd75264c26761cf2c3d787ed57f9783755a237e5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873188, "uuid": "73b8315d-916f-45b3-a837-918d5bb6a7ec", "value": "T176C36B07BAC4407FD4D7C1F893ABE20B9173F085A624B6A569E94A343F52FB14A2D770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873188, "uuid": "131a788c-377f-4f74-a1cd-f16e362b38ed", "value": "3072:RBraY3dB91wbMgX+/8RIEhNpIBJsP00Akox4Exv3iYUSGlBt5Zv+YWWXLc:RBrTdn6O/8RIEjp6OXo5RYWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705873188, "uuid": "06de9e36-43a2-4527-95f0-0a88bea0e092", "value": 128426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705873188, "uuid": "d88ea018-957d-489a-8d13-afaad99995bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873188, "uuid": "f5cba39c-5f65-44ef-974a-152dc574abf6", "value": "8937ef65e5179865f856230ab0f0d415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affa415f-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829416, "uuid": "11330a8d-79e1-45b3-a806-580c97f2ac9d", "comment": "Malware payload", "value": "d6c8ba045c94d496f4424147a3a1752e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829416, "uuid": "61c10159-0827-433f-beeb-aac8e2a54234", "comment": "Malware payload", "value": "c55e415b8920f5ff5aa0f8822b28fbcfb4866e2ea427622f38413865471df265", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829416, "uuid": "e0360738-b75b-4bda-9f39-c34bbfde0397", "comment": "Malware payload", "value": "e62b99e2d25f790a4fdb9e443fb68a7b8c8a627a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829416, "uuid": "a1d707c5-50fe-4e3c-abf9-b5f6ed1dced6", "comment": "Malware payload", "value": "8f46bc7487abaa820e1848c39d10cecdd88026a8af7b6fb3a85f2a57e528e71f2c4de28ddfd42ce06f165c456604ccda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829416, "uuid": "45cb5b0a-a689-4b75-b45d-9b0f28aa7608", "value": "T1A7C49F26E2D05537D1271B389C6BA7789C25FF003A29DD476BF81D0C4F3A6913D2A2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829416, "uuid": "1667440d-3cca-433f-9cae-8d9da92882a3", "value": "69932e10d93add129f2b9cc4ca6321a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829416, "uuid": "01842e15-3ef2-4493-9d8f-a939229e97d6", "value": "12288:GvwCYTKt0pCo3s8094YXx312bZjCVfSRCd6/8w54:9CZAaYbJCSRbDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829416, "uuid": "50e912fd-17cb-4561-a9eb-e772e30c047a", "value": 579240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829416, "uuid": "820fa523-fdd5-46b3-a3aa-c19626f0acc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829416, "uuid": "bfa82539-5c0f-4dd2-9b4d-1f47d3436d32", "value": "SecuriteInfo.com.Backdoor.Win32.NetDevil.6850.25104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18c0e71-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1705829446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829446, "uuid": "327371a4-d6b1-4545-b1c5-7c1b1df63ed9", "comment": "Malware payload (Adware.QQpass)", "value": "eb782e49a3f2369ba1c34ccef15924b5", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829446, "uuid": "82035762-cf5c-4790-8341-d92453d5eeba", "comment": "Malware payload (Adware.QQpass)", "value": "c56c76a938e15b95a03484ce6f74e553bab4403d3ba80e78086df7f34d9eb38d", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829446, "uuid": "d880e7f3-46fc-46b8-b683-3e7ae7c5ec88", "comment": "Malware payload (Adware.QQpass)", "value": "1186ec74289ba2095f8575a594396fdedca49ded", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829446, "uuid": "00f99d18-1b56-4b11-9cb3-9cea91b708b3", "comment": "Malware payload (Adware.QQpass)", "value": "6fe5aa855d65c77da67f47063c26b9d6b003734ed29dd08474d4d72f8c0c02fa5ac43314201f56c30ccfcb2f682bc938", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829446, "uuid": "a852baca-b343-413a-9ec1-77f528f82454", "value": "T135057E13F18240B6D21512300AE65B36AB74A7762E31EE87D7A4CE7DAE312B1DE3711D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829446, "uuid": "c8417208-ab33-4019-9155-a9e21adb11c7", "value": "fc9649c7c224fa8b8f1f4c65ce448fb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829446, "uuid": "cbac2032-8dce-4303-8ab0-9528a38f06ef", "value": "24576:Dy+nTkB1kqAw+BxA9ssnnqr/4woB1rtHa:DgEAXqMjB1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829446, "uuid": "3c9c1cb0-b70d-4d80-b08a-f7cbf0abdf31", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829446, "uuid": "99972144-c1ab-4469-b65a-f8ed0f0cb0c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829446, "uuid": "b0e70924-440a-41fb-b7f6-5c6be902b96a", "value": "SecuriteInfo.com.FileRepMalware.30610.16925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b52b14-b88a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705861694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861694, "uuid": "7efc6760-fdb8-4ec9-a9bb-81b64b2ed562", "comment": "Malware payload (Mirai)", "value": "19ca6a62eb123c25835f72b1306e8955", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861694, "uuid": "67d0079b-bd55-4626-8cb2-9d3d68d0e92c", "comment": "Malware payload (Mirai)", "value": "c638e269af3c0def3fd3ecbac9d9991df4ed16924b548052928b9c9b14b80a44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861694, "uuid": "9dee26b6-174c-4b70-8cd1-3a33937c767d", "comment": "Malware payload (Mirai)", "value": "610bf1307c240e4a1101e71f88c735748cb0097c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861694, "uuid": "cedaac01-0e08-465e-9586-d878c40bf22c", "comment": "Malware payload (Mirai)", "value": "8a06247693c2dda378a9d8d76974718a7cbdd7da990cda969f2a3a1c54ab3b6fc71d08001bf0cb084b71d373dab75acd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861694, "uuid": "ec479e0d-63e6-4fe3-aa4a-ad2fbfd7e560", "value": "T111B34A43D461CFB3C0622B7512B79D34032769622B4F3E68A539ABF8070B9CDB95E359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861694, "uuid": "90280f4c-e1dd-4b5f-8aff-d378bc36aac4", "value": "1536:PxOyftqjzYQ+oAvdONrJH+MVl1IgDOMT+iZQWmMGWLnXGUNYrnY:PTszYQVmsJIgDf+MQWmALnXGkYrnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705861694, "uuid": "3884f998-c401-49cc-be16-20152c4ee686", "value": 112858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705861694, "uuid": "5cc30d56-6bd3-488f-b1d7-420e5c863e70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861694, "uuid": "03f46141-e2e4-4ba7-a080-2217f6e2c576", "value": "19ca6a62eb123c25835f72b1306e8955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ebb743-b88a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705861667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861667, "uuid": "5710f9be-f252-4d65-8ff5-bacf3ae3a201", "comment": "Malware payload (Mirai)", "value": "619bbd3738ed3305fff431c1d0af3bb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861667, "uuid": "ad3b7147-5761-403d-98b5-bebbe14490c3", "comment": "Malware payload (Mirai)", "value": "c709df76fa0db8c6bddc60c2f0f9ab02fe4cd4af4634023fa22f4ac321d0b384", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861667, "uuid": "010d7280-a864-4c4e-96cd-4b9780d9b382", "comment": "Malware payload (Mirai)", "value": "655fd68af318714d882c0cd0946ff09b03bc8523", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861667, "uuid": "522bec98-1e82-46f3-80a5-8b7e9537b1cc", "comment": "Malware payload (Mirai)", "value": "4e0ff1011937bd0621c38da0f38f86d77cf9d55a8dc3ef385bc33f2642826688550545129040d55a8a0bbd5883762c75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861667, "uuid": "ff87b705-b357-4b0d-ba13-3413a3e738d1", "value": "T154C32993F510DBA6F41A973309D3CE242271F7A14B572636A2273B6AEA371C43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861667, "uuid": "b9e0cd61-459b-4bec-924e-c2895d39793f", "value": "3072:U1xyXq83QekacWVcW0JcWcBrr1FDpHoGVFUh8f7gN1Nj13WmBWnw+cHMOc:IxY3QekacWVcW0JcWcBlFNH5VSh8fENg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705861667, "uuid": "5d6a6203-f67a-4356-b870-b4f7d4312b33", "value": 125109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705861667, "uuid": "4510332a-bfb6-46a9-be1d-e34b824baf33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861667, "uuid": "6b2105e1-e06d-44c6-834e-bdde83bc61a7", "value": "619bbd3738ed3305fff431c1d0af3bb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b370660f-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829422, "uuid": "8df51fd3-a3b0-429c-9d56-d74fc3b6ac2b", "comment": "Malware payload", "value": "12066d5ff8c2b79e07af6abf4492ea69", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829422, "uuid": "02f424fc-5d88-44d0-89f3-0e80099229f5", "comment": "Malware payload", "value": "c7b2f60a291bda56521da25e084e7f90ae87f0bd4481f7942d8ca433d19dfbcd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829422, "uuid": "8d21ca10-3269-4602-a5ad-f2f376742a66", "comment": "Malware payload", "value": "c8e60db6de66502a19b575e001955752024b88bc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829422, "uuid": "c2072782-de02-4940-afc4-956c2e605e82", "comment": "Malware payload", "value": "7c8aa8a5ed70346465760ce6bbafce6082d89426f0898470af9b58a4f0728abf75339d9e7fc39dce36cec9aaff34a686", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829422, "uuid": "a899728f-1ce4-4c2e-870e-2652d8d7d365", "value": "T165C54B10A613D53FE9BF0AF2CA7D955E652CEA21076420E783CC9C5D0EB99D23D3192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829422, "uuid": "feb49d82-bff4-4dcb-9df3-c1a313af32cf", "value": "67aaac05778e980271e8f0f857a1cf9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829422, "uuid": "2753fefd-b485-4f66-a2e9-4a6f9a499bab", "value": "49152:jU8CRndCW98Jk/9iGFjXPbVPKRudqzhuag6DSWkzwZtSQ9PX3BHuU:anwWSJk/nXPbVPAuSZtSQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829422, "uuid": "522e1331-a044-4d9f-a208-2df0b180e264", "value": 2633728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829422, "uuid": "83edfd3e-a455-493c-8df4-a81b3d9b2dd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829422, "uuid": "d9eb01a1-7f88-4f2d-8f51-76bf4dce4591", "value": "SecuriteInfo.com.BScope.Trojan.Sly.12094.15739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69615afd-b89c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1705869241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869241, "uuid": "72f604d9-3204-4fa8-a859-5c981bf7a648", "comment": "Malware payload (Spambot.Kelihos)", "value": "8246a3c6f1dc7f210e53b273eef798a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869241, "uuid": "c2e0f059-ed49-4be8-a365-bd9be303b186", "comment": "Malware payload (Spambot.Kelihos)", "value": "c9d46ad5a9a42497b7c5949317e7cb743f865e84ba97a17289aaa69f91912a18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869241, "uuid": "2023f9d8-eddc-4e48-ab49-48b588e510a1", "comment": "Malware payload (Spambot.Kelihos)", "value": "eb71ebc5ecea81511f813bfa08203d39d68e2014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869241, "uuid": "35888051-6748-4404-98b3-94cba57e92d0", "comment": "Malware payload (Spambot.Kelihos)", "value": "3d8a5c212dd029159271bc5527c75b482dbfaf0ab026322ccd13ff45ff5f34525d1ec277de62a0fd1cc39e8185be4da8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869241, "uuid": "3af5e46b-44ab-4214-94d6-2d816f06018d", "value": "T18E947C927BD49C03CB11FC34BDF18B7A340A768F166A8B951789C8AF7C9A5986357C0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869241, "uuid": "1a8f2971-aa6e-4490-abbb-474c16777713", "value": "ea195bf8c93901cc0697df8bcbd3b755", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869241, "uuid": "4bbbd532-5c91-4317-965a-39c24599bade", "value": "12288:sH0b9StI3IXuNBHPMOYjzxLWxmS0uGPoq:sUZStI3IXFRuGQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869241, "uuid": "0f5127a0-e6ed-42dc-b2ea-061ca9a75bf2", "value": 414361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869241, "uuid": "7aad4366-27f2-4d63-9e5c-5a76196f44e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869241, "uuid": "c3d5a62b-e711-419a-bff1-0ead35cb9fe6", "value": "canu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5e4812-b83c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705827931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827931, "uuid": "5912f73a-0faf-4169-90a4-a44c2d5746d3", "comment": "Malware payload (RemcosRAT)", "value": "3ad42aa4aa9da9915bc1a95953e1042e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827931, "uuid": "c0a623a2-6087-4137-89f4-18fb73002ec3", "comment": "Malware payload (RemcosRAT)", "value": "c9f5d9d2b4739f72bb8cd0fb484c8fd454c138f3ecae8e0019900e6ffdce8fcf", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827931, "uuid": "00e96103-89a5-42d8-b701-20cadfd02093", "comment": "Malware payload (RemcosRAT)", "value": "d3ff13c2f0f8884be76748f2208e594ccda1a1b4", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827931, "uuid": "5dc8c352-7f63-462d-bc37-40a9ffb20052", "comment": "Malware payload (RemcosRAT)", "value": "8080d05499336194696c659c255cd2dea121ca9d6696538a242479f80fd7d15653b9c59a9344d163a449d1c0dab40fd1", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827931, "uuid": "4fca8bb5-a707-47c2-b218-fd374d7526e4", "value": "T14CF1F403146A91002F624E401DE87135C63372FCFEBD5A798B584D1E9BDB106AABDF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827931, "uuid": "ba8fc15c-4d2d-4420-8f1f-2bede1416893", "value": "192:Pk1A/Z0k+vmu39z+bk+RfgOyAYdUMMZqGM1NN/s:Pk1sZj+vX3ktJyAYdUMMAGUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827931, "uuid": "60622a94-06c3-45fc-84f0-890439f7addf", "value": 8188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827931, "uuid": "1a5f9fcb-edf2-421a-be6e-eb117f0c8ed3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827931, "uuid": "685e9513-bbdc-4415-a922-cc7236a6e253", "value": "DOC_SCANNER_847464_8474.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c4a9f6-b823-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705817427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705817427, "uuid": "61165f46-44dc-410f-96a4-1dec6ac55b80", "comment": "Malware payload (DCRat)", "value": "b4480d8f9ff2edfc96cb2b0d8cee91bf", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705817427, "uuid": "fa8af689-15e5-4de6-8c53-6fe9acf80889", "comment": "Malware payload (DCRat)", "value": "ca72edf92fa2fcb37aecc338ff70a85e755cdbe5051af7599d019106048be03d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705817427, "uuid": "9213b96a-b0df-4b79-a855-2e3ce43a6381", "comment": "Malware payload (DCRat)", "value": "cf2d87ae11cf1e230bc63fd76bd4cab26e980260", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705817427, "uuid": "82039c4b-5af8-4f02-8762-8852a5b6073c", "comment": "Malware payload (DCRat)", "value": "9a20d6c19d5a75c96a5cf9287c846e24605f23320d5ff666dacd99ff3db3d46e192474553f7fd83ce7e39e2f4f0ebdf9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705817427, "uuid": "a013aaa5-8a18-4d17-bf83-c5ec65e788de", "value": "T14D05E701BE54CE11F0191233C3EF45488BB0AC516AA6E32B7DBA37AD5512397BE0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705817427, "uuid": "b0ca5cbd-1607-4d06-8a4f-fd30b3ca60c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705817427, "uuid": "8d90954f-97c0-4052-9dd3-a3587ef1d5e5", "value": "12288:M/UoHV7JayXF4fUTcgOBGvmqtF5QvUvGjkigipWhkxGKyzg:M/ZJayXF4xghtOh5PxGKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705817427, "uuid": "f7bb52e1-35f7-4cb6-9085-e9f5cdb0229f", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705817427, "uuid": "fe7f2c76-4c9a-424c-bbd8-734c6631b8f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705817427, "uuid": "94720832-975d-43c7-92dc-d97e4ce35464", "value": "b4480d8f9ff2edfc96cb2b0d8cee91bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85512ed-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829431, "uuid": "0842548b-0db0-4ae9-a373-28fdd56adad8", "comment": "Malware payload", "value": "9e48cccadb584b874c28b1e9257282ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829431, "uuid": "6b4eef40-e29e-4bd0-9dfe-d02059307fb0", "comment": "Malware payload", "value": "ccb55c5bd68664b2864379da8ac6284f4a0bfa738f95526b925604865b3cc3e2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829431, "uuid": "6ac197fa-a121-4735-8fe2-f0e923bca42c", "comment": "Malware payload", "value": "2ac53784e8b9c0204fe70ddb722574ee766f832c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829431, "uuid": "22bfbe35-2e53-4f77-acd4-0000e97353ad", "comment": "Malware payload", "value": "bf67ed4df9fea6eca500fe072777d655219d4976aae0764f2347f6c2ec56d881d2bfc72ccd781b3b798c639e9f3a711b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829431, "uuid": "7556492e-a1f3-4a5d-a5de-db27294dd151", "value": "T140662351D3523EB7E347FEB1181668CDDE260EF122BA92F151B7025424223BC6939EDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829431, "uuid": "797da469-fe5a-48b2-8c9c-269f72cdb7b4", "value": "6eda519ace6fb530d1f7f0dfef24e789", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829431, "uuid": "0e04cf29-6baa-4ee3-a4bc-a08699a60806", "value": "98304:RJNDWlUtE5xB8zm+jE1dMXrJjAiX2ZJ6FYV0frZ+1C67PDXgLUQyhAWOdhd:7NgUtE5cSd86iXa6Y0f9OjDwQQyREd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829431, "uuid": "ce386f1a-061a-48b0-8a4a-9028920bc8cf", "value": 6667666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829431, "uuid": "58866b90-da9f-4b44-aaa1-84a1c2aa5973", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829431, "uuid": "15f13f19-a8ec-4c4d-a1db-a87aec73244e", "value": "SecuriteInfo.com.Trojan.Win32.Krypt.17600.12156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767a94de-b81d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Dridex)", "timestamp": 1705814717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705814717, "uuid": "4e8b4db4-03b4-4a24-bc49-cd6f22475850", "comment": "Malware payload (Dridex)", "value": "153bc84ce38485a27ee114e9bcd4eef9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705814717, "uuid": "bd9e14d3-a237-49a2-82e3-5524cf83ac42", "comment": "Malware payload (Dridex)", "value": "ce6b05e2593182af90dc4e8fd315240bec81cf0734a2590ee864a05bbffb014c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705814717, "uuid": "6180e813-15b1-4ff0-94c1-c6bafc79e253", "comment": "Malware payload (Dridex)", "value": "821ced6f8b1083a085f224210f82c0f301887f7a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705814717, "uuid": "33f9153f-09c7-41ce-8f54-57cb61420d5c", "comment": "Malware payload (Dridex)", "value": "0421ce7b29cae8cab6bdbf4c2ddbd89d9feded558fe4a16b0e04e3dc01e213652355631d49ba756e31c3e4573f96f198", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705814717, "uuid": "e089894e-d3a4-430f-b546-33074e1dd85f", "value": "T1E2B4CE8289EAF26BF83BE47EE5C8A28A551FC620330DDC5B6BC47DD7594518110EB6F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705814717, "uuid": "93bc5a50-294e-4088-9660-9005f6956a24", "value": "710c56df0906aa05cd4c539174a4f822", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705814717, "uuid": "7afd38af-3e2d-4ed0-bb32-6a1ee1e210ab", "value": "12288:B+8mHYABWaGPleAupQFpa7M5YXsXx5pgKB/Z:RmHBXGPlcQF87M5fBHBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705814717, "uuid": "e5a21f43-4e5f-4065-8aec-f7b5eefe25c8", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705814717, "uuid": "0e079065-6f40-41ab-89b2-2a1b8f424fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705814717, "uuid": "42b6b48f-85f0-4a78-8628-37a64a46a49a", "value": "SecuriteInfo.com.Trojan.Dridex.735.3965.29331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9470040-b85f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1705843283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705843283, "uuid": "ac050f81-6948-4f54-93f3-9641d728e5bb", "comment": "Malware payload (zgRAT)", "value": "6057b5031cbedfeec511cc5b247889db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705843283, "uuid": "ebeb9460-2b1a-4f8f-ba66-c4a2056d1eed", "comment": "Malware payload (zgRAT)", "value": "d10fa89f4ea51047f1bb18a88f804c82625e3412b5ff58dc917136c28a4390e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705843283, "uuid": "c11b8e00-8b56-4196-9daf-8652f8b1b30d", "comment": "Malware payload (zgRAT)", "value": "a45de70d74e59af3fe56394315e6ebb34397fc61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705843283, "uuid": "60585dc5-c70f-4e3d-bea7-1f95e80f45a0", "comment": "Malware payload (zgRAT)", "value": "9b32f0d2c2b2af86f654627cbca39128fe33e2d3ff05b180f7d99c58bb87e42a82935c4b5f7b937d4ddd2372902fabf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705843283, "uuid": "4b987aee-a35f-4466-a235-20c8bb5935a6", "value": "T11936BE1137E8CF9BD27F2733D0A1401443F5F95353A2E75E292851AE1E237067C9AAAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705843283, "uuid": "3082c46a-12e6-4c15-abf3-d96fdfa7d184", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705843283, "uuid": "a256f2be-e303-4f44-aadc-3280554a96f2", "value": "98304:UIfpwNcnBEZruYrsoiYWp3Vm4cyVOAFrtD0UwHH8lriNTR6LLdW:UIfpw5ruYrsohWp3JVxFrty8lr+9sW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705843283, "uuid": "dd6045cf-8ce9-4f8f-a962-015d1710676f", "value": 4948368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705843283, "uuid": "4f48a10e-8e8b-4a22-aafc-53cc52f6ddbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705843283, "uuid": "14fe5a85-af37-47a3-a201-a45fe38c0afd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cce7d4-b89d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705869531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869531, "uuid": "c64aed68-afb6-4875-a6c5-e6c651111e22", "comment": "Malware payload", "value": "0662fbb81cfbbb132abf4a5976e4ec2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869531, "uuid": "d577bfe9-d21a-4165-b0c0-a4a65d447bf1", "comment": "Malware payload", "value": "d1e6ca9ffbd45ca545fed4c76416559337739572c970a7aed5dad907d1eb30bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869531, "uuid": "0ff70a9c-e374-4e80-9d55-fb1c29f043b9", "comment": "Malware payload", "value": "d604296eb5471472d95a9dad66382d68d1c688fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869531, "uuid": "a2e9b0fc-d7b2-4b13-81c0-7355e05cb0d8", "comment": "Malware payload", "value": "620e45497d95a79e6ca93deddd43dcceb9955bd605d5cfeb73612a59148a867b18693df97de3192607cb399174af2067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869531, "uuid": "4304baa5-a556-4592-88b9-6b82941c6655", "value": "T13CF73330E953D4AFDBA3A3FD81ED6E33603C5F816CB62805251C6D4E6E20EC64B97256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869531, "uuid": "fdd0cdc0-ba64-4765-b2c1-7ba7b6098543", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869531, "uuid": "9ee38d15-c0ef-4ded-b0c5-829327d3cb97", "value": "1572864:FWG4/4rzOchPT647ZwOLu2f9+kQVkh8w61pdvQNLP2h7:FWNkqcd5dwOloPkGwaz4Oh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869531, "uuid": "9a3d1a1a-ff99-4f05-be76-b196431707ef", "value": 74045001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869531, "uuid": "6d784006-f543-4ee4-baec-a8575d4fd4ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869531, "uuid": "cb428b3d-4920-4d27-b898-719558a858c4", "value": "SecuriteInfo.com.Trojan.Siggen24.36338.4304.1754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfed35d8-b872-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705851374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851374, "uuid": "d6cbc1aa-8027-480e-8fed-3751e37cba3f", "comment": "Malware payload (RedLineStealer)", "value": "325e5e964179cfd16c3896703026843a", "object_relation": "md5", "Tag": [ { "name": "cheatlab.org", "colour": "#D8D821", "exportable": true, "hide_tag": false }, { "name": "cheatlab.tech", "colour": "#B5EF2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851374, "uuid": "41d3cf40-28cf-4145-b219-7d25a2c20978", "comment": "Malware payload (RedLineStealer)", "value": "d41908cdc3d29ae290bdb1c59bf3015c3862d884b2c811464ba1ffe5f4ddc91e", "object_relation": "sha256", "Tag": [ { "name": "cheatlab.org", "colour": "#D8D821", "exportable": true, "hide_tag": false }, { "name": "cheatlab.tech", "colour": "#B5EF2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851374, "uuid": "2d3d12e3-5718-4245-84a5-c1e4b1a769b8", "comment": "Malware payload (RedLineStealer)", "value": "5ab33136236bfd2baef983a99bf91a344d3b29c8", "object_relation": "sha1", "Tag": [ { "name": "cheatlab.org", "colour": "#D8D821", "exportable": true, "hide_tag": false }, { "name": "cheatlab.tech", "colour": "#B5EF2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705851374, "uuid": "5b7c7297-933a-4b42-961d-64d085db3a2b", "comment": "Malware payload (RedLineStealer)", "value": "3985137319efec64a1052054ca675e08fe51e2a717d3c5e3027ed1717d389a43c0020e09703bf76ac08e873d723e8e9e", "object_relation": "sha3-384", "Tag": [ { "name": "cheatlab.org", "colour": "#D8D821", "exportable": true, "hide_tag": false }, { "name": "cheatlab.tech", "colour": "#B5EF2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705851374, "uuid": "6193c260-3331-4225-944a-4ec74abc3f89", "value": "T13AE5BE25358AC637EB7E42706669D77A65BE7EE00BB104DB63C83A2E1E705C14232F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705851374, "uuid": "201b5cb8-3d5f-4df2-a349-2db1c8b0b881", "value": "49152:0XMMCZKumZrbq4Fb6HXr1iWnYs4ntHurpllQ6avuxtZaTreUuyZD6lvVz94jtzl3:dKrFnWn+uxCTgvVWllpl8O9zJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705851374, "uuid": "10ee22ca-96ce-4140-a138-ce69b55db213", "value": 3175424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705851374, "uuid": "d01a25b5-0cc8-46e6-8faf-9ebc91e11492", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705851374, "uuid": "6732128d-8740-49fc-9dfa-482d5af0d746", "value": "Cheat.Lab.2.7.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39449fb2-b8b6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705880327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705880327, "uuid": "d0bc75eb-f22d-4675-bb12-f4de9923aaea", "comment": "Malware payload", "value": "262a6032b08e9a351178b9151597f1b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705880327, "uuid": "311b4871-979e-46d0-aeed-0a78b001dcc4", "comment": "Malware payload", "value": "d53ce8c0a8a89c2e3eb080849da8b1c47eaac614248fc55d03706dd5b4e10bdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705880327, "uuid": "36bf1512-43d6-492e-b704-9f2ac5a5da75", "comment": "Malware payload", "value": "92a37ccf0588728e2746298f2db860cbdd0a60df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705880327, "uuid": "df936ad1-e82e-4f78-8b3d-1f07eca6a42f", "comment": "Malware payload", "value": "0a7851ab0762304164654d10935a3f01af84c9888496bd0b7cf346f399e84ae3fdfe3624bcc36221e8884218e9da4f60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705880327, "uuid": "e1915b04-69d5-456a-85c5-82e4424409c6", "value": "T1BD547C017591D072D5A114330A38ABB2996DBD304F659AEBB3D44F3EDA302D2EA71F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705880327, "uuid": "7ab9c43c-8cf8-4c00-bf39-81719a66365c", "value": "cc214b59c2efae32732d81402c874f65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705880327, "uuid": "dc218139-0b90-4f47-a210-653b73bda033", "value": "6144:WXJI+8JEwCuGqw/zhS/PA402wJdRqdhbSURWtp1JvP7612io3AOBurwnTBS:1/iUbdhbSURWtb3vJTBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705880327, "uuid": "85a21ea8-182b-4685-98ef-c9979e4e8db8", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705880327, "uuid": "7a7289ea-c02c-4780-944c-180d3a020548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705880327, "uuid": "760b0bc2-eb57-4159-978a-0fdf1e4f08ef", "value": "SecuriteInfo.com.Win32.TrojanX-gen.3279.14382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3601ede-b800-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Berbew)", "timestamp": 1705802444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802444, "uuid": "6557c442-3fd4-4053-9b10-e5c430a9b7ad", "comment": "Malware payload (Berbew)", "value": "68670726bfa1aa644b098415a191b677", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802444, "uuid": "05e88f58-f5f7-4c8f-bda9-b4de1d282f6d", "comment": "Malware payload (Berbew)", "value": "d62d1d895e2ad436db095e3278b3679c54386a09440832b2788565697c8b9076", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802444, "uuid": "3bc2ba18-99da-4d3d-9868-85d2ce286b30", "comment": "Malware payload (Berbew)", "value": "4bfa47d1bd8a951658d694ebd7ae0b1129c8c00a", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802444, "uuid": "3d72cc0a-eb56-4e02-b665-2eff41d1ae07", "comment": "Malware payload (Berbew)", "value": "f02eee2b231b6a0b8270ec1eaeef4d869c9e5c528a1c0e25863631311eb3717ced44e2f65aa9732420932080e83bc493", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802444, "uuid": "c25ad4f4-078b-4f00-a968-5f73494b7c2e", "value": "T1D3243A3671E0ABA2C449CDB211F62B76D17381F0127B9E8ED3A0C724DA36297E53578C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802444, "uuid": "94e0bfa9-d38f-4905-8ec2-25a3e23cae43", "value": "768:xHMeEXxR3F8UNvrJb0PztsYDpVLGc3HZWok/6pSyDLkRynrT/1H5IrXdnhu5:xszXF8CvrJ4PBhDP35RDqGhuk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705802444, "uuid": "a78192c6-e9bf-4605-a112-57a534fd4d16", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705802444, "uuid": "f0d58823-72ec-401b-a940-943f94acc969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802444, "uuid": "0bd4a4eb-2eca-45fd-904b-88d46648dd07", "value": "0gfkg4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31df327f-b801-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1705802576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802576, "uuid": "d63b0759-4aa7-47bc-b155-dc1316fcf729", "comment": "Malware payload (Gh0stRAT)", "value": "9be92b9ccb5d7469e0e136ba9c1685a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802576, "uuid": "83d99381-8709-4a6c-a6f9-cd35b66d6ab9", "comment": "Malware payload (Gh0stRAT)", "value": "d62ee92b65a34ba6023b4f16dd7b8083a14a5d6bf4d99af6e82676f9d468b656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802576, "uuid": "c8a8c67a-7af6-4536-b800-93dfca7d443d", "comment": "Malware payload (Gh0stRAT)", "value": "7c79f886d41db8c6940a78eaf176928b698dfe79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802576, "uuid": "694de32b-67f7-470d-ac2c-a70b4106c7f5", "comment": "Malware payload (Gh0stRAT)", "value": "93ac30bf03a4df0b09612bba15417c4e03965d550fc99f4d05b9947c046e57d31e2b9caf116d1658afcc850a8e261077", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802576, "uuid": "dfa6ce71-32a0-474b-8e4a-7cd994e84b5c", "value": "T1C5E57C43B69584B2C3C84571DE67DAB39B207EBE17F206BB7648FDC83A352847A31215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802576, "uuid": "99e5632e-e19b-488c-a2da-a23a754ba0ce", "value": "eeac73be37480fd144f387e3563a0f14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802576, "uuid": "8de648f0-9a2d-42be-a424-63e42ac601e2", "value": "49152:cjwsbCANnKXferL7Vwe/Gg0P+WhVKDmn2rJ7L9/:yws2ANnKXOaeOgmhVKDmn2rJ7LZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705802576, "uuid": "3a305d1a-f0cf-4308-950a-e8e5a3a6c1f2", "value": 3067334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705802576, "uuid": "965bbb4c-2821-4bfc-afa1-c601bafae14b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802576, "uuid": "33e60ea0-edbf-4f07-880e-3fdac66d5a40", "value": "RuntimeBroker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1552be3c-b880-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705857074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705857074, "uuid": "3c4912f1-8a9a-4cf6-8c1a-6371fca0c485", "comment": "Malware payload", "value": "ed02631c7ff658d14543cfa6e4376a71", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705857074, "uuid": "ad072cf9-afb2-49c9-ad4b-a239c0ed168f", "comment": "Malware payload", "value": "d86e1a1fa71525fb4ed648a6bbd6c4635b27b955f716d6398e2973f5e1fd3b6a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705857074, "uuid": "97bd1e6a-411b-42dd-83e5-75c37ed23aec", "comment": "Malware payload", "value": "a6596391eb9c21b38e61d90b4351fc06b3f3057f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705857074, "uuid": "d2acc3be-cd13-4bf9-b85d-2c8d0112d61d", "comment": "Malware payload", "value": "736710085fbde716d762479215ae11e85e61fce72e842e747627054eebced337fc6571defaa7bd54a0afa3f69923f910", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705857074, "uuid": "13b52563-a6cc-4a70-97f9-b848934715a1", "value": "T15EE733016E87B5D7DB11BCBAEBC383E6618992B4B7322BF4C02258D5E88714BCD0D756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705857074, "uuid": "cfa3800e-3db5-42df-a644-cd3f1153d532", "value": "1572864:0yXoONw5lYhIy0S9eI5aTc+o1qJ9AVVMPSCClc2El:RXk5qifS8TDosIVW6CCl5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705857074, "uuid": "d6e63ce1-f072-456d-8c0b-2332878d3961", "value": 69341194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705857074, "uuid": "a048022a-12a6-4e56-b8bb-545ff74c2232", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705857074, "uuid": "c705db59-75a8-4978-b106-c6163874d41c", "value": "app-64.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c0908a-b87f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705856911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705856911, "uuid": "2d554bc2-8bdd-4818-9cec-e708fa77631d", "comment": "Malware payload (LummaStealer)", "value": "689678e61aaa30763d6bc2622108ee44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705856911, "uuid": "0f228b56-ff3f-40b8-a440-195a42ed0070", "comment": "Malware payload (LummaStealer)", "value": "d92547626ce35c2eaab15552221278ff2d6dcacc4900eaf2ee312e36d4fe1e78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705856911, "uuid": "6663ab44-916f-4ba4-8124-f7481a911a3d", "comment": "Malware payload (LummaStealer)", "value": "3f2c82ad4839edb66f65391b689789de78ed62f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705856911, "uuid": "65baea17-2dfd-4719-8b5d-dfb63e3fbe78", "comment": "Malware payload (LummaStealer)", "value": "56a5afcc7e6d9da9bcd79818a0050d18cce780b47d4156b4f0bbc11b791c5fa40e72e97e956a9bbdb943a7a1bb4e12b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705856911, "uuid": "7cc752d9-6fea-4e90-a9db-60b274887d1c", "value": "T121B47C16F073A068C62F34BA65587378EF3E49C3439598F2DA408BB13932A659E35D37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705856911, "uuid": "08bf80d1-e562-4a10-85ba-3c727721960f", "value": "41482c048643282f0fa54f6385f74814", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705856911, "uuid": "aa36b9be-d92f-4965-90fd-c457b8df48bc", "value": "12288:8tjWq6P+CQxsJZLfFftzatl6d3WyHznPu:8tKNWpxsD9leSdmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705856911, "uuid": "4f1a7118-ff34-423a-b714-d87721fb1a46", "value": 520704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705856911, "uuid": "c6d7c4d0-93ba-4528-8201-09032a551861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705856911, "uuid": "d46afb64-9621-4922-b184-e40c68fb1981", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d78b0f8-b8a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705873194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873194, "uuid": "0aea15cf-32e8-4563-b849-65ab5604b79d", "comment": "Malware payload", "value": "fcfa1083ecb7df73a5adeede3ff244ee", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873194, "uuid": "547f9dbb-26b2-4484-8a37-3646dfd33f4f", "comment": "Malware payload", "value": "d9d4e27113ce25b3ad29418df0f44cbae34224e07573e5be2d608d455cafea10", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873194, "uuid": "25878251-a23b-4b6d-9646-bb04144d9acf", "comment": "Malware payload", "value": "ef1a9678e73fbd3de7c974b45ae297f0b2f8add0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705873194, "uuid": "bef2bd3c-9b2a-4079-bbd2-06bd71fe3f5c", "comment": "Malware payload", "value": "43128b96acb5be0cf3c2ca2d906f2a22ec922e0284520451c905da4d6f8a29873949ee1f73d400274c8b2d5890610a54", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873194, "uuid": "b051b36a-ed61-4f0c-9d03-58ae4291963c", "value": "T130936C07A6C480BFC0D6D270879BD203D977F0A55234BBEB62994EA13E12F705B6E791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873194, "uuid": "64f3c324-9782-44be-9706-d80aee41fded", "value": "1536:uKBraY3dCO91aD+jdA5BnaVxCcY5Z+/8HxPgp8Js6zRp2RjeEtbLk4sP00Akox/X:RBraY3dB91wbMgX+/8RIEhNpIBJsP00s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705873194, "uuid": "04689824-64ed-46a4-bc99-ecd9d8c76801", "value": 96699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705873194, "uuid": "894c8c55-4e40-446f-bfec-50f1808a2017", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705873194, "uuid": "6029f51e-5594-4371-bf8c-6110a0ed08f2", "value": "fcfa1083ecb7df73a5adeede3ff244ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4c9e1d-b83b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705827716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827716, "uuid": "d10853d8-6fa3-4a6d-a551-4ed729601702", "comment": "Malware payload", "value": "a5a83f292a1f4aff07578179575c09a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827716, "uuid": "7232839b-636c-42ac-a17b-777b946bc046", "comment": "Malware payload", "value": "db659e373070c508349dccb1aeabc7afccfcf1042ad1996ea5dfe15ed6262078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827716, "uuid": "35d3e0e9-6e53-4b1b-bbc4-681451d38619", "comment": "Malware payload", "value": "2da82335707e85fa55dd0b7e7d30140a31327802", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827716, "uuid": "c118bd6e-3bc2-4e14-97c8-0ac685474c44", "comment": "Malware payload", "value": "2dc213c1f2163ec9543c8c32fff059540d95df9c19e58ffdf32310005c93b78f4377a5b2379c4bc120cdfa726de573e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827716, "uuid": "5fbf2752-7f30-4e75-8d55-e5b603257f94", "value": "T1E7F5338570D0409FD1FBCDB62C711AC96EB62455664213EABF79CF38C971A8328076EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827716, "uuid": "86b1b1aa-3448-431f-8330-112b7fbb72ff", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827716, "uuid": "682ff5d5-3236-4821-abac-ad7ec96af133", "value": "98304:laVeJ2DFymVXtDF7CK6J7W/P1U0qUWURcFtXS4/HIV:+es5ymVdbG7iBqsRwtXJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827716, "uuid": "c54a5194-cc48-45b2-b6e1-dd53c95e1e5c", "value": 3467322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827716, "uuid": "ef64d04c-171b-456b-ac88-1c0a7b72dbff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827716, "uuid": "e4ac96fa-9bef-4e34-9b43-34bd1b6150fb", "value": "a5a83f292a1f4aff07578179575c09a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ce4ad9-b7fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Lazarus)", "timestamp": 1705801447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705801447, "uuid": "bee50b72-f7e8-4509-9076-5ffcb36d671b", "comment": "Malware payload (Lazarus)", "value": "edca71eda8650a2c591c37c780b6a0c5", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LazarLoader", "colour": "#A0FCBF", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705801447, "uuid": "4a9c8e19-8559-4307-9acd-24d9fac923c1", "comment": "Malware payload (Lazarus)", "value": "db846642c1c1872c6713a4194c4dcc8a8d272ff1bf0bcacc1ca1bdc3da6bc42b", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LazarLoader", "colour": "#A0FCBF", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705801447, "uuid": "5902fafb-0bb1-4620-b957-dbe96841e406", "comment": "Malware payload (Lazarus)", "value": "b8dd70a81279d5bb6b320d8c9e62683041107cc8", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LazarLoader", "colour": "#A0FCBF", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705801447, "uuid": "dafdfdc3-09c4-41fd-8f60-4b679a33efbe", "comment": "Malware payload (Lazarus)", "value": "f80731b335c459d397c0408eb0e7290a4f1c6d2257a5524edac3dd65f4789373b7600029a405d764d6e350f6303435f7", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LazarLoader", "colour": "#A0FCBF", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705801447, "uuid": "b2423362-0c23-4c6f-95ef-8cf8bae6c71d", "value": "T1BB85CF98775563A9D02B863882273904E1B5F91E075785BB71CB3BC07E8F092DE39E78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705801447, "uuid": "1766f745-ebc5-4452-a74a-40ff6d3d53ca", "value": "0c014839245c109cbf47ad8c2eabf402", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705801447, "uuid": "4c162d48-1e2f-43f6-bc48-35997689b585", "value": "24576:/wo5kB53GllG88KMRKuKtsx+G1piDKpPjKUfgm175S97FdPECJHgwa:WBBGlzgKtchXi3Ufgm9ElLdgwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705801447, "uuid": "d378b64c-e8c4-4a7f-ac8f-c7a69ebb2542", "value": 1764352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705801447, "uuid": "c4e015f9-5f50-4d79-95eb-decefcf91d4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705801447, "uuid": "dc58b78d-584e-4053-9deb-bbcc9c063d09", "value": "edca71eda8650a2c591c37c780b6a0c5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4698bd0e-b848-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705833105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705833105, "uuid": "bac6e8d5-7c6d-4ffa-9808-a9d4a15eab2f", "comment": "Malware payload", "value": "fcfcce6d1f2d9c5e71138aa8c8d4b8f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705833105, "uuid": "d404b1b6-b4d3-4587-b591-996bdd1da00e", "comment": "Malware payload", "value": "dbce49572dca715904d4584752663aa85f462968b94be5b3bc081c74b2247319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705833105, "uuid": "ee2e2e52-59b1-4809-8ae4-002240a238b9", "comment": "Malware payload", "value": "a0941c63cdbeeda4e0fdd4ca423cd8736f96e88f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705833105, "uuid": "feeb51d3-73c1-45c2-8397-ad68e84a42ad", "comment": "Malware payload", "value": "5d7dcce751c7a9b9d194389424e1094a9eb614e3c093460361e8dd80c06fecd81b4fb62c3a7124f5f5c32c69b69952b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705833105, "uuid": "43327b20-61b3-4e7e-8358-634c5c73c69f", "value": "T1C3A733D6CD620073F466043BAC91FE61432D12E9ABA5843BDB7A005725FF9F35A2163B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705833105, "uuid": "f3ba7643-c12b-4c05-ba9b-2822fa3cbb82", "value": "e9d858bf5cc2b22933333fd98518c716", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705833105, "uuid": "6cfedb53-fd1b-4a52-bc45-2874906f2356", "value": "786432:FfF8WWxUd9d1LRphkc3FphiWGlso5EYWAFPMUIW59Sabye+EoBTqzGIcmdK1jdiS:FfF8WWxU9ddRzFphiZd5EXUz7NbyfIz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705833105, "uuid": "43d3976c-f913-499b-8c63-2f39cfbd201f", "value": 47566456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705833105, "uuid": "afe90a9c-2dba-4424-8759-d31df7c6ea61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705833105, "uuid": "f1f9aa47-262b-4fbe-a2d6-90d5b21db074", "value": "SecuriteInfo.com.Win32.Patched.25674.16487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d23673-b882-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1705857983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705857983, "uuid": "2501662f-1a0e-4005-94a5-9dafe92d53b9", "comment": "Malware payload (AZORult)", "value": "a0aad7b264bd1c6e9a9535f6f1865e23", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705857983, "uuid": "8b6e7be6-a62c-42cf-80b0-914df5e84ddf", "comment": "Malware payload (AZORult)", "value": "dd4612be6e9a57ea8b9ac95cfc1db5bf7b4b05b3ac837c582cddbd7f1e7aed93", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705857983, "uuid": "4a48021a-318d-4b58-9550-286abcbf05f4", "comment": "Malware payload (AZORult)", "value": "f257a49e7f49bfb6f791233af3348731e12bc493", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705857983, "uuid": "fb11b66e-8435-4759-9ca5-307e7ddc00bb", "comment": "Malware payload (AZORult)", "value": "d1140e3fa5164caaed99c8218bf5edbac60f864fc447fea57f858cb2d83d291704026e6b4e5523e164a9beb5899f8a55", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705857983, "uuid": "6116a6ad-498e-48fd-a771-a63b9cbdd801", "value": "T1D2210BF42D518951E95DF0FD826E82A2F0E96443C5176A5B13180EF28B1D7C0FC47FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705857983, "uuid": "535d6aff-07b8-45e8-937d-24938f8c7228", "value": "24:91eXxTcjPHT2+KtTrpi8OdsvqnKIXe/fAytH0kCD2Xuvw4fV2jBsoea:98cjLXmXpi83v/I2H0b2+I4t2eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705857983, "uuid": "33538891-f806-4d13-a947-138f6e011831", "value": 1361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705857983, "uuid": "26c8a165-c295-4870-b368-216b131b5eea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705857983, "uuid": "049c4389-c830-4456-a3a7-d7d121690bb2", "value": "efax_statement_jan_2024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae8f933-b89b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705869029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869029, "uuid": "4f3c5c32-fe64-45e1-817d-280d4b1e4113", "comment": "Malware payload (DCRat)", "value": "06091136a76fc7024029f070baf323bf", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869029, "uuid": "3cb2478e-d43b-4c61-88ba-aa0589cc566f", "comment": "Malware payload (DCRat)", "value": "e131950a925158b637f77523a77a2c5566f5b4b102a84a703b979b603e199ce4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869029, "uuid": "72cca24c-6b8f-4c4c-8047-15584f83a2d1", "comment": "Malware payload (DCRat)", "value": "49641550170eb156f5098b152875ef2d9f33d098", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869029, "uuid": "ee9aa51f-30a4-4b5e-bc05-499a1c3503b4", "comment": "Malware payload (DCRat)", "value": "c4cefb3e5da8c68829923e3cddd83b33d6e4e0c2a4e6ea264908ea138a8cbab9d6a02f4c564aba11d9e5c570657f645d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869029, "uuid": "e6e8684c-f225-419e-acc8-90ad5453570f", "value": "T149454A027E45CA41F4191233C2EF854887B5985166E6F32B7DBE376D95223A73C0EACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869029, "uuid": "e79f83ad-dfaa-4088-a64b-55cca79acb2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869029, "uuid": "985f7824-c52e-4133-b3b1-d0394e1efef1", "value": "24576:ER3fjaeGyYZjhGHM7CG7sCmwVmBqH++Ck7NxWmrRS9sVcCDOu:ER3fjUZh0Cloa/cmrBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869029, "uuid": "c7514338-0344-4ec2-af3b-44022d22d49b", "value": 1199104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869029, "uuid": "cc2764e4-e9a4-480f-a07f-870e18f5afbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869029, "uuid": "bb2c091e-d37f-443d-9421-76d2edc2433b", "value": "06091136a76fc7024029f070baf323bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5caa61fc-b834-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705824552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824552, "uuid": "bb7a41d4-8caa-4955-84b0-993fa1c6c414", "comment": "Malware payload (Mirai)", "value": "148e32dc7348d89efff2ee70c5e2b45e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824552, "uuid": "bec34153-e83c-4d99-a01e-a45b812a8a57", "comment": "Malware payload (Mirai)", "value": "e1335a5c0c7be855d2cd47923ac17c0dd9f64c69e4e69e7b6900e9dcbf00b7be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824552, "uuid": "0762544a-2366-47bf-a482-4ab8121e9262", "comment": "Malware payload (Mirai)", "value": "b72e55c3306432d792446585dd306299bccbe448", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705824552, "uuid": "af5701b4-9861-4325-a97c-d453dcb4ec63", "comment": "Malware payload (Mirai)", "value": "91c6fd1bd9f376a19380e2b1d84db9ff8c2da55f9858e19afd60a2490cd60bc8041af03c62a173ee203fff9cc9fbf378", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824552, "uuid": "9ea58f59-6a6b-4ca5-9301-7d5557b9e413", "value": "T18CF33AD7F800DEBEF84AE33648230919B130B7D111925B376257797BEC3A1DA0967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824552, "uuid": "e50ee7c1-3539-4f24-9096-5d81500bec83", "value": "3072:onp1tFQ9eHXvFWFL3TBNsqC23vS4Q5XkFVrjbinLqV9+syNl8wt:kpxKiKnC2/SlXk0LqVByNuwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705824552, "uuid": "c7d977c1-dfb4-444d-84e8-e89e18465c97", "value": 165472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705824552, "uuid": "96d27740-ae03-4122-a7b5-1c42b73dc1ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705824552, "uuid": "04aa5a56-0e7b-446c-bbe5-388a34ee93bd", "value": "148e32dc7348d89efff2ee70c5e2b45e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9be612f-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829433, "uuid": "63b3babb-07cc-484c-9780-5ebad540faab", "comment": "Malware payload", "value": "9f3a98c48d88ce6223233d516f81f569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829433, "uuid": "a82198e7-1e08-476b-b487-57ac01fb3c96", "comment": "Malware payload", "value": "e1f056234cb1b97fb65288be65ba7130953e3d32527a055ec2cf7d9d030c033b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829433, "uuid": "b93b0e36-bd39-46c9-bdff-5f12065ef80b", "comment": "Malware payload", "value": "c7064f6716760bb509c5603372304a072a5a56a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829433, "uuid": "d248869d-6972-4f3b-8757-672c612f975b", "comment": "Malware payload", "value": "285c39851b2805127f5d0ed00e7d3a182a869a69b18cb41255bda01f74c563a9605dc9620f2787998f0a4606d6df0d3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829433, "uuid": "bc242aaf-49cb-476d-a1b8-a003caec5e44", "value": "T141447DBA73E74F27DDA923B2D5234241733294617361B7A78113923C09D238EE94AED3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829433, "uuid": "9bd236be-67ee-42cc-a0a6-89e936de3501", "value": "a7e9df442921da03196472b0c909c1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829433, "uuid": "4f70b2f5-129e-4165-8ec9-702add115029", "value": "6144:i5DfRalmUsaTcA/YxxfGkZyHUAsm2oAEdaG/2x4kzsGA/A4Sr+4SSmQKYH9VQx3I:i5zQlZsaTcA/YxxfGkZyHUAsm2oAEdaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829433, "uuid": "358daf6d-3580-4f94-ad9e-15442f7ed903", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829433, "uuid": "6deb79b0-1818-4856-bb9d-ba40c7d78d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829433, "uuid": "92707398-4a72-43e1-a2da-1a09f39c5b77", "value": "SecuriteInfo.com.Win64.MalwareX-gen.18487.27665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3426bf-b882-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1705858240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858240, "uuid": "3614f120-1aa5-43d7-9d70-0024faf5063e", "comment": "Malware payload (AZORult)", "value": "aa8c860b523bd4cbcf9fa48074c73489", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858240, "uuid": "1def4277-b05c-432e-9cb0-1dbcb3f115a9", "comment": "Malware payload (AZORult)", "value": "e3a406607f9de0b40935b0838b40f60dee58f63e69490f7dd9320d0e3293153c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858240, "uuid": "48831698-4fa9-4fe2-a6c9-8fbde0fe1cdf", "comment": "Malware payload (AZORult)", "value": "66e9027b0d4d223315af4ffb4579b4763c9a281e", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858240, "uuid": "990ee446-3c0c-4c18-89d5-0a1595e45c90", "comment": "Malware payload (AZORult)", "value": "56588f1858fe9cbc968e3ecf4a4fb9b6b87b0711f3b71485064de577dc3ed636ea756255c79949351f40162999094f32", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858240, "uuid": "89ec3188-f4b5-4540-9737-570cab6f5fd0", "value": "T1BD246C99B0E6D431FBB01E304CA3B56B767CF9347FA29E63224C07765E662C094325DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858240, "uuid": "6c10f21c-77df-45d5-9cb1-95bad0fa55a8", "value": "e1ed1b87d365b2ea75670bba09649dc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858240, "uuid": "1ddd5f33-60d3-4dab-ac4a-8b43220abcb4", "value": "3072:YmLd2f5yZBRE34J8Quhn0o2lGPetr2MVlGjtB257XNITvPv1RpGFI58tf3m4sf+h:x5EOb38QS2/ZlGPq7W7vElXqfNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705858240, "uuid": "968e0b1f-cf0e-4498-8530-bf0303a55828", "value": 225752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705858240, "uuid": "282a784f-8355-40fc-91b2-09407b450f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858240, "uuid": "184110ac-63c5-4c28-9fef-3aec5123a67c", "value": "helper1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b98a35-b88a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705861712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861712, "uuid": "e79b61a6-9840-44c5-9a9d-2b20f6ed852d", "comment": "Malware payload", "value": "0922687dbc43247c16883ba1c76c94a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861712, "uuid": "be3f07f1-106a-4630-81b5-a95142556650", "comment": "Malware payload", "value": "e44c5c884f2138364e657742a01188af8b0d383109008a14f9ba22364a472b65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861712, "uuid": "2e01429f-2b6d-4e00-9f58-6c8e29cae0b9", "comment": "Malware payload", "value": "39cc66fdf9e36e91134a5264dd6958fc52f9db70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861712, "uuid": "1715fa78-06e8-4850-b82a-d9b66a6fb701", "comment": "Malware payload", "value": "141e76614f853f692c112cec9ab1e3b653448c642fe48e092d21ecb0cc0e5135bef961d5c1b079c0f870207ab30e1fd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861712, "uuid": "e7768579-439a-4ccc-99ce-d5445795f623", "value": "T1B0A33BC6E252C3B3E55A1B7202A7CE794132A522375FBE19E33C2EF4AB17144711736A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861712, "uuid": "10cc8525-4167-49f4-acd3-44901bcd8497", "value": "3072:Xr/mDVkOsbWg1T5YBIxJo582NZpG71WmPezXdKCYdoq:7/mDVtsbWC3e8YpG71WmPezXdKRdoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705861712, "uuid": "bb82bf46-146d-4234-bc41-e6bd6bafbf17", "value": 103266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705861712, "uuid": "e2973b24-7c03-4eed-9d98-b6348c37fdde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861712, "uuid": "33a5c399-125a-40b3-9370-f650458ac7ae", "value": "0922687dbc43247c16883ba1c76c94a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90447ccf-b8ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705876608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876608, "uuid": "16048d21-1cbd-4503-8ac9-9bc6e8753e2c", "comment": "Malware payload", "value": "a6cb1a166c4da2b830ec6f1551f8a955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876608, "uuid": "25f02111-9900-4d08-9595-120887078a51", "comment": "Malware payload", "value": "e4997332e80ee3670e6348d9efd8c1fd3dba3e32184a16256e06f5ca60aa2428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876608, "uuid": "99b7d683-cf0f-4cd3-90d5-e23e52b42560", "comment": "Malware payload", "value": "6881a3fa7ad3ce0b7c1f75a397da02ccbbbd11b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705876608, "uuid": "e039abbc-0f04-4759-bf32-9d1c5e3f1bdf", "comment": "Malware payload", "value": "dfc3ed954233599ab750b30dabc38284a0a27da64c5230b4cd42dcae17ee9f8f2fc6619513321f78129c338e5e64aa4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876608, "uuid": "30e97d48-0c57-49f8-896e-2461ba560312", "value": "T197E41572DCF6C49DC23680788384F8E2996924255BB78EFF5F8502525E12EE437BA5F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876608, "uuid": "a4c64f60-2bbf-4128-a4dd-36b5c8fe2618", "value": "668b6ce43601a0b1d48fb162e57e97ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876608, "uuid": "555d9729-e871-441f-a798-01f38bd46cf6", "value": "12288:0NhRBErdEmkZ1C1gOGdl4i6YlQNVNNNNNrNmU0UXL+SHuo++sBT/atzYEGcP6uPG:0NhR/mk7CDiNiNVNNNNNrNmU0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705876608, "uuid": "732a6045-f246-46ab-ac3b-4a635e3026dd", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705876608, "uuid": "95f2b39b-7f76-42c6-ae41-93b1cca90c05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705876608, "uuid": "b4cdc497-d2d1-433b-97a5-e0f8d05cf31d", "value": "SecuriteInfo.com.Win64.MalwareX-gen.22468.16333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a52691-b83c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705827923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827923, "uuid": "9e7c3cc1-6683-4d26-975e-a711a8e3546b", "comment": "Malware payload", "value": "6a405d4e88b4acb9706e19a83aad9cf6", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827923, "uuid": "850164aa-dc87-41e3-9be0-d5d5f7976ff5", "comment": "Malware payload", "value": "e52b2e06efa641a7993760545dc4b34881ab8f8c9b18b7f030664215aa8b5e1d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827923, "uuid": "375e29aa-11e6-4450-a10b-ee5a02bf0404", "comment": "Malware payload", "value": "64b6546eca31410c60195db26d38416e02818222", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827923, "uuid": "325c790c-6655-4504-86bf-55e6eed16e71", "comment": "Malware payload", "value": "d8b1b4125b0ffcf18f8b638a0605597660cd1b84d7bb78385bfa6a279774b1486c9be9543dad2ece13752e0d2b7998dc", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827923, "uuid": "e6ab9db5-49df-4dec-98e4-b784da4ce02d", "value": "T1A7212B1813DE1760D3B5C936A83C510611617C15F8734B6D4599DECC7D25714A82BF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827923, "uuid": "556dc849-5c12-4e38-83f5-f2a73865d9b5", "value": "12:8m8qmnoAW+fHgl91GKJUXBrGP8tk1IXBMf8:8m8rM+fHemK2xrGP8EYi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827923, "uuid": "54d1b24c-4755-4781-bc4d-8db146ffbdae", "value": 1350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827923, "uuid": "15ea8cd4-302f-431f-a3a7-adb137152a7e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827923, "uuid": "9d38d317-7093-4a64-9bb0-e46939eb840f", "value": "MoM.pdf .lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcefc6e7-b88a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705861650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861650, "uuid": "31535c66-f107-428a-93d0-02e1fcdcb446", "comment": "Malware payload (Mirai)", "value": "2324bcc4767566fc9513e362b549b2b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861650, "uuid": "331973b7-5328-430b-a2c6-45dfc7b42d6c", "comment": "Malware payload (Mirai)", "value": "e57bbaee7a5b43b6ad127647546719522c49f780be9ad868da1c0b087b2b9485", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861650, "uuid": "1e0ec004-810a-4bcb-b523-06723e672b6f", "comment": "Malware payload (Mirai)", "value": "e24326e7795ecc738622c32e1da0db9200a8a46d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861650, "uuid": "d91bf88a-1374-4159-abf3-9a529b3158e7", "comment": "Malware payload (Mirai)", "value": "e312aecf77dd52d013ac84ec5cb07e56acaa47255d699d395daa2b84875237325968b66a4a24b404e3a0f3a5910f329b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861650, "uuid": "953e3f75-9546-4a15-a927-d7534e44e4eb", "value": "T1DEF33905F6408B07C1E22775A79B865933339B64B3DF33199938ABB43BC27991E36606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861650, "uuid": "cd19b7dc-2030-40b2-9605-308c270dd144", "value": "3072:wC2qIZ7a76orzbfdnbx3Aj1PIeoHe0z5M/92WmJhny2qAQYzc:C7a76orPfdRAjTwe0tM/92WmJhny2qP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705861650, "uuid": "c987c020-ae63-4bd2-871f-ebc65dd16335", "value": 167599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705861650, "uuid": "281add9a-69d0-47d7-b1b1-44ef828c4ca4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861650, "uuid": "62394362-9f63-438b-93d1-76bd5ba38e79", "value": "2324bcc4767566fc9513e362b549b2b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307e1e1c-b867-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705846382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705846382, "uuid": "d3fa7072-8795-40dd-87da-c41178da2517", "comment": "Malware payload", "value": "ed73536c23e3888e120f9b7f09859c38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705846382, "uuid": "c2f209b3-8897-43a1-8f25-5a5976d38463", "comment": "Malware payload", "value": "e64376fdce40bf0d5677f2bc7d28fc37e7f60b95824188e71ec27e27bcec1d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705846382, "uuid": "492a372b-0578-40b6-9cc1-b4c0277d2997", "comment": "Malware payload", "value": "ab0f365d3513775cd39195a484f1b98145dd3ae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705846382, "uuid": "a00e1106-e693-46a2-8ce2-67f48027cc55", "comment": "Malware payload", "value": "36b0aa9594514ae56b828236cdd659c820d03b6922645517d31b2549afe89f79d9167d18d24075cfdf7be6d48334f2ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705846382, "uuid": "4be17b4c-b13f-4c0b-84ff-ba5d0b0fc592", "value": "T1B1B4DF22B984F472C3211C36CAA1F7685938BD20CF6149DB677C7E1D4E3C7D1A62A792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705846382, "uuid": "a527a5a8-2430-4e1a-8d60-1d91627e03dd", "value": "319b1edcc4538be377f43066c635ffef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705846382, "uuid": "169a1d0e-e909-4433-a88e-0e7d5a6d00bc", "value": "12288:oxjrr7F5qfMs8WdkI308n5b3ib38nbiXVyasFYH0:oxLsMs8Wdbk8hioraRH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705846382, "uuid": "5143cb17-a282-4161-839b-22285bb05cc9", "value": 537760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705846382, "uuid": "7821e576-d1ce-4d6e-b53d-523366597de9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705846382, "uuid": "43956003-b9b5-4928-a3fa-a1536fc35228", "value": "Nixlupa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed70411d-b843-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705831238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705831238, "uuid": "e654698f-c337-4af2-9a39-ce558f518356", "comment": "Malware payload (RedLineStealer)", "value": "bf4aba1ca4d6c2f868aefde46a54e934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705831238, "uuid": "3c6a96c7-7fa5-4dcd-9704-a372162c700c", "comment": "Malware payload (RedLineStealer)", "value": "e6bfdcf4eb6b4c03bb883bea26a17b082d26683f54aa292a514706a978421807", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705831238, "uuid": "03479829-5005-474a-b372-fd210e64193e", "comment": "Malware payload (RedLineStealer)", "value": "a01f148d9ec5024c85cc9652a7e8257daa0a620b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705831238, "uuid": "fe48f2a5-537e-46e6-b674-b12ea769e500", "comment": "Malware payload (RedLineStealer)", "value": "006654a102a65435520239474e26a80011446a1c8165120e6b001c5cdfa43d0d0c9320b728207ade7d3958623ba1b45e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705831238, "uuid": "1b556b5e-1c97-4b96-b44c-f46088cc8064", "value": "T11D050221B6C584B1E8A318301EE5BB32A73CB9701B769ECF9B404A2D9F354D05E35B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705831238, "uuid": "bf1a2e21-ee1e-4b41-8ea5-53718c5fd790", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705831238, "uuid": "569f7576-59ad-4569-9c18-8cd2adf0c7fc", "value": "12288:f3DkEGDINi1EwkG8TsHWihcVWfqyF+c2+VjU8/Tga+h36ez5NxY1DirPvw:/DkUNi1EvGdWQyyF+l+V7b7+R75cDovw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705831238, "uuid": "d8edf09b-4d9c-497f-b492-76ebb524c2bb", "value": 834955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705831238, "uuid": "c3f1e94f-35d2-40f0-87e2-9995d26ea2f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705831238, "uuid": "f6a3ae31-0a11-4211-a633-9621790774c2", "value": "BF4ABA1CA4D6C2F868AEFDE46A54E934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae80fb7-b84f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705836360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705836360, "uuid": "cdfed5ec-b755-40d7-8c24-cff1e1039e7a", "comment": "Malware payload", "value": "08b2190bafabe2d5a7a538d34ffb68ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705836360, "uuid": "d75677c4-d4dd-45d8-8171-86f30d22fa89", "comment": "Malware payload", "value": "e6d4d06052571d0888774052ebc52475d22f83296fc99576906040db20a37aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705836360, "uuid": "8e2e40cc-2d3a-4c79-ae15-5e39c7a4c1d0", "comment": "Malware payload", "value": "3c5dc50b897fe52a938e2cf440efc18d86421044", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705836360, "uuid": "99c769d5-08ae-4a1d-86ed-9f0d54894b35", "comment": "Malware payload", "value": "e047940999bc7708364dc7ad40b869ec6b7b7f5d235e648b9d0707e865b95f28ba2fba8c97967dd81d81bd103977476f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705836360, "uuid": "e9b5ecbb-8699-46fb-bcca-6c3bf70966c7", "value": "T1AA533B09B38B9270C9690A7580E3D51503F2A7876DB3D75F39C812C54F22BEADA4375E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705836360, "uuid": "2d6f3957-7087-4cee-947b-a91da58bc112", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705836360, "uuid": "6da8fbad-e2e0-432c-b603-2da58ba13242", "value": "1536:VK1DxMS813aEzBfW+1+Hjp3vl3O+JprX6lN:AFMS81dFfWxjpfl+E8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705836360, "uuid": "6f264177-20d1-4dd0-ab93-4f12a2ee3616", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705836360, "uuid": "b3ee0425-6851-4be1-878b-2b281be7cf55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705836360, "uuid": "aa478fcc-6b3e-4dc7-8d25-447fd9dab70d", "value": "SecuriteInfo.com.Win32.WiperX-gen.2244.21136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9b5b01-b835-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705825196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825196, "uuid": "da0087d8-6757-4b72-8497-5429823496b9", "comment": "Malware payload (Mirai)", "value": "117e6730e24cdd58b1a7187e5091a3e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825196, "uuid": "cf2d4994-fd09-4d9d-a11d-d5b6f9a10104", "comment": "Malware payload (Mirai)", "value": "e77430e3f82aa2bebf6c2144981f75631f38996497ccfcf37b0310be53f89c38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825196, "uuid": "2d81c9d5-eabd-45a2-aa36-5df96309c482", "comment": "Malware payload (Mirai)", "value": "f6dfaf2edfe5e6811c4a2d1ca4339ec7756ac971", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705825196, "uuid": "eac05680-d439-47fa-9168-4bb49ff28be9", "comment": "Malware payload (Mirai)", "value": "eb059860397a7505443f219b1ec4fc4b26d4cf29b9331bf21fab33f2f3bb64b85d438a487ba905420804bcbf7a8dc0b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825196, "uuid": "08f5fe33-7457-4b3d-bef0-70bd02e8cca2", "value": "T14B535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825196, "uuid": "4c211e09-be69-4034-83c2-173798cc27ed", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8I:N1GjR8EVGO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705825196, "uuid": "202c76e2-0790-4cc1-9f3b-e97c713ed27e", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705825196, "uuid": "fab84e05-2338-4c48-a186-7d03889d27cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705825196, "uuid": "0db529a6-2f0c-43af-b6e7-ec1a3cc1fa30", "value": "117e6730e24cdd58b1a7187e5091a3e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9defce30-b87d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705856015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705856015, "uuid": "a2ec8501-a2d5-42d5-afb3-e0ad8beb5fbe", "comment": "Malware payload", "value": "6330e5be8dd2babac0f356077452ce98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705856015, "uuid": "ec0e17b1-b7b1-45bc-96a6-e11d328694b1", "comment": "Malware payload", "value": "e784ecea172939b35eed7c5aa413e6addb3b56affd19be0904efa2d63e8074a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705856015, "uuid": "5fe2f095-c659-4c78-af78-abf7016f1a79", "comment": "Malware payload", "value": "55915d243eaf9396d9f1fc1f4258abb785b2c375", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705856015, "uuid": "c2cf48dc-cb83-4a13-9813-db62c4253617", "comment": "Malware payload", "value": "70a6df68ab72ff5004bfaf08d0d04a15723df06001314b951b8cfbd4b5d06ba0e07bc90ca57a4211cc169cb50053fced", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705856015, "uuid": "6680e74e-ce08-443a-a2fc-145d8e939767", "value": "T142159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705856015, "uuid": "3139a1b4-ba6c-4777-be0a-494ed61e6bb5", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705856015, "uuid": "6385eaf7-3d7d-446a-a714-77796fa752e1", "value": "12288:XqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaaT6:XqDEvCTbMWu7rQYlBQcBiT6rprG8aq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705856015, "uuid": "3e83dcba-d8d4-4ec1-946d-f75c6835fee0", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705856015, "uuid": "7357cf1e-006f-4bdd-a625-5861bc432d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705856015, "uuid": "4c98ecf1-d393-426c-b72e-7ec10a94465a", "value": "6330e5be8dd2babac0f356077452ce98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cf5a3e-b88a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705861699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861699, "uuid": "c2f7d704-eb7c-4da4-bc77-103db6d763b3", "comment": "Malware payload (Mirai)", "value": "540b5d497f0572868d8f0d1286eef004", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861699, "uuid": "0e14bbe8-4ac8-47db-bd56-1e8ddae4d401", "comment": "Malware payload (Mirai)", "value": "e946b3de4d1b1c1dd7b6d082fef0d150ec5212bb6bf8cadf83b3a3fb3a4b82b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861699, "uuid": "8cb14217-ed5d-4d1e-b4b6-a6040aa45317", "comment": "Malware payload (Mirai)", "value": "8590f227c96f2f0ddb4d7fa5ae3103511008a741", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705861699, "uuid": "bdbd0217-666e-40d9-aec5-eb797369eef3", "comment": "Malware payload (Mirai)", "value": "d01f97a1ff659b4ceb63a17320a1b3898ac24ada45a95c89790992f329456ef65f637bedad6ea1c8127dd223c4b7e6ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861699, "uuid": "9698dc35-64e2-461b-b67f-723731ae21bb", "value": "T18DE3C83ABA11EBBEE27D833147F39F7082A5229237A1A645E12CD71C5F2124D1C9F758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861699, "uuid": "5c6db98c-e847-4da7-9508-b9202d44026d", "value": "3072:lSvxNdbZU6eoVsbO8jrdmH8QAgEsLgn24fI6h2KcP2O0/WmAVv5A46/Dc:vwtU24hh2FP2b/WmAVv5AL/Dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705861699, "uuid": "3b1e50e0-25a6-49a3-9be7-60f36398ed38", "value": 155365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705861699, "uuid": "35405659-5b4d-47a7-886b-c176b0a77b7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705861699, "uuid": "8f34067c-1f79-45b1-835b-f9dbf54bc157", "value": "540b5d497f0572868d8f0d1286eef004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150d2298-b803-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1705803387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803387, "uuid": "3996b196-825b-4d97-b499-a09be2e2163b", "comment": "Malware payload (zgRAT)", "value": "9379b6e19fb3154d809f8ad97ff03699", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803387, "uuid": "2b10448e-5bb3-4b06-8b7a-e53001f63f4a", "comment": "Malware payload (zgRAT)", "value": "e97b0117c7dc1aeb1ef08620ed6833ee61d01ce17c1e01f08aa2a51c5278beca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803387, "uuid": "aa3b1585-7bcd-4852-b99e-ac92b0ff544a", "comment": "Malware payload (zgRAT)", "value": "b6e4e709a960fbb12c05c97ed522d59da8a2decb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705803387, "uuid": "ac1a704b-f6bf-4d62-beaa-fe0f679982e2", "comment": "Malware payload (zgRAT)", "value": "1d05105bb77ca4c5bd760d8e6a8fa322fe169c08bd4e28164590a3950b824e7981974b13f94dabe385bf23f1916eea24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803387, "uuid": "d4e090b7-afd1-4177-97c7-a39e52f2a084", "value": "T115A4232AD2B585AED826E331C67CB747CAB1846C92C6DA7F68CC46354E320E1347DF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803387, "uuid": "15074f18-c05e-419e-82b7-d26251a14e73", "value": "12288:tn7iywwzRZdGuZaGkXRGmPE8Cw8kiRCxzQk+JN/D:tGywqrdGgDkXRGWEDkIkm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705803387, "uuid": "fd2aa8ec-def7-4ba8-a92b-a55140776d66", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705803387, "uuid": "a6c36b42-d1ac-4e83-a1d9-e8722c6ecaff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705803387, "uuid": "d0427271-1b90-4832-92ff-8793d4cf4af1", "value": "Eszop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95218965-b88b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705862013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705862013, "uuid": "bb31b304-14bf-423d-8bbd-63ccd8a75a06", "comment": "Malware payload", "value": "9c4db0fdd4661f7cded6937de17bd83a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705862013, "uuid": "beb122cd-43ca-4a80-963c-1bee3bf7c399", "comment": "Malware payload", "value": "ea116635127661e19feba6617d367225156d09f97149cf5687015450cc2d8866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705862013, "uuid": "138f7320-9c24-464f-adea-a6dff32c7a49", "comment": "Malware payload", "value": "bcce20e0ff3453a6c253d81130b4a6814954bf70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705862013, "uuid": "1df912bf-ea69-46f0-98b9-53b9e0ea3745", "comment": "Malware payload", "value": "f3863c0f813a8046b76ed19384c919d4027d613761660ebc70a10c3c9e7bb03ea7701633fab2fb0c060a8ef9f8b31611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705862013, "uuid": "1bc0d393-8c16-4f2f-8903-c23c9516bcb4", "value": "T12E532A09B38BE261C6B90EB880E3D45507F1ABCB2973D64E3DC446C50E12BD5DA6375E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705862013, "uuid": "6ea0eb1f-cd3e-41b7-98ae-6803053025b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705862013, "uuid": "a33b633c-2810-4a93-9ceb-c7f99c3dbc4e", "value": "768:7aISlD8/1iXruB8ZWjpGjS8hFULCKdkF4k7JddOwvNqSfuclSF9u0Vf22fYb:rSpK4y6ZWT8hFnKdmdVvvN1fuaSFBSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705862013, "uuid": "8f6e9be0-9cec-4a49-9f2a-9dbe14a3d61d", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705862013, "uuid": "0ef6d2a2-1e98-4ea3-8d35-cfb688e42330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705862013, "uuid": "c129cc07-30ec-457c-b361-8f1135252df4", "value": "SecuriteInfo.com.Win32.WiperX-gen.3986.18852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c3467c-b89c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705869309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869309, "uuid": "bd205746-6b68-4d26-bdaf-65e9a0014f12", "comment": "Malware payload", "value": "b907d920ceb878a595dfe9d9722fa942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869309, "uuid": "2d2ebe0e-fac1-457a-be1c-20a216a26edd", "comment": "Malware payload", "value": "ed3865996f2e3b1da3b93dd89827626f61819d93953273708bf262ba226e68b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869309, "uuid": "d2e91b52-b88d-498e-9b77-4740c5ddb648", "comment": "Malware payload", "value": "ea08db196ebc7bdce9624830e242bc908ca8d63b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869309, "uuid": "af5c4302-ffd3-4f49-b75b-3b993dbe9c8e", "comment": "Malware payload", "value": "72a56982f0f1d5e615a0dfc2239c9c308f22371f4bd1ec5d7998a30d89b1be6ddd22f8124a63fdb0bef3f0a16e680ed1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869309, "uuid": "5fae2371-f561-4d33-9ca6-02d42e098d3b", "value": "T19F449DE0A070653DDC8CE17BB22AC15EBC599A5384DA76E7342640A57EF361D7280FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869309, "uuid": "b8662d23-8715-4769-9a20-f77001e56af8", "value": "06eb4d13e1bb2dcafbe526f4a64db1ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869309, "uuid": "71a4daa2-4d82-4606-9ca0-affb64b17e0a", "value": "6144:ImzNwMw774y/2yEIIAsD2Wv3m9RZWo0OMugCZ:ImpwPsIIAsD2Wv3yRWOYCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869309, "uuid": "7c71a33c-c23e-4799-952d-298631c7d9bd", "value": 274585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869309, "uuid": "707933e9-0297-40ab-a3ff-caa463c79adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869309, "uuid": "9e737269-799e-4559-af18-7fcb9c57284e", "value": "tttf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4a71e6-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829415, "uuid": "f9d89018-f5c6-4a80-a6f5-b4bace4548a5", "comment": "Malware payload", "value": "20cba98552e99c880eb1ac1e326e30a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829415, "uuid": "78abc1fb-7391-462c-b7f9-917bc697bfc0", "comment": "Malware payload", "value": "edc2414df53a3fb46daf9f5d9e6d03326b38216ec20541a818e9de88593a027e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829415, "uuid": "11e09b13-3603-435e-a20a-91e2ace7a53f", "comment": "Malware payload", "value": "297093f248a05589d8456a03c08574f8508cb8e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829415, "uuid": "2a232011-441a-4047-b4e9-c7e502991bad", "comment": "Malware payload", "value": "d8c7c4b17112d4465e9e242d81067b4e1c83bb110b2e3934f881f992039c431e81c9ca6f645cbeb7b54fec7159b1de38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829415, "uuid": "9490ec91-d37f-4b60-9702-ff6eafb0b5a7", "value": "T1F594D71E39F6C867C02F49304CB7E6B5ACF3B9114D0796871E6AEB4E68F63019D13869", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829415, "uuid": "1a27f5d8-6443-4f03-9a93-01543b49e44a", "value": "07a3568a95d539f165958fd78f5b6a91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829415, "uuid": "a0faeba1-15d6-42ad-b07e-bd570e9e08ee", "value": "3072:aO+cJUIEPgLD2LryrsVbBCtbY5vIa+/E2TwYl0:vEP6UrisSYD+v6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829415, "uuid": "bac405ba-5aad-4bfc-adf5-7224854f6d01", "value": 448219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829415, "uuid": "e1f7f2f2-3f5c-47d4-835e-d65b63c45494", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829415, "uuid": "71d092e3-67fd-4edc-9355-fdecb1d71311", "value": "SecuriteInfo.com.Adware.MultiInstall.6.15227.25623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339d1a13-b89e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705870010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870010, "uuid": "3f9250a4-57e6-4a4b-83c0-51e5e67c48db", "comment": "Malware payload", "value": "647815e631362280dc17d0a50fa745ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870010, "uuid": "a1fd491e-3c51-46fa-bd91-69b54206c8f5", "comment": "Malware payload", "value": "eddd85fd74df2ee82c700de8e49284a5043d3e69913c97e66385abcbab75bf49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870010, "uuid": "6b070590-9afc-46d7-bfc8-2068e186a722", "comment": "Malware payload", "value": "87492f294a8decf2e4ecd67a471f13bb31cf030a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705870010, "uuid": "2df6471a-fea0-4372-9362-4f7baf44b910", "comment": "Malware payload", "value": "37f1debd68e62fb750e3dbb1e89d75db593c0308679ff956da6ae6b01ced64c505e302f499017b76ca7dab36c75c3ae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870010, "uuid": "84b167bb-5066-4d99-bb1b-47161fc0a2e9", "value": "T176E55A143BF85E63E16AD773DAB0501263F1FC2AF363EB1B6191667E1C53B4058026AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870010, "uuid": "7fc23921-4a1d-43ec-86a2-f786a25b1b0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870010, "uuid": "40756289-51a9-4b33-84b0-18e3973c6959", "value": "49152:Xv2D/2oga6ctePEl3s3jn7HZkgVrkTrBMfJBoGdYTHHB72eh2NT:XvQ/2oga6ctePEl3s3L7HZkgVrkTrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705870010, "uuid": "7ae68125-29f9-43be-88e0-dde4a1ac41d2", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705870010, "uuid": "da49e287-5ef4-4ea6-8f42-104d765cb637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705870010, "uuid": "0a4e7a76-8574-4709-9bc4-63a71864a353", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe7ad9c-b858-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705840281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705840281, "uuid": "3307962c-62e1-4649-87f7-c4fc426e8250", "comment": "Malware payload", "value": "9951a53645e71a794e52762db3630ba1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705840281, "uuid": "ce9e30eb-bdbf-4a7a-9025-afe9d1181b87", "comment": "Malware payload", "value": "ee59809668bf98543a53d35adbb7dc216945deb6eaddb9340495b407446b75df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705840281, "uuid": "92674ea0-f4f2-4027-b1e1-15469415b3c4", "comment": "Malware payload", "value": "1a96f9566404fb2db38b2f256bb6948728d2ea65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705840281, "uuid": "96d33a56-87fa-4437-a8a8-b3dea68629e7", "comment": "Malware payload", "value": "6055be7f8bdfd2d19ef90216aae8ef08d56c7ce9b09f967491a1555aaa28bccb2da3398974ad1bca5f926dafec0a5769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705840281, "uuid": "a8a78564-fdbe-4e59-abdf-60fb8e1a7004", "value": "T1DC532B09B3879320C5750BBCD0F3A8950BF2A7572673D78A3D8462C95E137D9CA83B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705840281, "uuid": "ca0421a4-d375-4035-b753-7fa2358fad68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705840281, "uuid": "805feddf-06ee-44dc-93f1-0b2e81e68ef6", "value": "768:aL8/1EiiJogxPQEJC7NP/61NZ7ohJlX9gSq3e8rovcAM7VuNt2f2J:8K7FgZQEJ2K1jYVbOe8MvuuNdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705840281, "uuid": "b9b63aa0-7c22-4cb7-be9b-7f218d44d217", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705840281, "uuid": "4454cb1c-ba03-44c8-9314-c780f17c62bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705840281, "uuid": "ec81daf8-6ea9-442f-998e-72227dde6457", "value": "SecuriteInfo.com.Win32.WiperX-gen.18426.26449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabef6e6-b89c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705869405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869405, "uuid": "1b69f757-8410-494c-a83e-cdcf9a2c0c01", "comment": "Malware payload (RedLineStealer)", "value": "4860a69d64c373d0193977c602bd19fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869405, "uuid": "102aab39-ef69-480d-bbd0-879de1315610", "comment": "Malware payload (RedLineStealer)", "value": "ef82cf52cbcd8a2539aa6340d008b8eecd80d053cbe7a158226fc5c9555e0cbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869405, "uuid": "e8819622-b32e-475a-ace6-09ccfaf80235", "comment": "Malware payload (RedLineStealer)", "value": "9884d128436321f2f01d6137a47733664eafca29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869405, "uuid": "df9a87bc-b36e-4af8-baf5-516eb5d3b5f4", "comment": "Malware payload (RedLineStealer)", "value": "c0669041ec75482c3b65242ab3af949d69c132c1bc1c35a1f94b219d02c3e5af628603ed4ad53d68747994c5690ec80d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869405, "uuid": "78c17656-fb53-4e60-9cca-90c6b5f15fce", "value": "T130A35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC164E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869405, "uuid": "218c69a5-0fcc-4727-ae34-f832aae29e5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869405, "uuid": "8e008fd0-d87e-4f34-821d-5b8981e578b7", "value": "1536:xqskjlqzWlbG6jejoigIr43Ywzi0Zb78ivombfexv0ujXyyed2V3teulgS6pk:fYUeYr+zi0ZbYe1g0ujyzdFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869405, "uuid": "e7f6da59-390e-4a33-b865-7857fea9b3b1", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869405, "uuid": "29e4acdd-83da-4366-aac6-c562d837a125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869405, "uuid": "644d9cb2-822e-4492-bcee-5134c64385d6", "value": "Implosions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4c9ee3-b870-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1705850425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705850425, "uuid": "cd1eb2bc-3b64-4c2c-8494-6b7c1a954cf3", "comment": "Malware payload (RecordBreaker)", "value": "f02707a04e5bd02b07e632f5cc023cee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705850425, "uuid": "8abb1577-d8e2-444b-b9d5-afe3ede392b7", "comment": "Malware payload (RecordBreaker)", "value": "f2156d1783e3ac6ce1a003a5543ab525a648d87061ed9a913e3c99ed492f166f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705850425, "uuid": "06c28fac-e393-489c-96e3-52726c58f156", "comment": "Malware payload (RecordBreaker)", "value": "759d6f32c4562cd760444f2cb6682b6d858f2045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705850425, "uuid": "0f3bedab-96e1-4957-9178-74f3ba0f2c80", "comment": "Malware payload (RecordBreaker)", "value": "be4186d26102acc301921e10c736db523a06bcf9e0251f63043b9a4eb8c24aa90d54c1d516c69b28aa479fc0581826dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705850425, "uuid": "8eb1ceef-5d77-47c8-b1f0-3a3bb5f1f8da", "value": "T1DD75BF3FF268A13EC56A1B3245B38320997BBA51B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705850425, "uuid": "beaaff15-51f9-4a3b-80d8-075ce989f24e", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705850425, "uuid": "54a0b237-4146-4321-8a9e-3429c5235279", "value": "24576:s7FUDowAyrTVE3U5F/Nsn7Kic6QL3E2vVsjECUAQT45deRV9RT:sBuZrEUQ7KIy029s4C1eH9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705850425, "uuid": "2276b70e-0e1d-406d-a907-a4fb91fa03eb", "value": 1671992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705850425, "uuid": "e92fb183-2035-4b5b-830b-562bfbc54f91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705850425, "uuid": "8e03d7c4-8a24-49b7-a38f-18121cdcf811", "value": "F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca669a70-b84f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1705836333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705836333, "uuid": "1682ac7c-5c26-4c64-a9ac-6619c446518a", "comment": "Malware payload (RecordBreaker)", "value": "d1e86ea54211e17fd017b37da9626183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705836333, "uuid": "168af8ae-315b-4165-aa3f-47f731ac21ae", "comment": "Malware payload (RecordBreaker)", "value": "f2e12b1d32d359b98baab1e30ed08146571ad432393579aa873b036722c9a0fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705836333, "uuid": "b91ee154-b6cc-46b5-aca8-66d404f6167e", "comment": "Malware payload (RecordBreaker)", "value": "a430ab0945a90c25edd890cc69cd278cec2b9e36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705836333, "uuid": "3cd9a9d6-53e9-4fce-9faf-49725c7d89cb", "comment": "Malware payload (RecordBreaker)", "value": "c7fc43203ee1be9a6559caaa5ac9acfd8fb9c151ef2aa6ab21eac2356b831ef983bf8605546d4af0540f97aa81846f5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705836333, "uuid": "62e0f977-7afa-4923-9a96-af593370c40f", "value": "T169B533AC3FB9F622DB05CC38A5F4824568CBA5D423B6C96C48B35BF7F3891959091F18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705836333, "uuid": "7b3dc4df-b632-4870-8438-f55b26e54a4b", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705836333, "uuid": "21e47336-6085-4b04-a726-63cc41798ea8", "value": "49152:RW5eYnVOz6u17uADVr/rokVAHBMdvEXo7qWatx:RUeYIn7umVr/0kmhMhEXo7qWatx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705836333, "uuid": "1b513c79-109a-4460-ab48-70896830e305", "value": 2417664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705836333, "uuid": "3ff406f7-2a65-4539-9ff4-96d3c606c76e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705836333, "uuid": "70eadbcc-0791-4396-87eb-95ed84b8ffe0", "value": "F2E12B1D32D359B98BAAB1E30ED08146571AD43239357.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1282447-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829418, "uuid": "7ddf084f-ff40-4c6e-b768-f68d00c0a5bf", "comment": "Malware payload", "value": "d38fba43f925aa5b18ed26136f26fc86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829418, "uuid": "baa1d5db-5419-4864-bdba-98998f1b1542", "comment": "Malware payload", "value": "f40c16a031e61655f787603f348674c97696cdb359624157f6302ed64d056528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829418, "uuid": "4b5b1fb4-8432-425a-a51b-2e0aca910c5c", "comment": "Malware payload", "value": "bdb7545e04aca2787d6f45542463fb78e50aab73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829418, "uuid": "408640db-dca1-4424-a11a-08b0a412b9f3", "comment": "Malware payload", "value": "aea6d87a654337204eb8e0b512657b7078b96617060d7a39a1ec8555bb7dda3c70e607a01fd719a313dce74ee910b579", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829418, "uuid": "d4aa364f-1b72-4cea-8d07-5b5c253dbebb", "value": "T1247633057791E178F2568B395AE8C5BE043BBC903B70AA2B73C41FDFB5B04D47921A4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829418, "uuid": "830ff628-5621-4b15-bc8b-bb2eecacaa13", "value": "e859dd0409c406b4558a8d7b196d17f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829418, "uuid": "7dc09b95-46e4-404c-bb1a-9f6da58eca0d", "value": "196608:y5A6+MXeidV3JqvpX23n9mYU7CQqQ+JOyByBlJsM:y5LeibZqRyncY2CQqQ+seIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829418, "uuid": "139ce103-f9c5-4350-8a6e-c2d31a20172e", "value": 7802280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829418, "uuid": "474f19d5-9852-4067-aa58-fe7665232fdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829418, "uuid": "24f8a0d2-c3d4-4623-8674-9c86b8fc11f9", "value": "SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e11bfd-b83b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705827660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827660, "uuid": "233106bb-2bd5-4869-b99d-a3385380f1a1", "comment": "Malware payload", "value": "ef36613b98e65a4fc10f20f034fff8cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827660, "uuid": "0357a615-5467-4769-bc2e-4ea11e6fc9ed", "comment": "Malware payload", "value": "f5db25dee52be77e901e1c2c9a4779f8e7b4ca50a20115c374b23a4fa5a4466c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827660, "uuid": "abf176e8-0ae9-49e8-8d81-7b295052eb51", "comment": "Malware payload", "value": "084d1ee9ed1aa476c0c14a6680ecf2449a22ce6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827660, "uuid": "80fb76f6-ce82-49ab-befd-9607867bcdac", "comment": "Malware payload", "value": "51ec2bbd43cfc4cd7709fbac582086f7f5766da89578f5190a39067ac83129762b482140f73d6bc66aea70f4008ef756", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827660, "uuid": "8b35b47d-d019-4c1f-8c92-ed0ab0835840", "value": "T1AF159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827660, "uuid": "37756c94-1adc-476d-b10b-9ebf2f457535", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827660, "uuid": "49fc7474-4a99-45e2-bc94-d9fb052209b7", "value": "12288:SqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga6TV:SqDEvCTbMWu7rQYlBQcBiT6rprG8aKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827660, "uuid": "fa82afc8-bfbc-46ea-9200-1aad0a7161e9", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827660, "uuid": "f035104f-591a-4dce-84df-47b41721f3f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827660, "uuid": "4c798e8e-7f20-4c7a-a9f7-5c32b746d7d4", "value": "ef36613b98e65a4fc10f20f034fff8cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0245314-b882-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1705858220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858220, "uuid": "9a1296a1-c35e-4df4-907e-6a71dddd483b", "comment": "Malware payload (AZORult)", "value": "6fffe8bb1d9464d007d32d886bce0817", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858220, "uuid": "7d3970c4-da21-444c-a5e6-44ae7482de84", "comment": "Malware payload (AZORult)", "value": "f61e953b18744be06991184c5d58a618ebcdb53c4a64ed0236e9e9300eb2aacf", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858220, "uuid": "a35bdc3c-fe38-457e-a2b8-1398fd86bba1", "comment": "Malware payload (AZORult)", "value": "f226f133abc9cf138eef791bd046524d187d8e5b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705858220, "uuid": "57c8ea24-ebd2-4020-9ece-6160d0833f91", "comment": "Malware payload (AZORult)", "value": "703ec5bd2e9fbfab053ff2f7be148633869d618578830e3a1b79db9ccc0f8103bfbbf8964dbe9e251dfc6d42ed9e508b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858220, "uuid": "17766555-c4fc-40a3-9a1e-12946d79708c", "value": "T1F0E179E5BE1C45E419BB225CDF928882AD4DA57415F88501F6BE8C0BF79FE2480F1B0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858220, "uuid": "2cfe0206-02e0-47de-8a8f-c33a7d0a3ecc", "value": "192:6vOuLf6+qUClbRZqwiJY5AH+W4BJeGZjf6H1XTMTqTn:6vQ+yo+yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705858220, "uuid": "a17ff51b-2a59-4108-8feb-712b728f0896", "value": 7318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705858220, "uuid": "b52a2f00-0a24-40e3-8908-172ad63e0ff5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705858220, "uuid": "e57199fc-7d75-45cc-ab70-ccb3a8a7d180", "value": "agent3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760cd6b6-b85e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1705842634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705842634, "uuid": "64db4b51-0e1d-42b7-8e54-a3a349af47e7", "comment": "Malware payload (RecordBreaker)", "value": "296016f5b8e64afa48b5447abfb1e051", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705842634, "uuid": "196670fd-2fa2-439e-a8af-3ce40efd8042", "comment": "Malware payload (RecordBreaker)", "value": "f81795c9da60984703aeb170967d4bcc9fa1512c03623782b3bdbbfa619c0324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705842634, "uuid": "b781f3d8-7408-4389-a182-bdae20712873", "comment": "Malware payload (RecordBreaker)", "value": "3178e0fea7ef7b60d5ee9186434f0fa1fa1972ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705842634, "uuid": "05ec6fbc-fbee-4093-a387-bf8a83935a61", "comment": "Malware payload (RecordBreaker)", "value": "17194fa00bad83d925444375e77194d92bce49615f797413f3c4b37c825b2a98bc75e1b8f677a9520dbc1673018e877a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705842634, "uuid": "85bcf8ad-3c75-479c-a658-0d12b46d9e9a", "value": "T10D1723963CDFC1F9DAC01828861B16DF13F2A6EB8D84882C66C47D86D595F73607A8D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705842634, "uuid": "cb058578-bcf6-42b0-9ce6-58871e6fce78", "value": "27cb3dd4b0c01d19e67be2c0b03afa13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705842634, "uuid": "f568b050-b2f1-48cc-88d4-6b64cd4609cc", "value": "393216:yWoKwRn5SwpQX5WrbbfGOjwmbDlYWOqiO5RNjytb45o9cIfrm:yRn5JpQXCbfGOjweDpL5NOtbWgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705842634, "uuid": "0aa14a6c-c5cb-45ac-8fd4-06df2ff5aaaa", "value": 19727360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705842634, "uuid": "d812e581-c632-4718-bb72-1230d9b672b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705842634, "uuid": "945a0cb0-8ab5-47dd-abcf-70fb3ca71783", "value": "f81795c9da60984703aeb170967d4bcc9fa1512c03623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be8179e-b83c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1705827933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827933, "uuid": "0d5ca2e8-dac7-48ac-a1cb-6ca1b80af7b5", "comment": "Malware payload (XWorm)", "value": "e38e4599d749d0eee94ad7d003e2b9df", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827933, "uuid": "74a7e672-5ade-4660-b0ce-96286ff9ce01", "comment": "Malware payload (XWorm)", "value": "f8f8bd476c063af3168d8f8fc4c724f319cc70b07c04100b5262015f1a21bd75", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827933, "uuid": "e5525fdc-7e19-4731-bfaf-16213923f619", "comment": "Malware payload (XWorm)", "value": "ecfe463bedd3d85aefe7902849ea081f253aeeb0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827933, "uuid": "094bbd03-efa0-455f-999d-ad1174183bbc", "comment": "Malware payload (XWorm)", "value": "86bf89350477b1c44c215f23802072ac3455f94d20f79c90672188982acb425fc2b37b1d26de34e09b1fdfe2f64f4977", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827933, "uuid": "5bfcbf51-6117-4e4b-a1ea-e0dd81336945", "value": "T1C8F13A1162EFB118B3B37F515BF8BEE58B6F7A56BD75811F2040010F05A2A80DE61BB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827933, "uuid": "c84b4c2b-d55d-404f-92ad-ddba13d63968", "value": "96:CQGu9GAl2x8Gkdl2x88QBRl2x8gLl2x8kf8fK9966:CFDVRqtUa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827933, "uuid": "47d3a603-7932-4a42-a8d6-a16220628a2c", "value": 7594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827933, "uuid": "78ac661e-0343-4f14-94af-05125203765c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827933, "uuid": "e9e6f17c-376b-4895-be79-eb8bd7fc4e42", "value": "Paid_invoice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f5f5e9-b84f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705836359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705836359, "uuid": "7099e350-b85c-40a1-a2b3-0b2d36267f25", "comment": "Malware payload", "value": "3113ee939c4165e11df0b5c4cb1de1dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705836359, "uuid": "4b309964-c56b-485f-a084-7c1418d47ccf", "comment": "Malware payload", "value": "f9308cf1e454e4329b4dd82d9e49efb3714e3bfeff8cc08e5478d4c8decfa32e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705836359, "uuid": "cf770781-7add-4c56-bb03-5d8760ad2f51", "comment": "Malware payload", "value": "b2fe9212d16abc635271f6c307c0d36d13d4ed5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705836359, "uuid": "2c79e814-8a97-400d-a97e-efd1d21d033d", "comment": "Malware payload", "value": "4fe29a319655ea66234ebe8e8b75d82789f97014744455868f43058417724555791015207a8869bf51203e97bd6ec44f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705836359, "uuid": "984066c5-e320-4b06-8bbe-0506812d0ff2", "value": "T1A0D623E995CA22F0D4D70E94B64E63CF3590506E0EBC5D2C39C52C429F62FAF164AE27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705836359, "uuid": "0f2655b8-abee-4a35-b671-e6f875d2b35e", "value": "cf90b06d66c317d72795a0f5b6218d2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705836359, "uuid": "ad27aa94-36a9-434c-a46a-3746e9bda41a", "value": "393216:nu//8etNHyFMyNGB6mfdRpxjf4IGLWVEuPO:uXNt4xNaRfYIGqVEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705836359, "uuid": "828cb2c1-6f2c-4fb0-8722-03dfd56dd2e9", "value": 13489664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705836359, "uuid": "7d1dbe25-d443-4389-907f-fc12803956ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705836359, "uuid": "22a4f2f1-a55c-4161-9ad6-11a1dd84094c", "value": "SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecbe449-b83f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705829468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829468, "uuid": "83b25c28-428d-4fb9-93ac-cfa68a15402b", "comment": "Malware payload", "value": "e4aa67c2b3fb6f586aa2e66970479880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829468, "uuid": "7bfe4cef-3be0-4755-beb4-c312af401847", "comment": "Malware payload", "value": "f9c58bb796dff9b81d73ae468413890bec88c6921f022c79ee6177559ed0df59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829468, "uuid": "c1c9b9f7-5ccb-489b-8eb3-fe68724908b2", "comment": "Malware payload", "value": "7aea084c7ffabd703ed842b18e691d3e80b5c336", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705829468, "uuid": "cfa626f0-b5bd-4877-8408-4345a54d30f8", "comment": "Malware payload", "value": "5560d6539ce4469c354cb54e5149a26c0c4225ea613b80e3a82b674e1003d41663e82f651e1d730ba12b16a908d541ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829468, "uuid": "edae6efb-e908-44d3-a608-33469dbd92e8", "value": "T1F6458C12FA9144D1E61B2871197217387B789AC70F27CBF72A5BCDA46E33372AD26341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829468, "uuid": "e361b780-4ed0-45bd-88f3-015ca991f73e", "value": "12288:8BZalJ50HiR+Kn2Np89P5d1y9Wi4AkxaxvgPCWwun:8BCJ50XH4RdM9d4DWv7cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705829468, "uuid": "f9fa2d2c-2030-4186-b673-1b8a0a32b64f", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705829468, "uuid": "19b5112b-65c1-4dae-8e46-654b3abc0008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705829468, "uuid": "b0c13d7d-99fe-4306-a419-9d350ae9f7de", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.2254.31076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccfb06f-b83b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705827720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827720, "uuid": "a01c5988-c2fd-4f74-abdb-56114fe8eaf3", "comment": "Malware payload", "value": "dd9fa9fe87611bb1135335c7af5afacc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827720, "uuid": "35721458-97c2-457d-9743-74d0c49605b1", "comment": "Malware payload", "value": "fb1ccd1bec66e93eb92766de3fc26b5b4f1e9eb17ba2ddd781c12fc907aa8df6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827720, "uuid": "fd885d38-cc2d-434b-a6c5-2d497da22ef6", "comment": "Malware payload", "value": "3e97fdef31b4426f1cf57f2f5aedf5137f2642ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827720, "uuid": "dd07c528-3220-4f01-bdff-a3b5380e78e7", "comment": "Malware payload", "value": "054f45a82d0542c26bcae0232d71f0d4f541b3c11bdfd3f1d69e1e1c715dc6688da37ba0765fe7d1a7710ed38444868b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827720, "uuid": "6b3c521e-f0c1-4a54-9dc5-2a9fdae15fa1", "value": "T133F533AA21FCDC67C90E327B4A145799FBEFDA8687A013A4CF947067F762119510B0BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827720, "uuid": "78ad5be5-c5ec-4cda-948e-246cd7c9a8df", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827720, "uuid": "125d2c20-c83c-4160-aab3-fa494ca45445", "value": "49152:+P+Js9WNTDcfwHKWCd7pKqdImPdI3VG2xy04Zt23s3RKnfbRLD3YztYen56OIM:+cs9WN+go7p1dI3bYL2c3Ef9/32znp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827720, "uuid": "fa6f34fd-1eb9-4c07-80ee-855d67a3991c", "value": 3467649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827720, "uuid": "a16ad179-4f4e-4504-bef6-a2ccd3a49eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827720, "uuid": "95cb01ed-021a-4636-a95e-02472dfa62b5", "value": "dd9fa9fe87611bb1135335c7af5afacc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccc6beb-b86a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705847772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847772, "uuid": "590e69bb-5ec6-4cb3-94fe-6bbb36f32705", "comment": "Malware payload", "value": "f8c0c5644eb70f3181e33c02cf002460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847772, "uuid": "1cffd551-5bf2-4122-a79a-03d11d1c7a78", "comment": "Malware payload", "value": "fd59b58f3ec15c2b4fe30f977a45e05f8f5b3ccca7e430897154b116ffa00d67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847772, "uuid": "841e21aa-6c1b-42eb-98e3-e81c83fc6392", "comment": "Malware payload", "value": "a7730e44c7afa45e3bb81bd324974bbd60a29b41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705847772, "uuid": "625e264c-987c-459a-9fa7-d9bb3f1b988c", "comment": "Malware payload", "value": "041f50d3c23944562c604cfd49c48a381594fae40d1c72b3118288671c91989b64fed6a8ce5c1a10989675d28a99f107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847772, "uuid": "db27f358-5a8c-41a5-b380-609408b16577", "value": "T1C344E3AF6B149D17C93263F9A445F7BA87260FDCB915C30269F2BC67F9C5A639C08081", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847772, "uuid": "cc0dae51-9a1c-4fad-aa9b-f9becf00d1ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847772, "uuid": "7875dab7-9c5b-4b3d-b93a-607dbf57475b", "value": "3072:/pdpj2mzyRk3JQ51yxHD9emDk5GfO3TlpA6k2KueEa:/pdpj2qyC/emQgf+w6BKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705847772, "uuid": "e1042abf-ba38-47b2-a259-4df2f8dc6aa9", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705847772, "uuid": "7aa559b4-66a5-4e20-b715-815d249724eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705847772, "uuid": "616cc897-7988-4c4d-9901-cf138a08d1e5", "value": "SecuriteInfo.com.Win32.TrojanX-gen.18884.25978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c5209f-b89c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705869473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869473, "uuid": "a1c50db7-2be7-4fac-a24d-10bda2d2803e", "comment": "Malware payload", "value": "efd90ef76184f9be2e720d804b61104d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869473, "uuid": "a3ab05f2-87fc-4801-9b28-0ed3ef849850", "comment": "Malware payload", "value": "fe124240f9f03d554d064f5fa7eeac7fc67eb7274830ea5845ac2853e241b371", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869473, "uuid": "fed1f8f0-4800-4420-b024-12e40b99065c", "comment": "Malware payload", "value": "e684a13fea65bb77d2702034c79a6d8c68497639", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705869473, "uuid": "c4b93404-e669-4c6b-9664-d4ac3d7c88b5", "comment": "Malware payload", "value": "adef890da29b92f314e43d720b8fb8dd949976e29448ca3c0e87e59fdd9a0e84d779992c6e2f21272dbc4cb093245865", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869473, "uuid": "70b3277c-b4a9-4529-8752-6ee72690d8e4", "value": "T182248D1174D2C0B2D973153209E4DBB59A3EF8710BA59DFF27A80B3E4F342819635AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869473, "uuid": "9c589b0c-54d4-423a-8050-a885f09c6e31", "value": "becb59d6c2cabee1a77fe54131d4eacf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869473, "uuid": "558453ea-9df7-4caa-944f-bed2fdede67e", "value": "6144:Yf03zFVHcinxvGLMBCnEAOu62Kp3iUw/pE:/3xV86b15w/pE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705869473, "uuid": "8d62dc22-20b4-4f64-a301-f14bfc0eb0b7", "value": 224544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705869473, "uuid": "c77724f6-1e83-446b-91d2-4899d7c4ca6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705869473, "uuid": "b9da22ac-f548-48ce-8edf-bfe1f0455180", "value": "cigar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f380db12-b83b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705827812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827812, "uuid": "915c72c4-20f8-4589-935f-695974da39ef", "comment": "Malware payload", "value": "83247b48483ba529beec744570765d9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827812, "uuid": "844faf7a-8c35-43de-ae58-b47673a0e0fe", "comment": "Malware payload", "value": "fe26552bf7af35c7880addff4b2ae3755b6e676b062a9a870bc07597f920ba5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827812, "uuid": "ee826b32-211b-4dcc-9441-ea6289a86023", "comment": "Malware payload", "value": "ee526f302d90e7dc11ece0c04cc79de0c301ad09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705827812, "uuid": "f321087f-62b3-4af8-864a-30a46834c8e7", "comment": "Malware payload", "value": "9ad4eb554ad3215f4efbbc80a0f0ef3b476598bd1fa265087624bf6891e915023051960b3201c52358ed5134379d9cd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827812, "uuid": "ae60e563-189b-4e96-8716-f57b4f9683f0", "value": "T1B4159E0273D1C062FFAB92334B5AF6515BBC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827812, "uuid": "54d5bece-1c35-4828-b375-51595b8e2ea9", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827812, "uuid": "506d7ada-a663-4221-b7c9-9793027af91b", "value": "12288:UqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga6Tj:UqDEvCTbMWu7rQYlBQcBiT6rprG8aKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705827812, "uuid": "229825ee-0dca-40ac-b90f-9f237927aaec", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705827812, "uuid": "75946be6-aadf-46b6-98eb-015979cda9d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705827812, "uuid": "88af268d-3ab5-4d19-bcf8-0235792c97ef", "value": "83247b48483ba529beec744570765d9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5cf7d6-b801-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1705802760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802760, "uuid": "4f2b4df2-b676-4572-a490-03a362fc83c0", "comment": "Malware payload (Amadey)", "value": "0b6cc42e0e7dbac5b14d8272cf9a10dc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802760, "uuid": "a88cd2e9-e92e-4adb-920b-68ad6e0e51c9", "comment": "Malware payload (Amadey)", "value": "ff3c3e7ea41955ee1ce503a05dd815a60f9f3d8765f117113212125154aa6136", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802760, "uuid": "718f82dc-8610-4ed8-91a5-483b26d403ad", "comment": "Malware payload (Amadey)", "value": "50cd32af636a9f7361076dec109e1304bdccab35", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705802760, "uuid": "cfdde603-e463-4389-84cc-f643c06643fa", "comment": "Malware payload (Amadey)", "value": "3bd028207710b25127ba39948b519551082c6340fed19dd5319e289b6d6cdd55cc687542c01a25e25e93fd0e050d0f6c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802760, "uuid": "4235e970-a20a-4bdd-a8bb-7423bf210a52", "value": "T1F50523F99506B431C83161B96D9A21896F7CBD2863C15A308ADF13EF26640CF9FCB947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802760, "uuid": "75929914-ad3b-4b90-9157-dea93fa5cbfc", "value": "7515ecf8c0dfa4d230ad835fe0acb57f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802760, "uuid": "db42ff38-b44e-4456-bb82-bfd75b138823", "value": "12288:gIvcEqXn0o7YNQz1F85ZwKd89BcFniz72PbZFbmqMrUAxvvvWs:+ntwQpyEvOnivQbnbmNrUgvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705802760, "uuid": "4d3de603-3c90-4c83-905d-0ec383ee43b5", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705802760, "uuid": "1e8396a5-afba-4446-9d8c-0428ece06434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705802760, "uuid": "2e773b70-8885-413e-a653-1d6398702afb", "value": "amer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }