{ "Event": { "published": true, "date": "2026-02-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-05", "timestamp": 1770336182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "dbae7517-3a41-430a-9e56-e60c525a4d9a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425f6be8-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305282, "uuid": "2290d15d-6bea-40bd-92ea-7b189df08f6f", "comment": "Malware payload", "value": "532ecbd8dd80dad064d185bcb7ea59e9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305282, "uuid": "c787cdcb-a07e-45aa-93c9-082dfa45a8f4", "comment": "Malware payload", "value": "005682dba62a836d6ea2a85af86276f1c414c48204a00b911a2fe23fbbc7fd16", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305282, "uuid": "3eeeb306-df31-48ad-ad1e-493fa03dad45", "comment": "Malware payload", "value": "ec9cd5cdee0e64c1cd415b1e3f5319d6aba9d733", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305282, "uuid": "52ceeb9d-fd38-4a6b-9806-d4c1773c44e2", "comment": "Malware payload", "value": "bcf6bf33c0cce99f1f4a4b361c60e46471cba8c839d604a3ed2b32fdb460674e2c68fefdd76cccaffff94497cdd68cba", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305282, "uuid": "c7cccd17-a291-4eb8-ac98-967ae94d2f5f", "value": "T1BAF502C4C8432874AB2D6855CB5FE62D101B70A322366E296D59B2ECBD9C4F7CC652FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305282, "uuid": "cf00a67a-04cc-4585-beea-a7607f08cbf3", "value": "49152:AKxNYMRSsvqlhgoxy9F1jhgnx3oEQSopKWu+uX8r536GAmTCFmpBsujKzfpy0vqj:AKxNk+p6G7vscK9yOzmZtM2Rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305282, "uuid": "9e934cb3-3708-4f12-9e5e-9e11c784be7d", "value": 3630885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305282, "uuid": "cf2dec71-1c94-4f82-8e15-0e270387c8d0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305282, "uuid": "b811ccf6-552b-44c7-9a35-964f6fa060a4", "value": "PO D2500513.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391cbe5f-026d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770280355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280355, "uuid": "8bea46c0-a778-4848-a79f-f1d5d8168b42", "comment": "Malware payload (Mirai)", "value": "7aa443411e12e949805cd5bfa520b9bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280355, "uuid": "cf195e2d-4d63-4ae0-9433-8d8071a4b65d", "comment": "Malware payload (Mirai)", "value": "01689ad9234724a26ca4bf6d57d6b5f50ebc2779c25c0b3369fbcfe053c9aacd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280355, "uuid": "71a7834f-6097-4d38-bd24-1b3d68eac85e", "comment": "Malware payload (Mirai)", "value": "f25b471c072f4b034e41787da867f5125bf5a0b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280355, "uuid": "dea00081-0cf6-4484-be7e-ad960c61a62c", "comment": "Malware payload (Mirai)", "value": "60aff8ddee244fa2f3d0a10499ee93bb877af73df3c672c8d444fe48351cc8f2ad8181aa4d8253e3bc911197ea50f60f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280355, "uuid": "6649774c-3fe1-4ba5-915d-4d64417d7f9f", "value": "T107C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280355, "uuid": "b6b897b0-6061-4db3-aedc-a8c176b93115", "value": "3072:36tJsoRNjmj1VGCLUZMIV9Sr+QVrxZNioew:VoRNjmj1VGc3rRio5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280355, "uuid": "cc3c595f-2f86-4533-9a04-6d6e3093bddf", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280355, "uuid": "e9d16771-c62b-4eee-91ce-ac5aca49dd35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280355, "uuid": "0a64e09d-9414-4f50-9cce-118acb63b86e", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999b7353-026c-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770280088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280088, "uuid": "36fff6fc-02d8-4e80-aa08-479ea0287c14", "comment": "Malware payload (PhantomStealer)", "value": "68d9015e2e34c22a9dc1d2d527fc88b9", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seher-yener-nilfc-com", "colour": "#D56C82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280088, "uuid": "c3f2b13d-0aaa-4c4e-b210-b5f29a1b848d", "comment": "Malware payload (PhantomStealer)", "value": "01afd8f97cb7e6f12bd97f06b862c27398ab81f7387c13b705fdf23050ffa0cf", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seher-yener-nilfc-com", "colour": "#D56C82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280088, "uuid": "d7296a69-0b1e-4660-919a-e2fd5c0617e1", "comment": "Malware payload (PhantomStealer)", "value": "a4f93048634904e976d0943bc8562300b35b9bde", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seher-yener-nilfc-com", "colour": "#D56C82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280088, "uuid": "18df09c7-dceb-4f6b-ba27-742c0afd7c58", "comment": "Malware payload (PhantomStealer)", "value": "966a11657fc020a18ac9cc625c54622ca9c3518455beb6154746bd6026c483754568961d5b48606dad36e4805e3f1965", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seher-yener-nilfc-com", "colour": "#D56C82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280088, "uuid": "021d1ca3-4bdd-4ba4-81c7-a79df665d8d7", "value": "T14E061151C90ADDA5066C811524AA1E9B26810E774C887B7A3F8F5F8E1F0F11F85B87FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280088, "uuid": "b5ec070f-9bd2-4db2-8c51-2bd19a9a69ca", "value": "49152:awYXjcbJDgMvbT8dUQAM8EX85JKe+MV238Ztjw/dLREQ1nU0RYrzZ:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280088, "uuid": "ac6ccd51-7784-419b-b58d-87b6cb40b445", "value": 3725905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280088, "uuid": "97713015-2b7c-420d-b306-a95ef96997de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280088, "uuid": "c7b118cd-74e8-4c53-b421-db99d960a4a0", "value": "park.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f634fda-0261-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770275212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275212, "uuid": "3ee182aa-d855-4aa5-aad7-73d6f686a0da", "comment": "Malware payload (CoinMiner)", "value": "ad497f97a719c13c83f257b356ec0381", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275212, "uuid": "17a2218c-b89c-468a-ab42-d4ddf86ebfe2", "comment": "Malware payload (CoinMiner)", "value": "01bf6c3bc93c0e9ca14b5cbeb91fc445d823a923c18f939879121a332eaa2458", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275212, "uuid": "0a06e29e-92aa-43a9-be65-5d592f87f0d7", "comment": "Malware payload (CoinMiner)", "value": "440a1f4f6c690657c298d2546bcd8b2f56c0211c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275212, "uuid": "6ff6dbd5-7d14-40d2-a0d4-890348842489", "comment": "Malware payload (CoinMiner)", "value": "a0f50f0f59097405983f28f48a9343e41b87ab56732e6f90f04cce3c2fdd2ae2292f30c728a5f89144af873acbdbfe2a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275212, "uuid": "07c0d8d6-af17-472e-a037-0dbfb7104723", "value": "T194E3129B4BB9DE2DD219527610F8A03A3B847ED8B1D1D3C48DC53E084B737DB216DA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275212, "uuid": "3f624f76-21cd-4c8f-97f2-5ce57c70b154", "value": "3072:VwoJmSgqgNPU1TZWkDH0GwPlOhePzfmHnPYQ8+PinXhWfaTSEbt:zJmSMNPU1ld9fhePiHwQJinXegS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770275212, "uuid": "808ee61e-29af-45d9-b221-a379c38f6b5a", "value": 144924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770275212, "uuid": "2284b689-38d1-45cc-9f61-c197bc61f820", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275212, "uuid": "570d0ad2-b996-412e-a3d3-ac2ec86b7464", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfe9db7-0271-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770282186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282186, "uuid": "f9f1e3c0-d37e-493e-b245-aa526ca56082", "comment": "Malware payload (Mirai)", "value": "4e0ceceff12560e2bb69744b7bb7de8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282186, "uuid": "f6ef66ee-28e7-4ef5-87aa-8989536c4fdf", "comment": "Malware payload (Mirai)", "value": "01d1b6bef0fb4bb0552eaf20d109ed63df079fce226e9c993cc5b1214febbbb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282186, "uuid": "e1f138a1-d113-4a55-8208-8eef9635346b", "comment": "Malware payload (Mirai)", "value": "33023a1145805de806b398e129f1022b6d39ef86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282186, "uuid": "9ed44969-a26e-4f08-9677-ecea46282ec9", "comment": "Malware payload (Mirai)", "value": "c4cbc659adc17385930a8ddff913291eceb96327110429bf9703887752a712f4bd6f1441d8f5c53c30cca64b394b8957", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282186, "uuid": "9c03b9da-49eb-4b7d-b4a8-76afebdff74a", "value": "T1CAA2E01072A32D66F3DD2C3DC96A8267F9660BFC90F5327569412620C94D24B3E3CA4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282186, "uuid": "ceba368f-b4aa-401c-997b-c4ecf0ecfeec", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj76kphymdGUop5hF:vvQn4j+ZO5fKAlxbps3Uozz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770282186, "uuid": "34e8d0a1-d156-4e03-944a-4ac0c8be4c07", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770282186, "uuid": "6407a121-6af6-493d-a3a5-a99f6fa517d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282186, "uuid": "72cc6881-9a78-41b4-9394-5e86a9da1347", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7dab7cf-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304700, "uuid": "7ff517ff-546c-4666-b4ac-056ea4881f29", "comment": "Malware payload (AgentTesla)", "value": "fe2b30210722e16f47c9b14079d56cef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304700, "uuid": "d1fe116b-a79a-4087-8c2f-4d647ca01fa8", "comment": "Malware payload (AgentTesla)", "value": "0249b099e5cf161407b30450caa1c6c778180293c336ac5990a7711cb4019ce5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304700, "uuid": "df0dc992-167a-4673-b718-e03c8ea81981", "comment": "Malware payload (AgentTesla)", "value": "0d3b40a8fea1aaf1aebf94fda5ba1fac9e342792", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304700, "uuid": "08045be8-a8a1-4f66-bbe3-f46d5c5df2c1", "comment": "Malware payload (AgentTesla)", "value": "2bad3fb8a49a2bd09bd2e4fcf33222070da415be1f4da2d036d345f37311f50f1a358a4f6075c9b1228374ed85b7b201", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304700, "uuid": "ca292100-5a53-4dbd-a3ea-1f83eaa81e3f", "value": "T17D251258379DDA13D8A617F40962F37617B86E9DD821C3078DFEACEB3820B14A645393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304700, "uuid": "a165cf51-b395-490d-aa67-c15552c2abb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304700, "uuid": "c5d7477e-f88d-4c7c-9098-b2acb25f4fc0", "value": "24576:Du2mwmGUNeoKajZAkggqeLI8KU/dGMCwreWl2y33:DHmwANfZ9ggqeoUgMCw52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304700, "uuid": "09013cd7-254a-4d5a-873a-f8066a7d6299", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304700, "uuid": "64def554-1627-49f3-b7c1-053bcbfd01d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304700, "uuid": "8a9ad854-08bf-4cbc-a5c1-79c2d161a74a", "value": "0249b099e5cf161407b30450caa1c6c778180293c336ac5990a7711cb4019ce5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05aaf92-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307292, "uuid": "e4f84a8d-398f-4ee8-8696-237446d2b3dd", "comment": "Malware payload", "value": "e7522c91b38dbf2439327076823581b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307292, "uuid": "76a35ca0-7704-4456-9bfc-ad53e562c147", "comment": "Malware payload", "value": "033b5d2499bfeaea884e2d4fbc22ac2ec5a74540bdf08457d432c9782a2e5809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307292, "uuid": "4a3dcde3-6bfd-44e9-b626-ffc4fd7abbbe", "comment": "Malware payload", "value": "f4764dd2074bdfa8149995766243266dd2951493", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307292, "uuid": "8abf8c3f-652b-4da9-84f7-46954970615b", "comment": "Malware payload", "value": "76b1c2849e69954324db63d37db29c1b7756b0f72c0fd7ba555da077b573aaef47e519bda710863e20fdc2aa25694bd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307292, "uuid": "33361c0e-0149-497d-96a9-6f13683934d7", "value": "T19E836B25F2A307ECD676DD74B1C606B1AA22FB2205F09F3BF241DE785E20A415ED8D19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307292, "uuid": "05d4071f-52c4-4de3-88db-dbc42cd19cd4", "value": "da9cbc22d816f3e5eb2fd6ff38a68da0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307292, "uuid": "07947921-ff5a-400d-8343-e047262a3e06", "value": "1536:00epobJFmC6N4MkwxQrQEICMXTdmbQsxsbkN3SFZmkXurEbDtKp6bq7WW:00epobJFKrkwxQrMXdmcS1F6bqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307292, "uuid": "57877523-3a40-4bc2-8750-bb4d0f0581d2", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307292, "uuid": "ab033d54-8bcf-4e0c-800e-be71a9400f0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307292, "uuid": "a8f2cbd2-9c06-4299-8e73-48734b70d39f", "value": "033b5d2499bfeaea884e2d4fbc22ac2ec5a74540bdf08457d432c9782a2e5809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d2de79-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770306388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306388, "uuid": "7e32c322-f146-4135-a5ea-e8dfdca7e546", "comment": "Malware payload (Formbook)", "value": "88aca4c9d81410e3f6df04aad1d8ec75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306388, "uuid": "ab495122-6f22-4ec7-94cb-b3d685c9537d", "comment": "Malware payload (Formbook)", "value": "03cf3b904fa5ab697555ec0c6ee3c0cb6bbb42a01876e2d093bd78edc4cbe3f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306388, "uuid": "d6579a03-883e-48f6-ae83-54743d7110ba", "comment": "Malware payload (Formbook)", "value": "315e57d682ad745b64db3a2de9daed1801f982bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306388, "uuid": "e5381467-c6df-4fff-9133-74f8ecbb75bf", "comment": "Malware payload (Formbook)", "value": "d4a1fe8ea8c7f5f883b85c56a4c57d00a65c21ed9d2f74dd4030a714d34b1af92349d122b42160df1b822716ee629fa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306388, "uuid": "9637cc20-a27d-413d-bf66-73c253dfbdf4", "value": "T19945BF0273D1D062FFAB95334F56F6115BBC79260123AA1F13981DBABA701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306388, "uuid": "05727e71-fd18-4aba-bd46-594f2e545f73", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306388, "uuid": "44a95df5-ffe2-4239-aeac-8e86be1e4d6f", "value": "24576:85EmXFtKaL4/oFe5T9yyXYfP1ijXdaJZTrRhKwimOQ3X2YvE:8PVt/LZeJbInQRaJZTrDvimG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306388, "uuid": "4fdc4c5f-4696-4b03-9870-8b8a6ed39f32", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306388, "uuid": "882edbc4-042c-450c-902f-60e2e878e81e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306388, "uuid": "2445d7a0-38d6-4bf5-af20-65180e331bdb", "value": "03cf3b904fa5ab697555ec0c6ee3c0cb6bbb42a01876e2d093bd78edc4cbe3f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46cdfb96-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304001, "uuid": "2f25396c-ebf5-4f43-9df1-847928062a64", "comment": "Malware payload", "value": "167a863ce55e91702114e85ceb47bae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304001, "uuid": "79bbd5c0-fd0a-4ac7-8575-d3d4f29f1fcc", "comment": "Malware payload", "value": "03d502570e21a473d39f3cc7258cc06a6beccf180b35698df3c7d3f9544a4c47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304001, "uuid": "94f19b4e-736a-4a81-9205-bd2885c69eaf", "comment": "Malware payload", "value": "fa37417cd08e2dec75d1613acbfbe629d06056a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304001, "uuid": "5593bc76-a39e-4cb8-b38c-e36a8a412634", "comment": "Malware payload", "value": "291e4a419f5dd6b52ce8ecbdd87952c495285f213800117bfdb2d8fe546e817f6e4e4d0904a952273d3353ef50d894b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304001, "uuid": "8fb0d3b2-0905-4fa2-9596-d4d894353fec", "value": "T143940812EA60B426F89345703DB9A246682E3C352641ED0BB78DDF5A3B71983B1F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304001, "uuid": "0c949f94-9f9b-49e9-ba5f-3693768fd091", "value": "af0020dfae36a911849c3cc9c57b5cf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304001, "uuid": "dd88404f-a343-4026-854e-b381a42433f0", "value": "6144:mcEqS0jzJB7MxWGEk+sZ2BCTBSvaBjLz6uSCNdszwrKt/:m7qSWMxWGEk+sZ2BkPjLz9Be5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304001, "uuid": "2eefefbe-dce4-4ea1-ba5d-505c0282d4e0", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304001, "uuid": "b7e5f2dd-e7ec-46f9-9053-f11bb205a371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304001, "uuid": "0f24e6a9-e89a-4d62-8ec7-e21c528f1c28", "value": "03d502570e21a473d39f3cc7258cc06a6beccf180b35698df3c7d3f9544a4c47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2440e7-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304357, "uuid": "3e080252-1cd9-4e1c-aefc-1168b0654bfe", "comment": "Malware payload (AgentTesla)", "value": "7c000ec1696903fff6fc9874f3f4cdea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304357, "uuid": "918b20c3-f2eb-4510-8935-06535cae3143", "comment": "Malware payload (AgentTesla)", "value": "03e1cac50f7694397f243a38092aa258c67c2d4133f14aed4bd61362340828d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304357, "uuid": "78e65eab-d6c1-46db-8cb1-9241ab3a59c2", "comment": "Malware payload (AgentTesla)", "value": "6a7d25976d9bb28a2c508a58b37a6897f519383d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304357, "uuid": "e6e6d542-56c6-4d44-b821-5e6a4bb51d79", "comment": "Malware payload (AgentTesla)", "value": "d22a3baa6a6ee9dc2fa735cce6c78e3f10899f97370b9d3733413e57e8334227b9433673a20a61f70227decf4d79261f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304357, "uuid": "aafb9cc9-7d23-4a03-896c-684932c4fca7", "value": "T17935120C7B26AA16C68D1F77D013214443FA9567E632F76B28DA2CE50E35B94C98FB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304357, "uuid": "5ec425bb-bf41-4fe1-891f-d6fee43859eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304357, "uuid": "220757d0-ecc7-4c26-bf75-f40727d0f3a6", "value": "24576:n5p7GPfNKmIoxaoOLA89jHYdK+/dnsLYXlCPI4Q:n5p7GKm/xOL3DsK+/dsLMCPbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304357, "uuid": "2b01ba9c-1f45-43eb-9303-60e498433b77", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304357, "uuid": "8f76f5e6-d581-4acc-9dcb-4daa13ef02b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304357, "uuid": "eb33d50f-b8c3-4d61-8d09-6e360ccc5f47", "value": "03e1cac50f7694397f243a38092aa258c67c2d4133f14aed4bd61362340828d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef59510c-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770307719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307719, "uuid": "1c653ca4-bbf8-4d76-a9d6-6ad7b6f7d457", "comment": "Malware payload (a310Logger)", "value": "1914e2c3194b55c37992c1bfc6503870", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307719, "uuid": "68bae698-74fa-4b1c-86a9-e57bf722fb63", "comment": "Malware payload (a310Logger)", "value": "040b425bee291f5a96b7004b0ca9569f988a892a06906f4e8e13a0e2b86d7955", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307719, "uuid": "065dfdad-5aa8-4b65-87d4-c951406204a7", "comment": "Malware payload (a310Logger)", "value": "2e2c2c1aff6bbeced6ca8fc47261f232b22991b9", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307719, "uuid": "0a15d7b5-0bbd-416b-bc14-63fd2be96223", "comment": "Malware payload (a310Logger)", "value": "950cdc325b080dccd086ee5b2580301b093dbdd4a6b15a317e043268f070f6e6a426e6fb02b2da8bccfdac8705fc7606", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307719, "uuid": "5d5d3422-798c-473a-94ed-b60873bb37ca", "value": "T19F845A23EA60A12EF1A3C9F1B9A5A25728263D395688EC57F3415F5834711E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307719, "uuid": "93bf8fea-248c-4b80-9be0-1535cf28791a", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307719, "uuid": "bfb58f28-41b9-4bbb-ab86-9bf73fc03cdf", "value": "6144:A8d1/w5KA81IJ8GpF6nuTmOOUWT2xKNE4EnvFEsvyF6GCyHxxBT7k:jjYKkJj6GmZUW1Cv0nCyHxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307719, "uuid": "132ea838-514a-4be6-9f3c-bb55d2451ba3", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307719, "uuid": "322a9f52-6a3b-4931-b8ec-cff6b4286206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307719, "uuid": "7d97d26e-0683-46cc-9be5-7d1221bdcdc4", "value": "040b425bee291f5a96b7004b0ca9569f988a892a06906f4e8e13a0e2b86d7955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465a1472-02e8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770333206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333206, "uuid": "2e727d5a-543e-4aa1-9364-929cbfe4967f", "comment": "Malware payload (Mirai)", "value": "caaf6aa799aa57f65a472fc606068aa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333206, "uuid": "7102be71-de55-4727-a7c8-c44fb504d003", "comment": "Malware payload (Mirai)", "value": "04abd9f424a5b26c0b27a1b8c2df5e7ac8ce91e4fbc0a1d90e2ebb9ed6e2d533", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333206, "uuid": "f72b39fa-e49b-4d29-ab1c-1a9b0b7202a4", "comment": "Malware payload (Mirai)", "value": "fb0c49890947a4790686024d4ccabf8ba60f1e2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333206, "uuid": "5c9cf6b8-0e67-43cb-9641-899e40b2c314", "comment": "Malware payload (Mirai)", "value": "4bb882561f3479a9cd6f459ef2074a1077cf81c2da92b6e571cbd9727cbb8ac2ac0d29ef9b6dd4328dbcef40e5180a63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333206, "uuid": "48038da3-45a2-4895-8796-8d6ecf86754c", "value": "T1BD538D75D12DAEA8C0424AB4A9598E704F13A0C046733EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333206, "uuid": "4ae99464-899b-4bd3-8ed5-ed20692b4701", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770333206, "uuid": "f3b5e84a-a973-4692-a853-e7b8ff849135", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770333206, "uuid": "e818e054-162f-4cf8-a164-158629b4fa0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333206, "uuid": "c9045a61-5dcf-4817-aaee-373e098b530c", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fd5a81-0262-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770275864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275864, "uuid": "f24a04d7-b468-433a-8384-1caf403efdc3", "comment": "Malware payload (Vidar)", "value": "76f9ef6d21ada8e0bcfb9c21cffa61ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275864, "uuid": "2ff84312-ab36-4b8a-ace2-7eb0d925e5d8", "comment": "Malware payload (Vidar)", "value": "053ab95d06f0602e39d167316e812f67b0f47a235a76bab776188f1d2694f4bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275864, "uuid": "87630f1f-8faa-40ac-99d5-b21a8289772f", "comment": "Malware payload (Vidar)", "value": "8f49cf5440dfaadcebf8696032320aff4fb21360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275864, "uuid": "ec8dc579-f6a9-43a4-809a-69baab41c633", "comment": "Malware payload (Vidar)", "value": "750e3e3962cd859d41d20cec0d9d0130029a96f48b2709eb1b9365e1c104fcbe641f2e9215015a70e936cbe917391f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275864, "uuid": "660b10ec-14b4-4efd-a74a-091a43e4e5e5", "value": "T191065B53BD84D129D6AF9139E8B15291A330F8480B3036D73B856AB25D3B7C85F3B729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275864, "uuid": "bc747993-c847-4584-83d7-856366be1567", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275864, "uuid": "2c42cb26-6763-4d68-9a42-d41e6fff9a99", "value": "49152:5FoKm0Mrb/TTvO90d7HjmAFd4A64nsfJ/DypMpEPug+PeCgwsNZcpcK1Pb:h1D2uUu5mrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770275864, "uuid": "70b56458-47dd-4e82-be2a-8a6831295305", "value": 3798656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770275864, "uuid": "42604181-3f71-48fc-be29-bce2a6b0a1e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275864, "uuid": "4afb6456-20e5-47ab-8595-e05fecc40f40", "value": "x053ab95d06f0602e39d167316e812f67b0f47a235a76bab776188f1d2694f4bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acbfa24-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770306692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306692, "uuid": "a06457e7-75b5-4cb3-9523-7963cdf0dccd", "comment": "Malware payload (GCleaner)", "value": "1c7e9cf72860784f4c419a2b8f5b309e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306692, "uuid": "5dc555b1-b802-4fa8-b0f4-93032ceeac20", "comment": "Malware payload (GCleaner)", "value": "054aae4f552a957b9b3378e7e9e4e54dfb2e20919dca2d5438ae098fd83d814b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306692, "uuid": "2ed6182b-baa7-497e-96a5-042c0bdefc3c", "comment": "Malware payload (GCleaner)", "value": "af8f2c2593e50e8a967bcebcdb4c0619491755e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306692, "uuid": "b24cafc4-c004-49f4-88b8-5b802a2ef29c", "comment": "Malware payload (GCleaner)", "value": "79c1408ac52eb98a21365417d0885d98e3007447d7a455eb1e30db0391002650b5ed874f49106204dbe41090038b3c62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306692, "uuid": "f810a0f9-94e6-428b-a0b1-46f839725bc0", "value": "T1A836E08163B182F7EE9B767B4C7DD018061CAD311F3CA95B36B663C70A3E5D066A44A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306692, "uuid": "62db0b58-7769-48ef-b916-1c94939fba73", "value": "90d3d45c4128e324bab07310ba2c236a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306692, "uuid": "c324f0de-c549-4c68-bed5-a54488d3cbd4", "value": "49152:QjdW0VqsaqldWsom7dD6m5Drwvzda5dSn4XfLaZY+MOgPagxWOVjqVu7M/L1JoX+:odW0Cqn0qgwDMwwRZY+PgPh746u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306692, "uuid": "55c87031-fb0b-46c0-9989-4076ba069079", "value": 5205504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306692, "uuid": "6bbeae95-131a-46f6-9f31-99b6aa511395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306692, "uuid": "c48c2a12-3907-4de2-a4a2-0c24f8dc286e", "value": "054aae4f552a957b9b3378e7e9e4e54dfb2e20919dca2d5438ae098fd83d814b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6401f0-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306617, "uuid": "2c6d8fc0-e068-4191-83a2-72f2460381fe", "comment": "Malware payload", "value": "7ca654e54c50e0544d3290dc8fc4ce68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306617, "uuid": "3e08c4f9-768c-4347-a40b-62840c058fd3", "comment": "Malware payload", "value": "05505b2a4a2eb43bc41fb095f1db16bab4dc58f92c74b707b5543fd6c98cc96c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306617, "uuid": "c94f80df-cf47-47c4-a048-0f057843f549", "comment": "Malware payload", "value": "9b0e93b97684f8e29d3430b0935578e7c79c5b12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306617, "uuid": "e053c4b8-693b-4f48-8337-cf5c6ea1129c", "comment": "Malware payload", "value": "50aff9638664e0994b3e0938a78db19ee41a19771b97ba7d5d74b234f96ef39398b353a20ca2d173d9112194bc976d12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306617, "uuid": "c15430f0-ba6b-40e1-9d7a-148df26cea9c", "value": "T15DB6339A349B4123C12F173C4B948F35EB702165678384CFBA9D92A397313A5F3A57CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306617, "uuid": "c695baf7-57ab-406d-af56-ba81bff2e025", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306617, "uuid": "2995d91a-59aa-4bc7-becc-47730ff19745", "value": "196608:MmD/FN0gUQGQ3AbsZZxjwOoH73/DRr25ZIQmxjKRqzftz3IuPPdvOBd:nDEgT3NZZxRoHLDR65iQmxjKRaz3IunI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306617, "uuid": "bd1d8a6a-3b0d-4bcf-b903-ae20df5c3744", "value": 11358208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306617, "uuid": "18a4f738-49f6-49fe-ae2b-49d07efada85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306617, "uuid": "9ccad408-7302-472a-b1a3-4d04b7546545", "value": "05505b2a4a2eb43bc41fb095f1db16bab4dc58f92c74b707b5543fd6c98cc96c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23be238a-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770303942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303942, "uuid": "5afa8efe-ce5c-42fd-a884-6f8339514d15", "comment": "Malware payload (AsyncRAT)", "value": "07c20a75c1bbc3f27cf0c0c1b6656c5a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303942, "uuid": "9480acce-e559-4307-b9c3-914d402f110f", "comment": "Malware payload (AsyncRAT)", "value": "055e35129e5bc0e4417ee8aeb8a4020825489da13a5e01962f0e69391e51b5f7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303942, "uuid": "cc0cc6d7-dd15-40a7-a2f4-94f1dbb657fd", "comment": "Malware payload (AsyncRAT)", "value": "705c72530f4808659c3067e6074dc50c936c020b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303942, "uuid": "a7a6f971-41ea-491d-8962-7ab9042b816f", "comment": "Malware payload (AsyncRAT)", "value": "fcfbc969689e583c701a6396e4fafbd512c3493ee24d16b24c296f3a2c4a057409c380950add5fe33ac938de439f49c2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303942, "uuid": "06261253-8d77-474f-b414-ee9c8676ae99", "value": "T15FE4124EEE171933D7681F3EC973124A09FCC8068462E7971EF698D20E76E5CC999C86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303942, "uuid": "1e85ccbe-c457-483e-8f1f-ce93f581d886", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303942, "uuid": "f8448e31-702c-4911-a726-8783bbd5ba87", "value": "12288:SPQH2HUaGXiEvWltSUf+7JBPZrafgjzUXwMCOhoUL/kSSOkg4kfyJNuhx:AfHS5ultQOOzUXCOoULMSakK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303942, "uuid": "f8d0fb23-5ee8-436e-b1b1-cfbdb9cfc418", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303942, "uuid": "4ffe0c16-3164-4343-ab43-3c33341cd513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303942, "uuid": "b06ae43f-9e7c-482e-ad25-b24d306b3bdc", "value": "055e35129e5bc0e4417ee8aeb8a4020825489da13a5e01962f0e69391e51b5f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13ce87d-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305548, "uuid": "bf25581a-8e68-43b3-946c-cb88fb9f9f4e", "comment": "Malware payload", "value": "1f9b92143c1d6ed2e43a269027dd5f96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305548, "uuid": "adc69f02-61de-411f-ae96-823877cc3bce", "comment": "Malware payload", "value": "05a97268db58bd86fc730eb09e3fc4ff999309cfa0832d323668dc37704b66c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305548, "uuid": "a2f87830-3f59-45b1-88ac-3701899cbdc7", "comment": "Malware payload", "value": "bf5ee6f91e9210b72028a987bddd8e2cc0c82d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305548, "uuid": "f6247470-1aea-4a8f-8c58-fa7843ce3464", "comment": "Malware payload", "value": "d7f93d6f3a4a584c7870c191171e86ac3dc8f71d3602d903f87c8b86f6f87f66fa15a48f556bb239368925bd3ac68292", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305548, "uuid": "6f7a3ccf-12e9-4e99-85b4-fd450d81ad04", "value": "T1BDA4D087FAC0D5D2D86C8832A973933112BF6CB8AB898383B348715176731D65637DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305548, "uuid": "a31e6c74-bc71-4f92-a811-351733148432", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305548, "uuid": "1005d352-ba62-4c2c-a839-a4af0e26bd42", "value": "12288:XcODb7v0o8JvG5UFP+ibiucOTjjjjcjzjcjcjjYXsNkBmMPVkwVWgCXbw1cfI:sO4njjjjcjzjcjcjjgsNemMPaPw1cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305548, "uuid": "78f8e000-b033-492c-9a8d-ddcf30176446", "value": 476766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305548, "uuid": "4a8be4af-b963-4f1b-96ff-ede39c4c5394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305548, "uuid": "ae7936dd-0cb8-4644-b53d-1f1f820596bd", "value": "05a97268db58bd86fc730eb09e3fc4ff999309cfa0832d323668dc37704b66c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5386d033-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306169, "uuid": "f25fcab3-77f8-42d5-8222-75cae16a813c", "comment": "Malware payload", "value": "5bc1da86fd99396e50538ee07d6b1d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306169, "uuid": "398755a2-f10f-49c1-b379-77f4ba16c889", "comment": "Malware payload", "value": "05b1c0d7ca44654c75712c481dfe69f43da2c8c4d9d973357965781ee528b99b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306169, "uuid": "a64b08b6-4a1d-4185-bbad-71745ae67a14", "comment": "Malware payload", "value": "1ae4066a382d9366df0fad0b5f87628dd5af51e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306169, "uuid": "3a19d679-fc5b-4ae8-8fe4-020063e0035e", "comment": "Malware payload", "value": "95c94797c06c17dd12b0b1f148d0b372d800e5f2584f640579486f74842f6dcc3c5ca75121a1e1224ef8b5790b9dcd6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306169, "uuid": "04d38030-7680-4dc0-9eb6-7168ff388e29", "value": "T1D534BE63A4BCAAAFDDD82F379C4E880713B66FE4D890603E1C44710EFE1A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306169, "uuid": "824cb1ca-c2d4-4fee-bcbc-14fed9973ece", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306169, "uuid": "7a396486-178b-4c39-9247-1d380bd53165", "value": "6144:MGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdlx:MG60BpL8jk1FGjDc8GVdlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306169, "uuid": "a2ecdeb9-4c9b-4b78-8d4e-06671a26f1c6", "value": 246116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306169, "uuid": "2512c076-5318-43b0-bd4a-36f09752ab02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306169, "uuid": "8cc40b41-1bc7-4a8c-88f8-6b44baaba84d", "value": "05b1c0d7ca44654c75712c481dfe69f43da2c8c4d9d973357965781ee528b99b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7a9963-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305918, "uuid": "1a747e9e-dd49-4518-8bbf-5692b362c290", "comment": "Malware payload", "value": "bc1d6810f77579f16e9404cd96981959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305918, "uuid": "b11df25b-7686-4202-8721-91d3f3919a3d", "comment": "Malware payload", "value": "05d1ed014c0e5b677f610b06d59731437680ec0f4ec280586923353c82754057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305918, "uuid": "fcf63b56-febf-452e-9adb-1b5da9439b97", "comment": "Malware payload", "value": "5c6e89fc885d11bbf86969541a92ad0754bba112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305918, "uuid": "0d2dde0b-db22-4485-9c4c-c24af86358a5", "comment": "Malware payload", "value": "cdea4a166036470373cfcedfc0351727117fb7ece5cf488345dd7a50274f8caf339e79c51e758b42046b0a6d71553542", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305918, "uuid": "55be391b-67c5-4cda-ba01-ca899f830fb5", "value": "T1E7256B11F2B2E03ACD96C0FD4AFB537B582C9B254794BCC7A2C45D6E2B503D1B27528A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305918, "uuid": "8f8e4435-da13-43d4-afd5-ddd18fc0c842", "value": "e7b0325b0ddcca85092dc6b4c73f202a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305918, "uuid": "9a1e21ce-46bd-41e2-9204-1376d506265a", "value": "24576:6sE2ZkyIZVCch45FAAUd4y3vHhToY1XRQQQQQQQQQQ+QQQQQQQQQQQQQQlQQQQQs:DIZVCs4TkPhT9XRQQQQQQQQQQ+QQQQQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305918, "uuid": "e87bd2c6-4afd-425d-a241-03997df05cda", "value": 1037960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305918, "uuid": "6c3e5ba3-1de7-4894-8cf9-c722689b5fb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305918, "uuid": "7dafdd31-0ee4-4ce5-bbc6-87c536ac49ce", "value": "WeGame_1123_7cdb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd072ef9-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770303769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303769, "uuid": "0fefd5fc-cea8-4685-b8bd-fb705bc43042", "comment": "Malware payload (Formbook)", "value": "850e981712eebc5fc95eeba4ddc401d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303769, "uuid": "f51b166c-45f1-4750-929b-bd63868396f8", "comment": "Malware payload (Formbook)", "value": "05f4c87488ee5219046f0eb72e97c183b071ce14f1772802a4e3b267ce99fed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303769, "uuid": "56a57921-f022-40bc-8ee7-56612dbbf11d", "comment": "Malware payload (Formbook)", "value": "c408e8409223ba6aea70f527ca0bc1b2266559a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303769, "uuid": "6cbfea9c-b520-40cf-9da5-9cafc047abcd", "comment": "Malware payload (Formbook)", "value": "5cbc206998761ed63fce1e232b69b67edab94821b89f0ba827f275785f503aa3389fd8f2e4e3a28e696dcd7752be6c14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303769, "uuid": "df9561a5-26be-4b01-8681-5ef90211a705", "value": "T176F4024D122BC812C8925FF41972E7F81B648FDDA520C743CFE97DEFB92AA58448435A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303769, "uuid": "945ffc3f-e339-4920-b128-ba88badaeacf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303769, "uuid": "30030d0c-f408-42f7-9478-e607234ce457", "value": "12288:OYITnNBR34uR3VSuLzgIDLDnWFYVJ6XO7Wc5Qv34/wmtZn6Vb99A3L7:mNT3HR3MurDLTFVU+7Wciv3UwmtZY99S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303769, "uuid": "4b64bbcf-aedc-4834-8e75-32c5d0635648", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303769, "uuid": "7f9a8e39-542a-4eed-afea-84d3bd573730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303769, "uuid": "39291510-49ef-4867-93ca-b75b17828fc2", "value": "05f4c87488ee5219046f0eb72e97c183b071ce14f1772802a4e3b267ce99fed4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c17bcc-0233-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770255355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770255355, "uuid": "33f107e1-53a0-441d-a60c-d7dd338ac5ca", "comment": "Malware payload (Mirai)", "value": "ec49f07f6560c9ae871a208c6cb76dc4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770255355, "uuid": "2e20e599-cdac-41c7-b65a-a514bf998dea", "comment": "Malware payload (Mirai)", "value": "0604c18e9bc170a25982673bffb3f707a606379e7471dc7cac8f053c02fb26c0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770255355, "uuid": "39e5935e-438d-4e64-b2ea-719ec005e2ea", "comment": "Malware payload (Mirai)", "value": "2e7e3e6555379f48a946a1fa96fdc63b5fb36b91", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770255355, "uuid": "4b40c831-8a19-42ee-92aa-aaab7d9b2872", "comment": "Malware payload (Mirai)", "value": "6669efed87b73b4a04ea9d4269e2e1ed00f26059462ff4992eccde42eebb7c7478a7ee0a952a5b3554a07478069a69b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770255355, "uuid": "e5d36316-96fe-4491-83d7-f7aea2465288", "value": "T1F7D32B45AA43CAF3C8C30FB512A757660632EC256B2BDE45F72DBCB44E165C8F11A728", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770255355, "uuid": "abd59c19-fff7-46ab-b6ef-675539359234", "value": "3072:cl6Ph2CLfROIb7Sd73wUgnRGsmXHngNPvKXKHsGhU:clGYC+CUYRxmXHngNPvKXKHsGhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770255355, "uuid": "c10880ee-718e-47dc-98db-0d84f70c7d3e", "value": 141683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770255355, "uuid": "6be83b7a-e26e-4fff-875a-0c1c429e34e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770255355, "uuid": "0e721b89-57fe-45f2-aa1c-073354be416f", "value": "bot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b6956e-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770304504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304504, "uuid": "34a1327f-3bc7-4dde-a2b7-601f6c094503", "comment": "Malware payload (a310Logger)", "value": "98c2b612943a03187db933bb58c2476a", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304504, "uuid": "15939d0d-0bf3-4c32-91f3-f0578eb17107", "comment": "Malware payload (a310Logger)", "value": "060655357175369a718decf6274acee85521593e6f5834a274074f34c01aa1e1", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304504, "uuid": "ad8a0007-d5bc-4405-8f4e-3f663f97aaa7", "comment": "Malware payload (a310Logger)", "value": "c5becc29ea2808b5f551204348d2f8eea2fe96bc", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304504, "uuid": "630b5ee5-1a59-42cd-8349-0081cafb65d8", "comment": "Malware payload (a310Logger)", "value": "cc6dcf61e0a2b61d3e8ac92426aef75a1b5620e30f7e1c76bf5ff871d8e5ab0cbc5b81ff15187eff00c5e6a128318430", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304504, "uuid": "c06a635a-1a77-413e-8414-04f52052a952", "value": "T112845B13EA50A11EF1A3C9F1A9B4919668693D351AE8ECABB7415F5834301E3ECF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304504, "uuid": "bc0e25e9-36da-4828-8e40-daf838ca904d", "value": "4e88637d5094cca5de1556f3666ec73c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304504, "uuid": "2a87cec2-47e0-4a44-b10f-436688fac3da", "value": "6144:r8d1/w5KA81IJ8GpF6nuTmOOUWTvtcD5W7mISVADsBE30hyfXuHqD4XthdN7Fh9G:wjYKkJj6GmZUWLtcRIo5hyGHQiJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304504, "uuid": "86a1755b-ad84-44a3-9e93-dc9054493723", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304504, "uuid": "8cd533e6-5925-4134-af22-382332e94c91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304504, "uuid": "d6ac3b8d-db84-49ff-b701-f27387b3b9b0", "value": "060655357175369a718decf6274acee85521593e6f5834a274074f34c01aa1e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa70e91b-0263-11f1-a129-42010a9c0007", "comment": "Malware payload (XRed)", "timestamp": 1770276385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276385, "uuid": "89b4fd12-8bf8-45ab-bb45-8fa3c83caa7f", "comment": "Malware payload (XRed)", "value": "f61a90d3683f3aba4e0a64d9639bbb68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276385, "uuid": "f2e03c3f-a784-4fa7-9c09-14d85b5a35b5", "comment": "Malware payload (XRed)", "value": "060754798d0960c49b43b08dcf01ef8358a9ad152975a4becad76bae8a6ce9c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276385, "uuid": "f96238a8-74d0-400e-a8f3-bb539cf31ab6", "comment": "Malware payload (XRed)", "value": "f7c12b829e21aadb0c99361f1da6e52348a5f94f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276385, "uuid": "7149f658-8f5a-428b-98a3-83283d466d8e", "comment": "Malware payload (XRed)", "value": "c4f03c3c9204a55e2c715e77f1c4f2bdaf4319461e14afb8e97c91ee54d01e9ee7032f9f08913727c804254d216c5610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276385, "uuid": "500287d8-fccf-470d-bc94-0fa64c3b256f", "value": "T190C5B033F6D18437D1332A3D8C6B93995829BE502E38A54B3BE51E4C9F796813D292D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276385, "uuid": "664e20da-e1e5-4f15-9d7c-1f53fd53a61e", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276385, "uuid": "ef3f7c9f-00f7-4654-8bb2-36ba77e8f9fd", "value": "24576:dnsJ39LyjbJkQFMhmC+6GD9t3vLR2VhZBJ905EmMyPnQxhe4/LwvHYgUBoHN:dnsHyjtk2MYC5GDf3dUZTH7LAlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770276385, "uuid": "e0aeaa15-3e3c-4b7d-8522-6de25361ae29", "value": 2513093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770276385, "uuid": "62f0c9f7-41e6-4eb0-995c-cbb754d5f82b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276385, "uuid": "e9fdf53b-2058-4b29-8819-d9a42d12d72a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ec2740-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1770307319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307319, "uuid": "edb638b9-cfc0-43d9-bd70-68d8c1d35d2d", "comment": "Malware payload (DCRat)", "value": "f3997426a03ffc9f9874cc23cee7c92d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307319, "uuid": "f4876012-69b7-46a2-b74d-0e775cd8539e", "comment": "Malware payload (DCRat)", "value": "06a3503b5be3450499323c6764a5edc840bc8df0ea19ad361ccd456770d38c40", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307319, "uuid": "5a4555d5-619a-4653-8c58-367c0c53e1fc", "comment": "Malware payload (DCRat)", "value": "e3117d5328ed88549427d0ed58d2805ea102c036", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307319, "uuid": "02de828c-fec1-4852-a719-a433a9ced7d2", "comment": "Malware payload (DCRat)", "value": "11c04b4a174cc4495cd97c86d955daf7097bee5df8660cc0411d028f3a181d81967bebd90ea12eef62099a1e6099a1dc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307319, "uuid": "ace5c291-5550-4300-aebb-99dc7ece08fc", "value": "T1E18523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307319, "uuid": "fab3a264-169c-4add-8f71-c4384811f22c", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307319, "uuid": "6de40f3d-feae-4a73-b7b7-7d5e589fdfef", "value": "49152:ckQzAwIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sca:c6ouRD9JdOR4m+lmY/4rx8ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307319, "uuid": "678801d3-e741-4dd1-b379-a1d2e7c8290d", "value": 1773568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307319, "uuid": "677a1425-4d2c-4425-9bf6-4c7f3c149b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307319, "uuid": "b88d3de2-b15b-4293-ab7f-30e3c14bb4c6", "value": "06a3503b5be3450499323c6764a5edc840bc8df0ea19ad361ccd456770d38c40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f23d6a-02d4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770324744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324744, "uuid": "355f7cd5-2aa4-45cb-9274-1dc4b6f88a45", "comment": "Malware payload", "value": "f561623e73c164160e32d5f7557864b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324744, "uuid": "14d8bc50-2680-411b-89e9-5b1ba17a7167", "comment": "Malware payload", "value": "06b6b9787f82bba5d2b9045c248fae2dae92503ca18584e6adc46b6f6ee6d462", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324744, "uuid": "a989a6e7-f3d1-4706-b3ee-bd4452e69c95", "comment": "Malware payload", "value": "fb66e6074e2ffc5edf1ada408ade5f9f07ead73c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324744, "uuid": "ba4ef4e9-3387-4227-9a3d-f037236c50a2", "comment": "Malware payload", "value": "d710d7576f9a8dc2c94685bfb5f72109762bc5af8f422aa2214d5fb2bac388e727673b33a5f38314066e78ca7eea2942", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770324744, "uuid": "155d4c6e-a26b-454b-ba08-08c36faa420c", "value": "T125467C47B5E354FCC1AFC434871BD9A3BA70789802257A7B76A4D6312F22F205729F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770324744, "uuid": "9ecbae5d-fc69-4308-a090-70d9a3a763c3", "value": "98304:RoP9C7aiJFe8ukJI7rpvrCSsQD99I/v/EJAqUy6VvXGLBX/nhzJBw7k1EyKOHs:Ru9mvXGLBX6kVKMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770324744, "uuid": "ac96ffe8-2ef7-4804-ba16-99ff8a77e622", "value": 5511352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770324744, "uuid": "b5b3ab44-e00c-4064-aa08-01b38bfe9c15", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770324744, "uuid": "88c11926-1386-4dd9-82f4-6855bd0decb8", "value": "build.64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3081172f-0235-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770256289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770256289, "uuid": "a740d9c2-2116-4b78-ad53-baf7d51749e0", "comment": "Malware payload (Mirai)", "value": "dde16956d2fe7aed8fb66571971f251d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770256289, "uuid": "f38b0f1f-85f3-4da2-a508-8461af1b999e", "comment": "Malware payload (Mirai)", "value": "06bcf2874e28168141d1fc376eccf9a75437a12f526165cda962cf023ac36c8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770256289, "uuid": "1e2953d6-ed79-4856-a53c-b267e998ab76", "comment": "Malware payload (Mirai)", "value": "492dc7d974b1c50715d149c97d4c573c8096341e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770256289, "uuid": "b557e806-eb53-4919-ae5c-c8a0bdba2253", "comment": "Malware payload (Mirai)", "value": "1d905a4bf034557612a515154e035fae854f9e5bf0a7df82b97ff25806c50727a6337921025b52536986e340c3b9eaf2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770256289, "uuid": "6a9e26ad-02dc-4145-9861-407ed07568ba", "value": "T190F2E1038299A34BE12E433D98BE7E4E1321D61DEA49A076EED840777854F8C935A747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770256289, "uuid": "fed5db70-26ba-44c6-b705-495aeed9dec2", "value": "768:LzbGjwng3vdOhxV/Whew0IAls1SeGhRLN1Hv8TmLknbcuyD7UHQRj7:fdnAzhe3rs2hRLbHv8Tmgnouy8HyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770256289, "uuid": "a12a0e91-92f5-4fa4-a2cd-b5977ef11296", "value": 34896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770256289, "uuid": "a236636e-b831-44d9-ac26-703895719d75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770256289, "uuid": "775d0000-515e-49fa-b43c-2bffb68c3166", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3569bf02-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306119, "uuid": "7b7a4c4e-5edf-4710-b915-b4f49aade73f", "comment": "Malware payload", "value": "f4ad2a70ac67d7da71573fe672822e80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306119, "uuid": "3aa0fe8c-1381-4123-8b81-bda37a15ed9e", "comment": "Malware payload", "value": "06bd40e8531a8cfc65936b9dee65c788c2c4ef84f9e16ee4a87c694644c2f0e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306119, "uuid": "b9d39dea-88d8-4c8b-a2ef-2a51aad1e297", "comment": "Malware payload", "value": "4e93470197eb11cab25174cdc1ec8745b4d6cf45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306119, "uuid": "741ef88c-ec74-47fc-96ee-ca6c4b31c1ca", "comment": "Malware payload", "value": "b290c3c3c2538c630a4dbc6104bc6b5b05f9734cc7fb70ab8c0ccf7e2871e5cd8fc39a19218dcf1560d18e88fcc7c807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306119, "uuid": "8d0ac536-a887-4056-a658-a09df7cc5490", "value": "T106A28102B240A4DAD58106721D77C3F65A73BC242F578E476690372E6C31E519B2FEAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306119, "uuid": "1a06e840-823c-4a2b-be4b-fd41b9a8af21", "value": "8d162cbc7e2e56a9b395a94f110c275f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306119, "uuid": "0ce6232a-6342-4562-8c4b-00cfe6c15276", "value": "192:ZkfmyABI0B+BJqXx4lpm6nprkV6lDHpJYgbEV9Ek4/dx6nUzzWFt:SfmNmzBJqKDteV+DJJYgbGKZjDvyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306119, "uuid": "b67d607d-982d-4244-a2dc-acbd89391a59", "value": 22380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306119, "uuid": "e69ceae0-ae86-4834-8445-940789182f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306119, "uuid": "7f619da9-7ff6-40b5-891c-b780c8329c85", "value": "06bd40e8531a8cfc65936b9dee65c788c2c4ef84f9e16ee4a87c694644c2f0e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd19cfc3-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770303394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303394, "uuid": "97a53d3f-0417-4cac-a8cf-3c125ec5f753", "comment": "Malware payload (RemcosRAT)", "value": "e39ed1e33d68a19933e165eead73c8bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303394, "uuid": "7b22c55e-5fb4-475f-8041-a1393c894129", "comment": "Malware payload (RemcosRAT)", "value": "06e8719891850e08c7903cc97d247a2e0b5cb92ab6bc82953440f46fe1229664", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303394, "uuid": "e7b17065-b1a1-45c8-afcb-c24430ba44c1", "comment": "Malware payload (RemcosRAT)", "value": "ff34c8d5ceb707b18ae422dcdd45ab0909ceef63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303394, "uuid": "bf0db5ea-0d60-4b4d-9543-d3d1ac9ed0b8", "comment": "Malware payload (RemcosRAT)", "value": "128c5248160b56f5d77ae1aa0e15e0e03cbc737c687d9b4a4bf32bd9a456355229575049deedc882d48877b92d99df56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303394, "uuid": "20092a79-375c-4a5b-a7c3-98697c1b41e0", "value": "T12075E132A2908437D1325638AC27A7B8552A7D202F1F9846FEEC1E4CCF7778179E5297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303394, "uuid": "861442be-1668-4f4b-8eff-21515413912f", "value": "e282a991ee7c244b6117f270d1f2b833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303394, "uuid": "5d4b8995-71dc-4309-bb5c-53b8c9060a84", "value": "49152:mXGNx/Cr6zD5HUbtMzG7/SHrP6C2J3XKSo:UaxCr6zDibh7KH2/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303394, "uuid": "a4fa3986-f38d-4040-8ce2-2a613fe484e1", "value": 1577984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303394, "uuid": "6e09cb8d-9e62-4527-a4e5-c6afcd58555b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303394, "uuid": "e23bd983-d9e7-40c1-ad07-c48164d7d700", "value": "06e8719891850e08c7903cc97d247a2e0b5cb92ab6bc82953440f46fe1229664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb97e171-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770306800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306800, "uuid": "9468fa4a-5ea1-4607-accd-bbf6f03e5934", "comment": "Malware payload (GCleaner)", "value": "bff102e1ace2bc86f06a0dd40433a110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306800, "uuid": "18b2d239-705a-40da-b228-6213aff0e823", "comment": "Malware payload (GCleaner)", "value": "072ca2b921058a9190139c49ba1a5beef36c81ad0331881359e269d00606b7d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306800, "uuid": "1c40689c-faad-485c-869e-d87fe5863dda", "comment": "Malware payload (GCleaner)", "value": "9d666bf3f47dfe4dc1e679cf40b09740a6530fab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306800, "uuid": "6939e74f-4450-4a15-9548-368fa8a58804", "comment": "Malware payload (GCleaner)", "value": "d3f44b97ec178de1a407d7db06492b69137d8eee2fd1f9b53b641b0c08b1c90f895e2a8ddffdb897f9d6f843005c7153", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306800, "uuid": "e7e300e6-e9e6-4589-89b5-343020019280", "value": "T19C36F0BDC24D06F7C96E537DEFA941CB0B2BA91B083CAC907FB52ACD4629174B01E495", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306800, "uuid": "0f06ae84-b947-4056-bfcf-7457d5772d42", "value": "90d3d45c4128e324bab07310ba2c236a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306800, "uuid": "954a9c00-5b30-40a6-add2-c7de92465eb2", "value": "98304:adW0AZBgoSjnYsuPr2ryfmRt8a1ciQSpObYoCuQhbZi:adaH4VuPr2rygaMzhbZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306800, "uuid": "c70c9f72-72c2-428b-bbe6-ca40c517fcda", "value": 5056000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306800, "uuid": "fcc591e4-9612-4f59-957f-6d2fd464aeae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306800, "uuid": "77c6a389-d220-45c1-a7e4-c50a6cf519e0", "value": "072ca2b921058a9190139c49ba1a5beef36c81ad0331881359e269d00606b7d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47dc8e37-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770305291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305291, "uuid": "5d6e581f-bfc1-49fa-8461-d978b74f260e", "comment": "Malware payload (SnakeKeylogger)", "value": "6f2ac73374844aec0b0e362baa46e861", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305291, "uuid": "3167a60d-bcb5-4dbb-b192-8ee8e8562271", "comment": "Malware payload (SnakeKeylogger)", "value": "07a15c3e77551af54b6f3d90cdd52cabe4b1a7aea22cab447025569d5bb1874d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305291, "uuid": "89199f23-c0ef-41ae-bc42-fdf19dbe26c2", "comment": "Malware payload (SnakeKeylogger)", "value": "d291e8711c47c39ae7fe2f5a99fdb9dafb5ae9cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305291, "uuid": "5f83b62e-cfce-49f2-8c8d-1f277ca07e26", "comment": "Malware payload (SnakeKeylogger)", "value": "4314bcb2e18ce02fe0ac745a9f7fff85186cc3f9938ed3b7738a841e9777e20fcf74e8ea0be5c3c7115e7f891152cc3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305291, "uuid": "cafd4097-3a7f-4d5b-a966-33233e8682b2", "value": "T1BA35DF34EA7EBB05D0627A31C439D6F21728FEC89815C31ABFD4AD5FB8356520B26346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305291, "uuid": "7bc0f4f6-d500-454f-a306-ed74a2c49d10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305291, "uuid": "245d13ac-dcfa-474e-80a7-3b0534df2688", "value": "24576:fs40DDixz2TMW0Zo/N57YinZ5e9qWpZpVnykyUYcT1FgMGiJ:E40DDFPoyMHZykr8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305291, "uuid": "45c6c98c-68e0-4cb8-8b8f-c39503dcdf62", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305291, "uuid": "c8bda868-fb06-4f37-9d6f-7fa4eea4d9f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305291, "uuid": "a4457dd8-c190-4d4b-8fd6-3af2dc7dad1a", "value": "07a15c3e77551af54b6f3d90cdd52cabe4b1a7aea22cab447025569d5bb1874d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24058fb-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770303322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303322, "uuid": "127f9967-a4df-45c5-8e0f-02ce53bf02f3", "comment": "Malware payload (a310Logger)", "value": "604d192103b06c7205cf869862b74738", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303322, "uuid": "b2887453-f043-482f-a49f-0997d5949af0", "comment": "Malware payload (a310Logger)", "value": "07c336349ee39e69279bf887c9a8effce9bf141557f2b17d0a34ea3d1e0cb297", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303322, "uuid": "febc64e7-8d06-4955-a8e4-b8cc2e64fbff", "comment": "Malware payload (a310Logger)", "value": "2c00e388d8bd7fe22927b495faa7665e3503cbd1", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303322, "uuid": "3a00229c-4660-4e21-9b07-21ad6fb763eb", "comment": "Malware payload (a310Logger)", "value": "fa628170505212a48b5f94ad4e07eba3bb42318f6664a3a67cb5d0f8e82a3022cd64da36dc1048931f94ff2fb1a98a2c", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303322, "uuid": "044fa49c-0035-47e8-af62-ce67bf2a6415", "value": "T1D6845A13EA50A11EF1A3C9F1E9B4925668693D351AE8ECABB7415F5834302D3E8F131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303322, "uuid": "fd652d28-aade-4eea-870a-374f629752fc", "value": "4e88637d5094cca5de1556f3666ec73c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303322, "uuid": "a9aa2a7c-8bdd-4eac-9c32-9a72c395db51", "value": "6144:48d1/w5KA81IJ8GpF6nuTmOOUWTO/HHJzn68qdIYFEw0wyuvmPSHE/9tRZZt8TR7:7jYKkJj6GmZUWeHg8sowyzPc9TR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303322, "uuid": "60e4f4ab-9680-45f4-9fcb-60830d7a0c40", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303322, "uuid": "ad585956-92e6-4bdf-84af-b5b43d8fcf80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303322, "uuid": "c46f0b65-2fd8-4bdd-b909-226e2db83d88", "value": "07c336349ee39e69279bf887c9a8effce9bf141557f2b17d0a34ea3d1e0cb297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c002dd2-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305378, "uuid": "dbf91cea-af06-4981-b82f-a48875b9f300", "comment": "Malware payload (AgentTesla)", "value": "7c4a7c924a203f0336dad4ac9e99bc41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305378, "uuid": "1e180c18-f216-46e4-8727-b650678662a9", "comment": "Malware payload (AgentTesla)", "value": "07fa3b53b7aaa614ed5e5858502e9aaa58662b16e62b60d77202a7de9ef761f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305378, "uuid": "7d7a77cd-aeae-4469-8ea2-74e6b99a1d31", "comment": "Malware payload (AgentTesla)", "value": "48eb07dfffad28ec064e5f62566c9aca9c2383c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305378, "uuid": "ba8c7a89-bcff-495e-a18d-c3128369dd4f", "comment": "Malware payload (AgentTesla)", "value": "cd953c560962cd62021c5e0ebbabfc09f9169c92c28484352a88cbd3aa21bccf8426d5be4aeda2af36b993247b78e7d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305378, "uuid": "c29a23fb-7b68-4329-8071-99961842636f", "value": "T1C2D42356A9D0A8A0D2613331C437CC94597838709E06777E83ADFA6F6C70393A9A7B1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305378, "uuid": "74aef9a1-36be-4e6b-a145-5e94ba7def7d", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305378, "uuid": "99801a19-4d44-463c-8eee-ad5e9f25cc5f", "value": "12288:qz7hU5I5yuNHIgzSFKxWltRohBfSTso93UOeeNaWrT25yEYkCy:qf+iN57Gtene377sx5ybo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305378, "uuid": "c6a46780-a1ea-4861-b086-179f0fe5871c", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305378, "uuid": "ba96c805-2ba8-400c-8821-25e112641f9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305378, "uuid": "968619c7-a5b9-411e-8b6e-e774e36bbc43", "value": "07fa3b53b7aaa614ed5e5858502e9aaa58662b16e62b60d77202a7de9ef761f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83339a3e-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770305820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305820, "uuid": "8889593f-932c-4975-ab53-a4ba6b01bcc7", "comment": "Malware payload (RemcosRAT)", "value": "5313301f3cf523f916fce2ffdbd49f8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305820, "uuid": "33b13f1d-2ba7-423b-b5f9-53be9bfa416a", "comment": "Malware payload (RemcosRAT)", "value": "081a30496d35fc471cd6e333bbf116f016fd3b9984a17f6d479dceb7c8ce0ca3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305820, "uuid": "891ffe6f-ae16-4213-9ec7-a01b387a66d7", "comment": "Malware payload (RemcosRAT)", "value": "eb039ce076634fae250d0d1161698b0e1032e58b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305820, "uuid": "9ef008e4-d5df-449b-9ad6-868395021f54", "comment": "Malware payload (RemcosRAT)", "value": "0b6990462070e683ac8c508b86ceee42acb838553903df5d4cfd6fae61e72e9d33b64072f53a1aa77b34000a2f92c414", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305820, "uuid": "43f787ab-1d6e-4ad6-9227-e102b07ed836", "value": "T1DAF412A87B0CC943C59587B40860E7B623F49EE9F514C3D68FEEADD774A1B443E18682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305820, "uuid": "bd39ad47-d300-44f7-962d-b4597627990b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305820, "uuid": "92440711-f103-47bf-a329-b0c4a924842d", "value": "12288:5239y7hq7WHujD2VWAiuBmRlEkC+AW/SMnAPfVjmpne/YFqhSbDgkgTKKQjkQjzA:m8ujDdnvrC+QMoftm9eaoulGKDPzHpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305820, "uuid": "98db5807-c6ac-4897-971d-71f2afcea914", "value": 767136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305820, "uuid": "fe05d21d-5204-4172-aa3d-2a6e9ef5137d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305820, "uuid": "8dcc1a48-639c-4f07-abbf-ef9e99fb142a", "value": "081a30496d35fc471cd6e333bbf116f016fd3b9984a17f6d479dceb7c8ce0ca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf39cc9-0271-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770282402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282402, "uuid": "22645889-7c02-40c6-a6f1-0723773ae08c", "comment": "Malware payload (AgentTesla)", "value": "b98492b822e093f0d8a442eb9df5e414", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282402, "uuid": "1ee48167-7dc4-4492-963b-c69e06200e48", "comment": "Malware payload (AgentTesla)", "value": "088897aff112ca0b12068dcb8f3aee3300d3ddc7ca8fe540692e8e3e201feb3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282402, "uuid": "4e9a1334-ed28-436d-8c02-6da569f6f212", "comment": "Malware payload (AgentTesla)", "value": "bdd42b1db4485f09ee3e630584fe253ba46b07ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282402, "uuid": "3cd940d3-85fd-41e6-afb1-b6dd574ac85f", "comment": "Malware payload (AgentTesla)", "value": "cc2aadca330a000f5f0423702ac98400372210d55cadc1b089f5bf11c35ab9483346b1aa88727cf498145dcfaf386c6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282402, "uuid": "ea755de0-3cfc-4b80-855c-16f236123e13", "value": "T102B42A30ED34016A0F9B2B9EFDD95A528CBD861D861751F5FADC034D62038ACE3BE619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282402, "uuid": "f24559ae-91ab-45ec-8b47-ecd8463ad644", "value": "6144:Pkkr3GHkkr3qkukkr3xkkr3Z2kkckkTkOkkr3G2kkr3GGkm6xkbkkr3Gkkkr3lk7:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770282402, "uuid": "98bc0605-3f1c-4e3a-aec9-745de9aeec3e", "value": 541524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770282402, "uuid": "7569d85c-b89c-4bf0-ae46-69f70f032cb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282402, "uuid": "a002543c-2fa0-4d79-8590-31f5fc6f0f20", "value": "IMG_20260502_73510.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cea5c18-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306507, "uuid": "4f7d0564-d3b0-440a-b94b-9b3a1bc7427a", "comment": "Malware payload", "value": "15eaa759787e41b4da9d8638d617d35a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306507, "uuid": "f759c916-b566-4f7f-aeef-fc1e3a1ad39b", "comment": "Malware payload", "value": "089e8cfc63b61fde5010b4f4b499e775a977c3b5015ad20679008bd13653d432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306507, "uuid": "afdeca09-316b-494e-bad5-9b3454f66994", "comment": "Malware payload", "value": "02e54b02db6170ef630f7cebd5b15eec5c2781d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306507, "uuid": "c3060baf-50e9-415c-b703-b8a72b85a545", "comment": "Malware payload", "value": "7a2ca02eb444c46bc28867b1f1adf18039afe59557cfbb6ffb46d93f6dc9f63a3550e91e33063b09ac49055a936241a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306507, "uuid": "5d81d076-667e-4937-8ad4-cebc490fe32f", "value": "T1BE55F10907E58598F4B9DB3493BA361543F0B11BD936EFAF938421F88D3679AA143363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306507, "uuid": "46c7121b-34ec-4ed6-a667-643d03db9829", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306507, "uuid": "f02f8421-75f0-4de8-bee2-8fc7322dcc1a", "value": "24576:61gtfMs1hsAdBen2pqp1pojZ6tm48YZ1KObIW+:ptfTfe9Oj94p3iW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306507, "uuid": "3375fd81-642d-40b5-abd5-331e444d3c57", "value": 1405440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306507, "uuid": "e4eb9abb-42da-41e8-a2b2-e164f153db31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306507, "uuid": "fd9a5e85-4335-4466-b3a3-cd773b947b2a", "value": "089e8cfc63b61fde5010b4f4b499e775a977c3b5015ad20679008bd13653d432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f361fd5-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306162, "uuid": "4d843ce4-8880-4d0f-b01e-ffca17529636", "comment": "Malware payload", "value": "34b041b5e60aa76603638df459a11707", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306162, "uuid": "996cb1d9-0794-405e-ad64-c6266d2d3405", "comment": "Malware payload", "value": "08ba7a2fa1a339544ca60c507e52687a04635937a22dd509b0906d203bd6645a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306162, "uuid": "a0fe0363-9c72-48fe-bd4c-5a6f379f272c", "comment": "Malware payload", "value": "107ec8c140248f91e425b8b9ccebd4b896256e13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306162, "uuid": "6fc0b553-9fa0-473b-84be-7c9d3a604569", "comment": "Malware payload", "value": "88b1d7035504beeb41ab6c7e449159fe240d2010fa9080b3b246d0a82f7bef74beef5a15ba06e53426e5be51da818dc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306162, "uuid": "7baa0eb2-6e44-45cf-bf3a-fa90bef5b2e9", "value": "T11294E716E660B126F98345703E78A25A38192D3A1E40DC0FFB8DAF6A36719C764F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306162, "uuid": "6acabaaf-4d5d-4ebd-987f-9a00e75f2a1f", "value": "943314f871ac891172c623d6761f5da0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306162, "uuid": "ab54aa53-afad-4606-bef0-fcbcc48b024a", "value": "12288:LJWgwflIzdAASRh9dpZDkOZ676kT4TzIKM:LgX9dpM6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306162, "uuid": "01929ff7-7aa6-4362-8fae-52b5fbb825eb", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306162, "uuid": "d9dce990-ccec-46fb-93d5-765105041dbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306162, "uuid": "539beddf-5311-43c5-8b2c-d3f28514d23f", "value": "08ba7a2fa1a339544ca60c507e52687a04635937a22dd509b0906d203bd6645a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d37940e-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770303233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303233, "uuid": "6f6f13db-187f-40e6-bd5e-3c07c9e071a7", "comment": "Malware payload (GCleaner)", "value": "1a37ff123c25fde56a76cb593f1b5d4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303233, "uuid": "4b6b1874-80cd-4d94-9a98-9d46a581db5d", "comment": "Malware payload (GCleaner)", "value": "08c194a8cad5bd90c4bd5e6a9409e475bfb73afbbe20689fd5329b6a0660d9f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303233, "uuid": "b80c0d68-33a3-4d87-8836-1d2b08775769", "comment": "Malware payload (GCleaner)", "value": "1b777d56bcc1b81b0444b458ad2a47d684136b4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303233, "uuid": "ee204a4d-ec4a-410f-8370-8d714b06387f", "comment": "Malware payload (GCleaner)", "value": "0e65ad0d33e4535711f88f313b7f7f399d284a97e4175eada98037ea05b67ddc56492c8ece0c5fa8bba8960398bdd3e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303233, "uuid": "ba893a47-c235-484b-a617-085a37a8cfa9", "value": "T16936E013CDB6CAE5C9175334BAA2DE1E0FAFB6C02C68216B37FD29CD95387941921235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303233, "uuid": "0a1e3f34-de52-445f-9202-4ad5833925ac", "value": "47a71adfa27f235be83d38d946a32453", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303233, "uuid": "c009f4fa-e805-41dc-acc1-9380bbe80611", "value": "49152:Z6fAUkBodZClDDTO8o8nn02CuPYU3ylmDJV9dOMuaBMogZTVchUBidjXq0i5M:Z68oelbYUYUO4ddO5aBM5TVcqBidj6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303233, "uuid": "adb62565-1933-4982-acbf-185c9084549b", "value": 5337360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303233, "uuid": "ad9e10b3-715c-43a2-a3a1-4e7a7af86d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303233, "uuid": "624461a4-2f80-44a2-b41f-627ad5cb2c78", "value": "08c194a8cad5bd90c4bd5e6a9409e475bfb73afbbe20689fd5329b6a0660d9f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2247ce12-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770307805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307805, "uuid": "95f76ea5-9a86-4c23-ac6d-3752657fd200", "comment": "Malware payload (Formbook)", "value": "f41bb4ae3540b6bdf589af358814224a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307805, "uuid": "1b32933f-da22-4a42-800b-21f4f6724243", "comment": "Malware payload (Formbook)", "value": "08d1b8b8c99de4e6a4d043d9004aa154088453361140525d5626d5bd9c9281a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307805, "uuid": "d041feb1-4550-4556-8232-91cdc0bd6adc", "comment": "Malware payload (Formbook)", "value": "9735ada4eb636cfab2b59d07848c7a630dfef679", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307805, "uuid": "7fb99634-0fc4-45e2-95ec-f1868028f783", "comment": "Malware payload (Formbook)", "value": "8c583cd3fb58465cb15e110dea422343e08a864ec057a310401cef1dcbdbdad49667d102b99dd228a5b2dd58a2848281", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307805, "uuid": "91e1fdfc-d4c4-48dd-85cb-d8be101bbeed", "value": "T11345CF0273D1D062FFAB92334B5AF6115ABC79260123E62F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307805, "uuid": "e189c216-0529-4c07-b596-deff91a75be1", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307805, "uuid": "07d62d69-c108-4095-b070-285bfb8e3c0c", "value": "24576:t5EmXFtKaL4/oFe5T9yyXYfP1ijXdaeGrH0T60D2YAiSvp:tPVt/LZeJbInQRaeeh42jiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307805, "uuid": "0e13904e-5eb3-480a-b8a8-f063fc798400", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307805, "uuid": "c4495bde-4140-4a69-a47c-734d0da824c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307805, "uuid": "5545bc0e-74ed-4d5f-aeed-6417f79e650c", "value": "08d1b8b8c99de4e6a4d043d9004aa154088453361140525d5626d5bd9c9281a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f01b4a-0264-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770276486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276486, "uuid": "49e43ae8-40d3-42b7-aca8-51f02f92266f", "comment": "Malware payload (Mirai)", "value": "ebb447980fae3a880a30f84087776b0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276486, "uuid": "4bf0997b-9be3-4703-a407-bb7de2e36819", "comment": "Malware payload (Mirai)", "value": "091f2e8fff8bc8d83ec45640aeb6e12491614b577224cfe1813c7cd8a3e19474", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276486, "uuid": "865caa7f-b243-4197-9346-36c2c7431973", "comment": "Malware payload (Mirai)", "value": "9d3ac1ff03eaae015ed9124081b2d156e536743f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276486, "uuid": "62a0b317-5ee4-46e3-81ae-3ada8fb85c8d", "comment": "Malware payload (Mirai)", "value": "51773c33440a6cb891f7860f994b5ed267003624f07aadfdd7f61dbbdcfbecebfd7038306a51474a3d4d2eeca148d27e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276486, "uuid": "75a570e9-871c-498b-a7b9-44c7575009d6", "value": "T13E0412696D10E9A6F3F92DB09CC015BBC8EADE7C477CCC945CA17692DA384FC205C994", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276486, "uuid": "abcfbc40-b099-4bb2-b023-72a8b6db1476", "value": "3072:CHkRgjKQSsXhcfuk2fZocFwQZQ7so+Fo2mPY37Hvv8qIlVpeMoN+P:KjKoXHXZrFwQZqmoY3bEqzMoMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770276486, "uuid": "68ac01a7-8957-434c-b7b4-69996ae2f133", "value": 175608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770276486, "uuid": "fcd92c97-c4c0-4f6b-bbbd-c8be8438fd40", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276486, "uuid": "6fd8a4b8-24fd-4b44-b8dd-66d58a640006", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8b46eb-02e8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770333213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333213, "uuid": "beaf371a-589c-4b89-8f98-2b8a7f22f47f", "comment": "Malware payload (Mirai)", "value": "b63983d9208ea0e23270a7bd61c8ca7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333213, "uuid": "a6358be4-0e19-4982-901c-e2ac3e668aed", "comment": "Malware payload (Mirai)", "value": "0926d0dab79ed200d0f18672c9e5d7c960da799e874b501792c3daaf4eae9010", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333213, "uuid": "68e03e7d-6f47-4c17-9474-084144179ebb", "comment": "Malware payload (Mirai)", "value": "1144f8e16063bdc8c8b7a8435bbbb1b545395567", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333213, "uuid": "9844b63f-e27f-4260-98e3-40de90483a04", "comment": "Malware payload (Mirai)", "value": "818c5585462c8b4aafdaaab0f41113c3ff39e207f6ceb721f46bb50661826dd303146e62f4b0988c5ee551fc7dc4dcbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333213, "uuid": "f4613112-2e58-449f-a54e-90b0e8d05703", "value": "T1D8D2E1B87B0249D7CFAEA1784DE50B262D618FB2F1426C077554D9C7BB058AC3CA5DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333213, "uuid": "88bf33b9-300c-4926-99a4-81a48cca4532", "value": "768:94ylAtv6pqLJM0RXaxGyUbXtheU/S33q92JgGlzDpbuR1J0:GMBqTRXa+Zhr/uVJuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770333213, "uuid": "edeb50aa-903e-4d50-adc4-12449a1af74c", "value": 28876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770333213, "uuid": "6b014683-00e9-4154-b9fa-33bb57c3e777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333213, "uuid": "e153765f-1348-4544-8ea4-816bb788ed6d", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f30fac-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770304029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304029, "uuid": "91eec770-10eb-4a31-912a-22fe17278e1b", "comment": "Malware payload (a310Logger)", "value": "2ec3ba4b875d4d81a8a152cc8e9e7d69", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304029, "uuid": "d3327f11-adb4-406b-80f4-144b3de43be5", "comment": "Malware payload (a310Logger)", "value": "0937e2e1e027827ce1b50f2c290236ae0e8cf604dddfcae4b2b57a5b6bdb2426", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304029, "uuid": "02d726ca-eadb-4207-8e94-bdb57fc0805e", "comment": "Malware payload (a310Logger)", "value": "316d8939ad1e259f996a18b58ba05819ca595022", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304029, "uuid": "62510a93-38e2-4246-b089-6c6965f54a0d", "comment": "Malware payload (a310Logger)", "value": "420714b98941f6c1498c2f4b3067a73fc22b725bc63105f0c3794190979f6c543f6dfc367366df3b440813014a98dcc6", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304029, "uuid": "c10bed27-7bc3-46c1-a7aa-e9cc3a8f2f08", "value": "T19DF423968982E951E2D577308435CCA005703871AE17A6AFC32EE67A7C743C3E95BF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304029, "uuid": "6fb59046-ccf9-40bf-ad06-e161998dfa85", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304029, "uuid": "68ab1a3f-0464-489c-a64e-2700640cf521", "value": "12288:Az7hU5I5yuNHIgzSFKxWltRohBfSTso93UVmcUgqk+ECaqZHlhZO6kXosFOUrA8N:Af+iN57Gtene3MURk+f9rZJmrAqp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304029, "uuid": "3366c20f-2a4b-4d1f-8dad-b7429832ce46", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304029, "uuid": "4a8ae39b-2951-4f5b-8db0-430b3a111e54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304029, "uuid": "a9129b27-2cbb-4994-baec-73b221148f38", "value": "0937e2e1e027827ce1b50f2c290236ae0e8cf604dddfcae4b2b57a5b6bdb2426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3304350d-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304826, "uuid": "f83bbfbe-7669-43af-b753-6098d1cac2c0", "comment": "Malware payload (AgentTesla)", "value": "7b9a8f1cf5251938c330ea07d5a0e692", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304826, "uuid": "e9d0c5b2-9485-4be0-89b3-7df90b649ad2", "comment": "Malware payload (AgentTesla)", "value": "094beb246dfa0cbfa619f1927cb7234d4085d4d1784e97bf17a9b1896d7dfe5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304826, "uuid": "5df793e4-17f4-4ad5-85b7-d8758cec208a", "comment": "Malware payload (AgentTesla)", "value": "decccbc58a8c3ef736891897d3a7d86e5bcf5d70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304826, "uuid": "a2190f9b-eb18-452c-9dec-853d10b78ed9", "comment": "Malware payload (AgentTesla)", "value": "a6d8f5c126dc57c497ff12f0aa974f532c8af3433713b98aea394e6a9a9716505c0c06fa979d04cf574bce49ca13f122", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304826, "uuid": "9b9a8cbb-2daa-4dea-a8c1-848a70a32c75", "value": "T196F412423764CC67D82F5371CDB38A6212B3EE9866F6621B33527B017DB3287591B24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304826, "uuid": "ac99a46d-fab6-4143-8fd2-732258e1ece4", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304826, "uuid": "68367ad6-1dcb-46f3-a869-6d275d972a12", "value": "12288:UlYZbhtBE4kAXWrlEaGrAFnaEM6tRonX5TSqIOQ:UlYZbhtBSAXWBEdrAAEM6DonXWOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304826, "uuid": "afd2a712-ea78-4432-a39a-52279bae0d73", "value": 755632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304826, "uuid": "63c5d0bd-7023-4117-b11f-9639f42675ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304826, "uuid": "e08378e8-e2e3-4b14-b031-95e66c0cbf7e", "value": "094beb246dfa0cbfa619f1927cb7234d4085d4d1784e97bf17a9b1896d7dfe5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313af63f-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770305253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305253, "uuid": "c4676147-8b36-41d5-b680-fd949ad4e5a8", "comment": "Malware payload (Formbook)", "value": "77e1a51112cc8fcc0f3ffab1c950b10c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305253, "uuid": "8b599906-0361-4ee6-920d-f2bc9ef6c25c", "comment": "Malware payload (Formbook)", "value": "097dc4aec7ed02e13875b9747b379156b142f7f80ed40a0798ce98f6dde5600f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305253, "uuid": "c028f27f-f581-4980-a3b2-0766e01d3099", "comment": "Malware payload (Formbook)", "value": "182f45708c00e5ab967e6450e266a71b75609912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305253, "uuid": "35b44a4c-1739-420a-88f4-68d98c7e2d00", "comment": "Malware payload (Formbook)", "value": "5741c5121795ab5518598d57e466ee61abeb8fc44ffba013488979943a4fe8172881d0056105d144cbea2a6b7ee4c6ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305253, "uuid": "1d70b439-258f-415f-860a-d9e14cc52c5d", "value": "T1ACF423928DC1A464C5406731C422CC984A3678727909663FC769FAB76C743A3EA77BCE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305253, "uuid": "6691ae1c-ce3b-4370-95d7-847daa907afa", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305253, "uuid": "5e64025f-eac2-49de-8cbb-84c03de52aac", "value": "12288:nz7hU5I5yuNHIgzSFKxWltRohBfSTso93URqq+cCcLtwwpaLaeEi5KcM3:nf+iN57Gtene3uNCcLtw/LTtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305253, "uuid": "eef9a3c8-dd95-420d-992f-dab5e411a784", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305253, "uuid": "0272d31c-49d9-4d2b-a7fe-441e875a3fbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305253, "uuid": "f3688112-c500-4d75-919c-db62d6bd3f74", "value": "097dc4aec7ed02e13875b9747b379156b142f7f80ed40a0798ce98f6dde5600f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e78fc7-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770303056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303056, "uuid": "1e4a5a27-6d81-4e6d-ba60-ad0e689d1f8c", "comment": "Malware payload", "value": "3c5bef45e401949ece26e971f8ce48a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303056, "uuid": "67fb8819-dfdc-4337-b89b-e7c3793543e4", "comment": "Malware payload", "value": "098c5d84384544c9685da40ca5145a0a59dfd466c1975a20f9a66d68d66d4696", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303056, "uuid": "db3d0f53-dd2b-49bc-ae38-97adf7ce334d", "comment": "Malware payload", "value": "9f75666bfeaf6540fb92d047831d98ed08ace471", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303056, "uuid": "e8fc6230-f309-4535-928b-e7a9606b3db6", "comment": "Malware payload", "value": "bdad27271ddff704894c93751a0c6daba3216ecc38b9ca3e249c99f8791f2569396fa04f8ed7d8fb19380bdcbdc5d9a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303056, "uuid": "f7160e51-5994-481c-9861-529a5c5c957c", "value": "T18FD484696FC32B55C19C4BB849ED631A62803F96569B093623D4CBD43543B3CFF9A8C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303056, "uuid": "d320fd20-f5f4-48df-86c1-3f69ec28df8d", "value": "6144:q7pRnZJF9T9+KntREmQ2HCs8HYOE8jdEIZXhmN1Zy5p+ryhM11N1KpmKE/ssP9mg:qXZJFJtREmnHA4O6Zyvh+4pjE/sS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303056, "uuid": "064312b6-0084-471f-9815-1b3925969559", "value": 640999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303056, "uuid": "a6234b4b-946a-4aaa-b5e3-236f910dbdb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303056, "uuid": "ee4f6477-0761-4d3d-8f8b-dfdb0339b312", "value": "bizy.mpsl64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f95666f-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770305358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305358, "uuid": "f87aeb7c-c4b4-4eb5-9fe6-599060dfc61e", "comment": "Malware payload (Formbook)", "value": "40d6d6e3afdccdea1df041e527d26976", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305358, "uuid": "6374d375-1562-47ce-bc9e-78d1c5753ca0", "comment": "Malware payload (Formbook)", "value": "09cd9b1d43d94a7ed055c5ca90f21a9fd88587fe04d781c12d1d3749929daae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305358, "uuid": "478f6504-911d-4b34-8833-b55f7f7bd46c", "comment": "Malware payload (Formbook)", "value": "e7cded7a12918481cc4a3e205ea6b9765e3911dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305358, "uuid": "084a00f0-f6ed-4e63-9548-2957899a4947", "comment": "Malware payload (Formbook)", "value": "0ee2942c67996cf918cf334272b5973fb58b34e40e21d6ac59a987e293950d8f1addfe25cd2dfb5ce1ebb27721713256", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305358, "uuid": "cf99e7af-5448-4f93-9d61-a2c71042dfdf", "value": "T13B35DF34EA7EF701C0227A74C826DAF25728FED89915C31A7FD4BE5FB831522176A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305358, "uuid": "d53c118b-57b3-40df-8394-bce921264624", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305358, "uuid": "ebac99d5-06e7-453d-949f-8bfba8b0396c", "value": "24576:Ds40Qs9DQm/bjK1oTW/+ypCUzhkxG5SKDrRv6kseWp:w40QODDnK1oaWnoixG5SKN6ksX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305358, "uuid": "15871da1-aad6-42b7-84c0-b2a34b8c62d1", "value": 1071616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305358, "uuid": "b48f2659-0971-4b9a-9589-d5ae558b0f02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305358, "uuid": "c1455559-4570-4e83-85a7-e0611e4e4d42", "value": "09cd9b1d43d94a7ed055c5ca90f21a9fd88587fe04d781c12d1d3749929daae4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd57f447-026c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770280201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280201, "uuid": "70a4c8b2-7b6b-48fe-b078-57d4b29078c0", "comment": "Malware payload", "value": "65b77cf768ac14ca86bd76e39412b588", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280201, "uuid": "680f5aff-e5dd-4103-8fea-fd708f1d1978", "comment": "Malware payload", "value": "0a08eb9584f6fa1594367d7fd8aa29fd173227458be4718d31ded9066af0c216", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280201, "uuid": "1c3b8033-fe68-4453-abd3-e1df24b64567", "comment": "Malware payload", "value": "d61b59bb48f2797a5d4d6b8cd10233406e29e998", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280201, "uuid": "a4781f4f-7274-4b53-8512-0902d6f16958", "comment": "Malware payload", "value": "5a2c84f87e489c7ea7bc7bcb68703fbc23dcb8e541e4f10b58ec3659cd3def1af6a6dc58d1842b5f0533d270794b0260", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280201, "uuid": "21c95b94-c8b4-46ea-8e85-9a44e3bd1482", "value": "T1D5261101CA52CDA5065C8115246A5EC726500EB78C44776A3F9F9F8E2F1FA4FA43A3FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280201, "uuid": "5bdb5cae-ebbb-4854-ab45-0653bd2e5c33", "value": "49152:CAohbIXn0fZfnSkyGjfjFvM5MCk5G8logTjdo3UDOqs82SbIG0uy42nCl:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280201, "uuid": "bed70aa0-cff8-4a21-b3ac-da17dfc9745b", "value": 4422561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280201, "uuid": "86858f02-8d8a-4668-b51f-d4bfb565ea93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280201, "uuid": "a8c888c7-ef2f-402d-8e88-b53abd828dee", "value": "FFF.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4686400-0262-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770275891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275891, "uuid": "1ae2a42e-1499-4949-9e57-a940e1a706ae", "comment": "Malware payload (Mirai)", "value": "04ad2fcc27c585fc670f13e361b0b57a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275891, "uuid": "3d081b5c-2db5-494c-9cd0-a00164648a0f", "comment": "Malware payload (Mirai)", "value": "0a2c5c89de3bf14a6486af7018fe53da2ec6e23ef3eef464908808d9d5f4f904", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275891, "uuid": "5a083d37-4bcb-4f75-a378-2b322f5e6a23", "comment": "Malware payload (Mirai)", "value": "3533e3b77558085523ef18a29f3a68a55d39e89b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275891, "uuid": "0b2e566f-3770-4940-a8fe-3da4092cfff5", "comment": "Malware payload (Mirai)", "value": "621f6479eb1de4679d1b1b361f3039a30502f70530b2a3135d23004981b64cba27b27ffd1aeb2d0bb02413db00cdb547", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275891, "uuid": "efe910fc-8f73-40d2-a205-15014afb3f55", "value": "T10CC312F6B2830CBBE23C5532105DBABBDA8FD31521911D617E02C833A9DD1B4692F879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275891, "uuid": "dd631ed4-e277-4757-a3b8-7bbc15d156f6", "value": "3072:wACISXtPM7HN7rl6L1w1vafJpOOTly2+B:3CdXCD6Zqv4UOGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770275891, "uuid": "a9d69b9b-8b98-4093-8943-a0ab98b97a1a", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770275891, "uuid": "dcf77ec6-9214-4951-bdb2-8cb669daca6a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275891, "uuid": "21f7de40-ce71-4fc1-8e06-39fec130e461", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec89128-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305732, "uuid": "3089bc52-9b07-461c-8466-be2ad2a54221", "comment": "Malware payload (AgentTesla)", "value": "03915986ef93bd93b467db39795c1afe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305732, "uuid": "d2e6541f-a455-4ced-9ff9-1503723860df", "comment": "Malware payload (AgentTesla)", "value": "0a6a06e56f2dbda37023903607bcf61523387a2593d700123f9adfa9a4cb7a40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305732, "uuid": "02b3060e-ebcb-4ab8-8c98-9d5486cb394a", "comment": "Malware payload (AgentTesla)", "value": "8247c86ae7dbc70a97e330cc8e2f9c2abf473104", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305732, "uuid": "a8417219-8156-4b9a-be23-8a3822ef058a", "comment": "Malware payload (AgentTesla)", "value": "6db4cad5621be7f2cd224ae3f6f2be2923dfbd149f71c526cf1088aa97cec22f2319dd026a0af6503090f148eaf3da15", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305732, "uuid": "eb8a67e1-51b4-430d-b064-84183ffb5b1d", "value": "T16D151259320AD90AD6A61BF80C71D3B14B396EA9B811D71BCFDABDDFF076B500900253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305732, "uuid": "8856c642-3e83-4841-b218-c9feae98310b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305732, "uuid": "e06ca171-41c6-41e3-9b5c-678cf87606dd", "value": "24576:Us40YiplPw56m/tPCJmgZR+xP8Qsk7AMR:/40YinPw5RVKJXZEN8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305732, "uuid": "f7da5ef6-6b7b-465b-be0a-c3efe6183759", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305732, "uuid": "cbd0767b-c42a-42fb-89fb-26a3843b4e9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305732, "uuid": "9fefffe8-901c-4aff-903e-e1cef85bd633", "value": "0a6a06e56f2dbda37023903607bcf61523387a2593d700123f9adfa9a4cb7a40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52839e21-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303591, "uuid": "13193a1b-de78-4cd6-a729-011507cd7020", "comment": "Malware payload (AgentTesla)", "value": "a0ecfa0ed0498d3c0092129a62763758", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303591, "uuid": "c45fc580-59c9-46da-9ae7-17f8211316e9", "comment": "Malware payload (AgentTesla)", "value": "0a795a84711a3124536313e95c9b23572203c90eac5ea6204295dd3563657848", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303591, "uuid": "a182a70a-7d85-4151-ac16-c2d28499aecf", "comment": "Malware payload (AgentTesla)", "value": "efe7301b1507aa7e70bd18b6a09f090ad410629c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303591, "uuid": "13a2ce88-b98f-4d93-bb00-60c8e4d63d43", "comment": "Malware payload (AgentTesla)", "value": "2f0085fcd0aab44509d64b0b93f277124776139d0238466e3fa40904eb208d2de289129b95e283c4b5d28ce34c8e7408", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303591, "uuid": "bb1672ba-4da8-4ea8-84af-006fba99f09e", "value": "T191C4229156C1AA91C550B370CC33CEA045B838B1CE16772D832AE66EBC713D7AE2775E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303591, "uuid": "adaa6da9-6a78-4c28-863e-713d5b48edd9", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303591, "uuid": "f8ba215c-63d0-4d41-8f5a-17fdeda309a2", "value": "12288:Jz7hU5I5yuNHIgzSFKxWltRohBfSTso93UY60mUnnfICy/rRi2mq+:Jf+iN57Gtene3KefHy/rRi2d+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303591, "uuid": "877ddca9-0429-4af8-99cd-82fec6b1782f", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303591, "uuid": "25b966f1-5249-4b2e-8e2f-e0bf9e7b2a19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303591, "uuid": "156ea314-e7d5-44c5-8286-63e50bf3e6d3", "value": "0a795a84711a3124536313e95c9b23572203c90eac5ea6204295dd3563657848", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81852944-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327292, "uuid": "646d0d82-fa76-42d1-9677-f7435fb1d7b0", "comment": "Malware payload (Mirai)", "value": "e2d6a1560508e01d1032ce7f29e7c5b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327292, "uuid": "9313c871-c786-4e42-be78-e41a241ce36f", "comment": "Malware payload (Mirai)", "value": "0abc2e2564391c64e5f98abfd5a7936f05548ed9558037b67b7c395f939a31e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327292, "uuid": "4d925af1-ae64-4e37-968b-6a386cd870f3", "comment": "Malware payload (Mirai)", "value": "92bcb2663922c5608f8c5273b3495a694ab1f4c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327292, "uuid": "3cc6f1e1-70ef-47ea-9e89-8b4dd1253783", "comment": "Malware payload (Mirai)", "value": "7af76260ba22be9322832463e3be2f252a1e81bb2d91cc22e841eb159be4aadf6c6401d7f40aa0f2fd0cebebda6c25c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327292, "uuid": "db9051c2-175c-48df-b64f-cea0ea594fd4", "value": "T130833A85FC819A12C6C5167BFB2E02CE372627A4E2DE3207DE15AF2237C661B0D7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327292, "uuid": "1c2549bf-d009-4e05-bb06-5fec4dccd0c4", "value": "1536:Q6rrCP7b4sgqoUlP4USR8sBh4hnAmVMAXjP2+iTavjt:Q6PCTbqNUhS74hnAsTbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327292, "uuid": "3799b15d-da86-4103-921e-fb2de0522504", "value": 87528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327292, "uuid": "225c9789-5935-4342-a375-95653b0b0cbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327292, "uuid": "0d2958b7-6720-4dc2-9974-6436c66531c5", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa20101-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770304114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304114, "uuid": "9627d0c3-41bf-4c89-82e9-8c044ff17a9e", "comment": "Malware payload (a310Logger)", "value": "d1260f6c84de6a0c6d7caa47ef4b321d", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304114, "uuid": "7fc68f64-7943-4295-a5f8-b5105dcbc1cc", "comment": "Malware payload (a310Logger)", "value": "0ae822a90eaf7160e1fb51cf94fdf6bced5acb72f2f1c1bc2ba220950f4b5289", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304114, "uuid": "7ad7c382-faf7-4e83-865c-bb9f09f3c7b0", "comment": "Malware payload (a310Logger)", "value": "40819d82339ea1e026a769ed17ba547ab54d9f3b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304114, "uuid": "1e56394a-c8c4-4fd6-9c23-ac2d44f9f7a8", "comment": "Malware payload (a310Logger)", "value": "f915843a357821e2b4cf2ba9e3082fb0bb9d009207d77b0fbdc5837cad199b96a9349926cf9449014c6675fc9bf350fb", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304114, "uuid": "40a8ef14-db2b-4f02-b182-4d626d76630c", "value": "T11F55CF0273C1D062FFABA5334B5AF6115BBC79260123A62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304114, "uuid": "804a1a18-f514-4aaf-8b43-7617ce1c8c75", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304114, "uuid": "314030e2-e8d7-4ed4-9b75-349c1e9e2bb0", "value": "24576:G5EmXFtKaL4/oFe5T9yyXYfP1MAXDz8cURk+f9rZJmrAqp2u:GPVt/LZeJbInGiz87vrZJmrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304114, "uuid": "19b49e35-e7c2-406d-803b-9221b25dd82c", "value": 1299968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304114, "uuid": "38cc66b2-36fb-4c0d-bc8b-aeb85bdac253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304114, "uuid": "c8aaeba5-7d52-4aaf-9294-7352642d34be", "value": "0937e2e1e027827ce1b50f2c290236ae0e8cf604dddfcae4b2b57a5b6bdb2426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c139415-0261-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770275179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275179, "uuid": "7e239242-d7d3-4e45-ad44-ca16a331167a", "comment": "Malware payload (Mirai)", "value": "1400676cb95b18d5430f910b9f96ae44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275179, "uuid": "210d48a6-3ac5-458c-84ce-7e70291c89c5", "comment": "Malware payload (Mirai)", "value": "0b4eb6f43bcfeeea1225c1f25af685c255d6df274d447513587f0ddce007496e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275179, "uuid": "1f0dcec1-2d1d-4c55-9e44-359fca476cd6", "comment": "Malware payload (Mirai)", "value": "4e733c935909eff698ae9f2634e27731da8cb1bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275179, "uuid": "cc833c2d-6863-4e30-8377-b4433075d0d9", "comment": "Malware payload (Mirai)", "value": "8529f326b61c12f5eb011f162de63528f4ec5a962632794c3ee8874247923616c4c313539ca68924a7b1644662f6db2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275179, "uuid": "5cb24a71-3ead-4c1e-9b3f-e19827746589", "value": "T1E8546C03FB81CDF2DA9701B2128AC7257670C531561AC806FB855A79FC2A649936F3BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275179, "uuid": "2b524d26-a5bd-4157-b2cf-d2e5fadc6f76", "value": "6144:pDjlONOjpLy8nmh+uDoPwmtuYctS8Rg+jQv2medI4W8O:5lONOtNmh+uDoPwogS8RlMv2medI4W8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770275179, "uuid": "7336a7f1-f7b0-4c65-afc9-b5a255ab37ba", "value": 302748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770275179, "uuid": "1a3b24d3-aeeb-4447-9f76-71bb8bd9f379", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275179, "uuid": "d83b8e0e-73dc-4516-833f-a4472b249f19", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cd3df4-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770303277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303277, "uuid": "ea4e6841-867e-46ac-b559-bb69700b425e", "comment": "Malware payload (GCleaner)", "value": "f0f2b3b0e64e02eca6bf0de056dba547", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303277, "uuid": "23b0da48-72ad-4134-9157-2151538ce1ad", "comment": "Malware payload (GCleaner)", "value": "0bce2a6af8683d11c09366b7435286b4a7108bc2ab9e9e79ae01172e0127a786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303277, "uuid": "c2dc9daf-5992-4f11-a0a5-e2ba75e5c439", "comment": "Malware payload (GCleaner)", "value": "7407cec998748c986c903a4b25daad9bceeb9497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303277, "uuid": "e98966ed-25bf-4db4-8974-25441727efbd", "comment": "Malware payload (GCleaner)", "value": "dc36b08afe74a484d31f5ebd18c2642c746d5253c52a0e741853482091ac25e01236bb733329f624fe5d27cad4c225f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303277, "uuid": "93ec6aa2-98ca-4c41-89f6-1de83c43c8ed", "value": "T11B35BECCF381D8A1E433E2F178AAEC50010D6D55AE25450DF55BFFED66BB24220A69CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303277, "uuid": "c728e1c7-afde-458f-b119-6ba826d2927a", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303277, "uuid": "ced2e90c-a689-47d0-84cd-b057034a257f", "value": "24576:WTA0vt+Phbdm1R+nbsej8JiBkY1/qRU+tpcJS/PYZd5bN3:MPvt+PyR+nXjRkei++t+JS/PYL5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303277, "uuid": "1fd3a444-89bb-4565-96f5-476f3dc27772", "value": 1069592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303277, "uuid": "1ad7433b-d91b-49d6-aedc-98dadf936f18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303277, "uuid": "31cb9cac-c67c-459c-87d0-2f4d32ce8d84", "value": "0bce2a6af8683d11c09366b7435286b4a7108bc2ab9e9e79ae01172e0127a786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9f7e37-026d-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770280306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280306, "uuid": "30d505d5-c454-463c-868b-c6c859baf43b", "comment": "Malware payload (XWorm)", "value": "fd53bdec5754200bb42972a1bc243e78", "object_relation": "md5", "Tag": [ { "name": "185-208-156-243", "colour": "#744C5E", "exportable": true, "hide_tag": false }, { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280306, "uuid": "d55a643e-1e53-4a26-9919-4bf5f5e50362", "comment": "Malware payload (XWorm)", "value": "0c0a32f550ab253b514075b72bcdf112667a818fb89729d6cc0814b8e370bb38", "object_relation": "sha256", "Tag": [ { "name": "185-208-156-243", "colour": "#744C5E", "exportable": true, "hide_tag": false }, { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280306, "uuid": "dfcd8037-3236-4a23-8f6b-663de4d9521e", "comment": "Malware payload (XWorm)", "value": "015398921c74408929b406475a83ece12164a20a", "object_relation": "sha1", "Tag": [ { "name": "185-208-156-243", "colour": "#744C5E", "exportable": true, "hide_tag": false }, { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280306, "uuid": "3e4c9290-5045-4486-8d27-dd00f4bcf87a", "comment": "Malware payload (XWorm)", "value": "65b2af750c27e533aa040774c16a6755b48d021abddca218d97fdab240a134e5cacbcb6e0b1fe57c12151958ad78f60f", "object_relation": "sha3-384", "Tag": [ { "name": "185-208-156-243", "colour": "#744C5E", "exportable": true, "hide_tag": false }, { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280306, "uuid": "b0777af4-dbb7-487f-bac5-fe2f69289dc7", "value": "T155941220CD0ACDA24628526538648D8656620E774D483724BFAEDF8C1FAFA5FD130BFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280306, "uuid": "29e0a217-716a-4b55-9416-46e187d8ed0c", "value": "6144:oIf2vAZICXiNEbXWnzcuuCNeLVH13EN1+nCgtWSoL0Dal/ldQGn:oIfYOSNkXWovLC1+CBJLKaBldP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280306, "uuid": "e7025ce2-1e7e-48ef-8bca-44036e2ebebd", "value": 443797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280306, "uuid": "408f0b0a-a29b-49bc-b4b1-ee37506ff210", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280306, "uuid": "25ddd4b1-d0ec-49c6-88e9-fee3f98e2f0f", "value": "EAZYYYYY.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec214dc-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304953, "uuid": "45267e69-732c-41b0-a017-c3f0fa624056", "comment": "Malware payload (AgentTesla)", "value": "cea340eafd9a83022d39f0bc0db7cbc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304953, "uuid": "4323a78a-1d41-480e-a8a2-e341e3c74574", "comment": "Malware payload (AgentTesla)", "value": "0c7a47180973a40c9f704dae07fd91d93f74b90e75a2c6e1cf22677eeb6e0251", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304953, "uuid": "4e31a954-fb7f-4ae2-ba9c-e32301445d44", "comment": "Malware payload (AgentTesla)", "value": "e3ac1b9a23aa4bc8a5fd8123c7ba297aeab94531", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304953, "uuid": "2c68afc7-5399-4c27-b530-424816567e48", "comment": "Malware payload (AgentTesla)", "value": "15ddb037ecf8d5a1b82c8592b4821bf3790c2496ea3e429b09cbdc8a867a1b343268bfce096f4fb0c3ac2dcb4e1cef10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304953, "uuid": "44fa1b73-6d8e-44df-8a9c-03e9d17cc635", "value": "T10FE4234337B5CC57CE3B06709C6B9A361BB3EF59A9E6A20B32517601BCB3943061A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304953, "uuid": "45f6d49c-9fbc-414f-b60f-c3d732835efa", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304953, "uuid": "c23e5cb7-aba4-414f-be94-279838b0e4d8", "value": "12288:iDzfL6s3vRunZV3GqKRoMHnee1CTQ21UwgX51vRRd8ghRe/RpQtZUaQ:inV5uDGyM+e1UQ21Ufrdbhga6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304953, "uuid": "f2086408-1658-43e8-bd42-308a93ecf164", "value": 720056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304953, "uuid": "805c089e-8a3b-4fa6-8333-e938d14d1ea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304953, "uuid": "a18cfee9-e627-4410-9add-a30a3ecb347d", "value": "0c7a47180973a40c9f704dae07fd91d93f74b90e75a2c6e1cf22677eeb6e0251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85998709-0271-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770282202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282202, "uuid": "a53d5a5f-88ed-4cad-b6c9-00eeec01397d", "comment": "Malware payload (Mirai)", "value": "704aba2cbfdb69dd851f9dca810c5766", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282202, "uuid": "4d1e27d3-b0ff-461e-8c0c-2ba5c4a29978", "comment": "Malware payload (Mirai)", "value": "0c7b14d6a447b60c57b289c4061540eb6f50b6c76d3fffd686771829fc956b69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282202, "uuid": "dd1aaba6-3203-42d7-a36b-69095f95d233", "comment": "Malware payload (Mirai)", "value": "6cad04e2e4afe9d813fa4dd54c46fb0818666cf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282202, "uuid": "bd947c75-7d43-4700-9e35-d0c5ecc2cf4b", "comment": "Malware payload (Mirai)", "value": "6ff67ca695be490d2fce2276c083ddcb953d1433c0ace73eed5ecfb906a8234fb72eee7560f342a268708a890699a6fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282202, "uuid": "a24db4a6-75e6-43d8-8e12-21cc5c7ee240", "value": "T168431891BC819A23C5D4137AF56E56CD372133E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282202, "uuid": "b82d31bf-3ded-44bc-8be5-2c280bec9e3a", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770282202, "uuid": "d81cbb55-edf2-430b-85de-e9dd110fd3a7", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770282202, "uuid": "7021d5f7-8b7d-43cf-8870-9dac2aacde6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282202, "uuid": "d136e4ba-0c96-4f22-96b4-8b9d99f7b120", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169d628e-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304349, "uuid": "15918238-d527-405c-870a-632ac8eff3c4", "comment": "Malware payload (AgentTesla)", "value": "1e41f8dd9683d21f88c047afca3392e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304349, "uuid": "5f397b4a-4589-4511-a02c-be906e34be14", "comment": "Malware payload (AgentTesla)", "value": "0ca4e2896859ee2bbd20d1cb46efc20b0f2c67aa58d7391579660698789aa855", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304349, "uuid": "cbca63bc-f85b-4770-83d0-09a77d1679bd", "comment": "Malware payload (AgentTesla)", "value": "f40b12051901cad222ecfd1215cc1efa8b171fc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304349, "uuid": "5856f5a6-46ae-4030-ae73-3ffafc8a0bf6", "comment": "Malware payload (AgentTesla)", "value": "6a4310c4d57572a3d0ef8f8d942423ca3f2507f31c2354eb3e2c64c5e86a277512e63191315fca2f08391d3645364d74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304349, "uuid": "7091aea2-01fa-4baa-8015-64c8a9821910", "value": "T1C515129462A5D602E8B19BF81A32E2700B787EDF7911D31F5FE9BCDB34A2B154C14263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304349, "uuid": "cb4d675b-3286-4456-b766-d7509ace5091", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304349, "uuid": "54f97947-10c1-42bb-8e87-a16856e22522", "value": "24576:HPbi4NqCyNlEys5E2XvKreRHpif9K++Yrt:HfNR3rOBxf9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304349, "uuid": "266f237e-55b5-435e-a44c-8db6bb54e856", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304349, "uuid": "2f6fdb5f-1fff-4247-983e-65aa453f820f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304349, "uuid": "c522b90e-5403-4320-9374-32b0a6d595b6", "value": "0ca4e2896859ee2bbd20d1cb46efc20b0f2c67aa58d7391579660698789aa855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367472b5-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770306550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306550, "uuid": "867c1aba-f536-40e4-bf6c-8785d3c5a41b", "comment": "Malware payload (PhantomStealer)", "value": "00a3c14d0a5dccd236558057731f54fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306550, "uuid": "471364c0-6319-43a8-811d-54c958c77bdb", "comment": "Malware payload (PhantomStealer)", "value": "0ccbf7714945cf60d24b6fc417160c6b188bb39cc14537e41063076c7fb28518", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306550, "uuid": "bbd7654d-26ff-424f-98d7-aeb58b505b55", "comment": "Malware payload (PhantomStealer)", "value": "429bbfea70442b7caeb4bee47b619b08a36ac143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306550, "uuid": "f89afff8-68a1-48db-b9eb-3571c4da1f04", "comment": "Malware payload (PhantomStealer)", "value": "c770c6a978d39f020325ac2aea2545ec664bbcc0faeabb0b29246687e64aa2ba6079ed4daec74a91b380325ba2c92b98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306550, "uuid": "a8e62224-021c-406f-b21c-be5baa24d844", "value": "T1FE85E0027391C062FFAB92334B5AF6115BBC79260123A62F13981D79FE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306550, "uuid": "70dc7a99-0193-49e1-bcf4-287e4aeeb353", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306550, "uuid": "754cf71c-15b7-4cc0-a1fc-bcc2d9ec0984", "value": "49152:APVt/LZeJbInQRa6AILU0oq1K1YRKULH5TFB:+TYbInQIILU0v1KuRKULH5TF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306550, "uuid": "c64cbb77-2c77-4550-8492-90eb0214c43e", "value": 1718272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306550, "uuid": "8f4a594b-d2f8-4d67-8252-bc35e65be6ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306550, "uuid": "7f81dd5d-24ca-4862-98d5-6f17bd8e1326", "value": "0ccbf7714945cf60d24b6fc417160c6b188bb39cc14537e41063076c7fb28518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3aa38c-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305942, "uuid": "a0d780e0-8da2-4ca2-b0f0-7d6460dfc3c6", "comment": "Malware payload", "value": "62298c6fec9a944de4d3a57dfeb86b4a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305942, "uuid": "f5674ca0-04d2-4729-9ac1-828a99998a61", "comment": "Malware payload", "value": "0cddf047584dcb308d5cea01194b95931a48946cbc9e9b8ca31b25223bd1823a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305942, "uuid": "a239b5d1-d161-4d9f-9642-3bd6a2d23811", "comment": "Malware payload", "value": "9be352b6d8a3614c04d64a4b40847a383af77d2b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305942, "uuid": "5a874b2e-0f0c-443c-a53f-46eb0dbf81c2", "comment": "Malware payload", "value": "41b49d3ebfb33352fba13970d4f932865e0ae090168e0d27d608bfcd8811c86c5906a2a4e7a01ef13070c8618fd70c98", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305942, "uuid": "e04bb257-7572-48b0-8d9b-a201e75b08de", "value": "T12796F8736301B4B23A2B2B6D117654809D077C03748DE658FACA72B5B1EDD83E735AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305942, "uuid": "3710ee2f-d448-43c4-a708-dd887c753bc4", "value": "98304:gv42n7st7Pl/bC7Bi88xmDY0S4+Vb7tpxJy8P/X754UvxMh7NZgwhwqn:m7ul/bC7Bdz7N+Vb7t3P/X754UI7Qwag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305942, "uuid": "3c51fea7-52d9-4103-b1ad-5046487c3ae1", "value": 8626982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305942, "uuid": "e821e3c0-4a91-42d2-b6c9-11ddce8da657", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305942, "uuid": "d84619fc-a89a-4cfe-8028-10e43be7c416", "value": "download-the-latest-acrobat-free-pdf-pro-version-download.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2fb731-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770306746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306746, "uuid": "41d62874-7fb4-40b5-8ac3-bb7dea600581", "comment": "Malware payload (GCleaner)", "value": "399cfc87ef308a83f35571523c4c5e19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306746, "uuid": "1551a179-3396-496b-9e24-cee3b63b0630", "comment": "Malware payload (GCleaner)", "value": "0df58ccaf1f893c00965a2df0d48d628d411ef4b894f9498b68b46ea374b1ed1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306746, "uuid": "7c7efa31-80f9-4f01-8c55-bf11c1fd7d17", "comment": "Malware payload (GCleaner)", "value": "ceb968b05826ffc1a66c679dc54bd58b32670554", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306746, "uuid": "5988f4d7-9b1c-4be6-8935-a545087959be", "comment": "Malware payload (GCleaner)", "value": "41758bfc15c8975bd960665ae5dfd0ad7a17b8dc9994aaefd5dae8158024daa82413c151fb582596e5d2abffd9d655c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306746, "uuid": "552ef394-ef1d-416b-8d06-eee8f2236b95", "value": "T19226E0E0C123C176D5B367348D6642D4AC346EF4E52D37D81AFEA8CACBE1ED0662419E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306746, "uuid": "e7077d6b-4ddc-4240-9593-2f4a63971773", "value": "9076f23e9ae799dc4881fd0cc23a343f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306746, "uuid": "e93b7b38-46f5-4299-84e0-9201c9454606", "value": "98304:gJtP8ZWr3pUU0zEXzWar/t08vKbP82AZo:IB8ZWr5r0ATLNSLNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306746, "uuid": "dafd1571-6f8f-4813-b279-3c380d1edf4e", "value": 4786688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306746, "uuid": "302639a5-5312-48df-9fb2-311b9f8825a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306746, "uuid": "c5537849-d70a-4ffb-a106-165154f81aa7", "value": "0df58ccaf1f893c00965a2df0d48d628d411ef4b894f9498b68b46ea374b1ed1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc90cd5-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327208, "uuid": "0782c655-84eb-4b59-ade9-729243f149e4", "comment": "Malware payload (Mirai)", "value": "7714e81238137fdff7be5c964985e4c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327208, "uuid": "25d139af-005f-4854-b1b5-bad4cef9ada5", "comment": "Malware payload (Mirai)", "value": "0e0d054d52030ecc9a7e8e76d6cf83c94e460995fc100cce62ab047be248a10c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327208, "uuid": "1f296451-c56b-4f7c-b70b-76ccfae06f76", "comment": "Malware payload (Mirai)", "value": "be1abc7803764661b9095beeb8717840ee01b029", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327208, "uuid": "e97ce586-5a0e-4211-833d-b4a76188ea09", "comment": "Malware payload (Mirai)", "value": "62261909b3cfc0442823f49e0cda5ef40166d88648fda12b13b6a89e2b590103159b33fba790260f6419533d74b17200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327208, "uuid": "66e967f8-245e-4df7-9df6-84b692cf1af8", "value": "T1A6739E23C8291D98C69C46F8B5649E3B5363D96056D72FF21AABCA36D003EDCF5093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327208, "uuid": "90c160da-32cc-4c8d-b16d-2d4c4885f1dd", "value": "1536:a/kwSgMCnT8o8i60BfOKmCxZ7zp4ZgCtb9XI4G:aMwSrQI5i60xhmmR4ZgsZ5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327208, "uuid": "fd67091f-da4f-42d0-abf3-0f3120733c55", "value": 75296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327208, "uuid": "3a8542f8-d285-415c-8055-8eb55e991bd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327208, "uuid": "fcfa1e66-62b3-4c6f-80d3-be444b23bb52", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb0132b-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770307020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307020, "uuid": "c33312b9-625c-4a06-9b4c-300d907f42d0", "comment": "Malware payload (GuLoader)", "value": "93560008d2c889952cdd8dcec762ef2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307020, "uuid": "ac78cdc2-1bc8-4eb3-895b-3fa87d66b34b", "comment": "Malware payload (GuLoader)", "value": "0e0e8a78f37b87b6343a3946c1c3d3a702d58492f18962f36aef116c9c5607ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307020, "uuid": "d4a369f3-154b-47a6-b7fa-5becd83da395", "comment": "Malware payload (GuLoader)", "value": "2e4fbccf044c5e003b7430fe094aef9a9aae2e5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307020, "uuid": "f66b48a8-e951-49ab-9fd4-ecebd8dd9aff", "comment": "Malware payload (GuLoader)", "value": "4008ef2273cb761b11f7c67d715caa00238673ca79457ce429b9e186eb5096acb983dbeb29d6c6e695729d57672e6d0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307020, "uuid": "35c534a5-edd6-41fe-8169-6299021b88fd", "value": "T1A394BFBDFE18E4D1D41A42743436AC35FA19DF16A4B8422EB9F9731919322CB642BD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307020, "uuid": "a5f8e223-64d1-44dd-8818-97628ec27473", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307020, "uuid": "bcb05cef-486f-4e3e-9c9d-58ccc9e815c1", "value": "6144:x8Mm4CCOkXvVPZCvwrid11lVnJsp+F0qhCEbXKO0Own3eVGcGyNDHVsETNJrPZ2:x8Mwtn9RnJRF0qhxLBmSHNDZNJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307020, "uuid": "c928f946-c81c-4ac5-8e9b-5be1dd526108", "value": 447760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307020, "uuid": "3cf3b8af-3033-4d12-959e-aba5c2343182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307020, "uuid": "7d4de3bd-5f51-4448-8957-02c28947c5bb", "value": "0e0e8a78f37b87b6343a3946c1c3d3a702d58492f18962f36aef116c9c5607ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285dc03c-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770305238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305238, "uuid": "7f086d35-06d2-4240-bd00-48d90e279a20", "comment": "Malware payload (SnakeKeylogger)", "value": "c22e015dc60dcb8accb6252bca1c44d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305238, "uuid": "bee30129-60f0-4ffe-af5f-b8dd6fed2b3b", "comment": "Malware payload (SnakeKeylogger)", "value": "0e1ea2bee6ebd3ca2bbcaa814faaddf1d6dc53bf81e2695a609a8f45ceffda9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305238, "uuid": "12608539-a1db-41c0-a453-7beec90a4001", "comment": "Malware payload (SnakeKeylogger)", "value": "271b585e8c2c8da6b4f3620064699e684743504f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305238, "uuid": "5b33ba30-711f-490f-ad4c-75ee30754299", "comment": "Malware payload (SnakeKeylogger)", "value": "9fc4961d9529c7a61562b3eaf9330c80a3d25edf5476b802e093918d26c71c9b71d12cf52fb86963b41855f874b30fb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305238, "uuid": "6e4a4f63-9606-4224-a3a5-f3f8ce1e2d37", "value": "T177451204279CCA40D89257F00AB0E7762BF5AE9EB821C71B0EFE7DEB34617A55844787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305238, "uuid": "5bc00193-98d0-42cf-b6f9-948319a4e586", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305238, "uuid": "ff2569c1-e380-43a6-bd7e-b8d5cfa0f094", "value": "24576:G1WL0pduhnIuEXYphVUVAir/X2jAA33Ea49dV4cNbLE9pJyoQXcx:GhpEIuTi/mjNnOv4ebQ9ycx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305238, "uuid": "933c0474-b7c4-4b7f-b2d7-c3e00ce48860", "value": 1252872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305238, "uuid": "ebbf734a-ab53-4d4c-9735-22dd9cc95ee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305238, "uuid": "8f8a8a2f-a861-4ce5-9d90-ad08fa91d97a", "value": "0e1ea2bee6ebd3ca2bbcaa814faaddf1d6dc53bf81e2695a609a8f45ceffda9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbec5d78-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305593, "uuid": "dfbce70c-a0cd-4a9f-a598-77c877f1b7a0", "comment": "Malware payload (AgentTesla)", "value": "851d8d9cfb1036218c98a87a63864471", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305593, "uuid": "119539cf-793c-468a-863b-2ab25b7a64fb", "comment": "Malware payload (AgentTesla)", "value": "0e7748b165d5f1c07358bc019822d04ec982afaaa3041b9eadea63c3e2ed0eee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305593, "uuid": "b5be8c61-37d0-421d-ab09-5752abe36156", "comment": "Malware payload (AgentTesla)", "value": "61e65454f98facc562d0de7f083275cf57426370", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305593, "uuid": "38241ed5-1db5-4ae4-9419-8897c8c88557", "comment": "Malware payload (AgentTesla)", "value": "10dfdac285610a8453b87e6a6400161e9c291592a283760b680dc5acde577979f370fbbb275964166477a98ae570c595", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305593, "uuid": "d89ddffd-0f03-476b-bfa2-ddde72dcfd4a", "value": "T175D4129199C06951C29563308036CDA0997C7C719E16B62BC77EE5AFBC303C3EEA6B1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305593, "uuid": "9933f097-363c-450e-bca4-358256c8523c", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305593, "uuid": "1babc5cb-96ad-41cb-b086-0b56d2b1a05a", "value": "12288:iz7hU5I5yuNHIgzSFKxWltRohBfSTso93UDgEY2+jRzreEUz+S56tj0O:if+iN57Gtene31MIm6S9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305593, "uuid": "c6866a55-2c24-4352-8d41-e4527963eba8", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305593, "uuid": "23b93e09-3bea-4e3f-8997-6115a69c1a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305593, "uuid": "2a6da16a-9365-4729-acd6-0852fe314b20", "value": "0e7748b165d5f1c07358bc019822d04ec982afaaa3041b9eadea63c3e2ed0eee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd538144-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307743, "uuid": "a6394f10-06c8-472b-b653-4b9a14e3e70e", "comment": "Malware payload", "value": "e8d33df93b77c9d5731ec5ebc288aebc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307743, "uuid": "a072f95f-91ac-436c-9813-7b2aecac530f", "comment": "Malware payload", "value": "0eb7dfc1582f6c1c125caa0180cee99060eb90d679ea0a7a50f331bf1b880701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307743, "uuid": "635ebcc0-e319-42fd-b828-281b6668462b", "comment": "Malware payload", "value": "72c6cec20ac8552394e54e5ae100f677d129aa17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307743, "uuid": "6e1bc014-db05-4094-9dfe-49cc81be6d84", "comment": "Malware payload", "value": "efcd75a2a583ee0a4a1dc60bae2ad61e71e7af3d6875ceab3ceb6c68ebf275cb2e02597b32b982a6d993072745b4f3b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307743, "uuid": "b9b08141-71a1-4e59-b132-6867dbd40928", "value": "T104940716DA60B4A5E8A349703D79A256782D3E3A2540EC0BB78DDF5637B1993B0F430F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307743, "uuid": "877d0a5e-6e9d-4c6a-998b-58ecb95f35e2", "value": "09902aabd1d4575ff7b0915cef45d7c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307743, "uuid": "dc32b68b-ba30-424d-b07f-f99b8aadd2c9", "value": "12288:+KKhR2XiisOmbBA0epfa+8OeBM5Jj6MxvqBJLizJQypO/erjwIXRHedV5arjuA3b:QhRReNJbGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307743, "uuid": "0a9d50e8-bd5b-4cf1-8c7e-99dcc827f6e4", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307743, "uuid": "d8ea8253-f8f5-4017-861b-f2448669e6c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307743, "uuid": "aea8b4e2-aa10-4dde-a791-436be7183e0f", "value": "0eb7dfc1582f6c1c125caa0180cee99060eb90d679ea0a7a50f331bf1b880701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b571b9-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327222, "uuid": "9d0aa831-07fb-4962-b19e-7722c4af5afc", "comment": "Malware payload (Mirai)", "value": "e445bfba6b40744b13e9f4778a048637", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327222, "uuid": "e4db349b-cd76-46a9-b5f1-48bf5f4193b0", "comment": "Malware payload (Mirai)", "value": "0ec8ee4979dac7d4b8748241fb8927a5b50d998a260adf4d60aac943e7829abf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327222, "uuid": "257a3620-4e2e-48b7-a4b4-b64ec261c8a8", "comment": "Malware payload (Mirai)", "value": "988e856edae6475f215b3bd6ea1ffe12b309a3d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327222, "uuid": "18805446-ee93-4f05-9827-71ced71a3939", "comment": "Malware payload (Mirai)", "value": "6ff18d2848f387db200e681093c50ebe57b5de55e25fed141c1554a19af3066759a0aea46958062cbaa77b8a7d2ece53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327222, "uuid": "dc4d7f16-9165-4e8f-84fd-8ea9e74cd7f5", "value": "T17903F190D387EED7D7BB3DB1140AC3D5EF2107EE25A60D4232AAB2022F019126345FA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327222, "uuid": "5a556468-1ce4-4fff-9229-31a903112ae2", "value": "768:QDq/l2Nf5oKMUi38qrgx3An1vzZiGS4EJryJTOtk4uVcqgw09s:QDqNu5onMro17ZiGS4EJr0ik4u+qgw0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327222, "uuid": "3bea4db4-2725-47ba-8f8e-b44435705223", "value": 38200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327222, "uuid": "95b3b490-9561-41b4-af89-f113f706c1e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327222, "uuid": "47d68d2a-171c-4150-a476-994e7eb41b62", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88225ae8-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770307546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307546, "uuid": "36d61160-4d2f-4f8c-a8d4-9cbe25bf3985", "comment": "Malware payload (SnakeKeylogger)", "value": "4e98cc94e245646cbd84ea2782e1ca62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307546, "uuid": "a01394dc-0747-4340-b172-162c02cbcdf3", "comment": "Malware payload (SnakeKeylogger)", "value": "0efa2634bd9897ab590e1a79e423ec78c1ff0be81aeda65c821a5054d1ef40c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307546, "uuid": "df650e01-8266-4b3b-b4b9-1011c08e9949", "comment": "Malware payload (SnakeKeylogger)", "value": "55f365dc9aa162d2bd26ba473956d9f7b7c66c1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307546, "uuid": "830392d1-e398-4778-b4a4-7e3c8cbaad64", "comment": "Malware payload (SnakeKeylogger)", "value": "88099968764fa66b2144477368e95f3d7ba51d1686a9fc772b3c79b78723c521be6d958e53d9144cb45042cdb0ec5908", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307546, "uuid": "f14b1d39-ad13-40d0-b56b-489dfeab937f", "value": "T1A90612027391C032FFAB96334B96F6115BBC79664123A61F13981DBAB9701B1473E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307546, "uuid": "68c34cfe-304e-4b07-b77d-b9174888f7da", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307546, "uuid": "911cb2f4-1565-4b02-ad8e-c201f9006338", "value": "49152:NPVt/LZeJbInQRaD9FPCzumKRJCBPu2cumaDRluwbChwzRBwIUITsQClcKu9nfZi:lTYbInQOFqy9/CBDn53s1cKu9nxmuuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307546, "uuid": "8614656a-b994-47ec-93d3-7ab62ba04ba6", "value": 3745792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307546, "uuid": "9bf881f5-3b08-4dd4-bc47-e61f071ddba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307546, "uuid": "33ad32b3-c95e-4c65-b1ab-ca8b271247c1", "value": "0efa2634bd9897ab590e1a79e423ec78c1ff0be81aeda65c821a5054d1ef40c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fc5438-026a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770279353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279353, "uuid": "df341113-77ec-425e-afdb-943242273281", "comment": "Malware payload", "value": "327fc35957b037b56e306913267c768e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279353, "uuid": "dedecb03-e598-4ea4-9964-86b65558859a", "comment": "Malware payload", "value": "0f6e85b70eded366fdb46964f7f4d35b8c2f7835bd8247de47bb757c01634cbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279353, "uuid": "ab401f76-c7e9-4358-b2e4-a489e4fb115e", "comment": "Malware payload", "value": "4de410baf703939d33706a5a2132293fcd436c8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279353, "uuid": "6145603d-18cb-4542-a710-ee348459d223", "comment": "Malware payload", "value": "ee2fcc89837f60da3538bcbbf71a3f8c2d6196b0ca3bb6cca6900bef888732130011ab56c56546e8559fe3457d988a5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279353, "uuid": "55a8e754-14c9-4938-a9b9-2e11d24b66d8", "value": "T1C1F4F97F5962913ADA8A80FC255947625971B33B03B41FF301669130271BAB2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279353, "uuid": "e9b49872-8726-4d57-ab00-afebb379e019", "value": "12288:n8HmItRFFHxLc1BAMjPdKoI8asoPs3gF949tE17jDDmqtn1nWk:nmmA9hMjPFPgKtMnDb1nWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770279353, "uuid": "13721e19-ff21-4121-a37e-cd86f7e87e2c", "value": 733299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770279353, "uuid": "44bfafde-613c-4892-842d-680967c31863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279353, "uuid": "0603b47a-44f8-4bd4-b022-16414c1f5d73", "value": "cahalu.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d92f3b-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305392, "uuid": "d258aa6d-27cd-4746-8b26-6751ccdfa9ed", "comment": "Malware payload (AgentTesla)", "value": "7fd0960338971ae0fae230db52c43f07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305392, "uuid": "c4d79a6f-1316-4b41-a8c4-5d69181c6599", "comment": "Malware payload (AgentTesla)", "value": "0ff209e9b8f4d38bf80c68879b414775ab28bc151aced58d2c6c4de220e313ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305392, "uuid": "9e4a20e5-bf34-4204-9570-a814bc4ccc92", "comment": "Malware payload (AgentTesla)", "value": "10aed10d72e763e4d0d59cacebf48cd6f5be9d0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305392, "uuid": "f053f9da-4b26-4ea5-9b46-e069531c141a", "comment": "Malware payload (AgentTesla)", "value": "fb55eae52277fc1db7642883f01d1e985b2d54d75d77b6a0776633e93ae3da765c273e0eafb9ab34a62286fdc456de55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305392, "uuid": "63ec22a7-0afd-4616-b774-eafa892f9cad", "value": "T11D35CF70EA3EFB05C4227AB1C829D6F21724FED95805C20A7FD57E6FB9322520736646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305392, "uuid": "eea62cec-0768-4a9c-8a6e-4090911de680", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305392, "uuid": "d3de1013-a2b4-4418-8f9b-077524e2a0e5", "value": "24576:Ss40j+cc2/b1cD8GxSuo0S18YDxPl0AVEhrPJi:d40jt/bgTSuoMYDLpExPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305392, "uuid": "73ecb5bf-1933-4d23-a1a0-66be49f332cd", "value": 1096200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305392, "uuid": "b17a050a-5448-412c-8cd8-00155c859f29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305392, "uuid": "b4a0707a-0b78-4d9a-b598-894b3dc696b2", "value": "0ff209e9b8f4d38bf80c68879b414775ab28bc151aced58d2c6c4de220e313ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0011c9-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770306395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306395, "uuid": "b3f86545-e159-40d7-b246-06d3cd36ac63", "comment": "Malware payload (RemcosRAT)", "value": "a71df36971d9b3d37b323e9247537331", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306395, "uuid": "f96ab3b7-f423-44a4-9d0a-b7cc8bab7692", "comment": "Malware payload (RemcosRAT)", "value": "0ffe0aad8f03e9194dbea8811fd4d28f850463ebe93ede56f193e32283203ff7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306395, "uuid": "21f7de59-2d80-47c5-98d3-2e1296dc4dc3", "comment": "Malware payload (RemcosRAT)", "value": "e352c00618876fd227331dba953915a70489c1c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306395, "uuid": "4f4ea717-666d-4c99-b70b-8fb50cbc706a", "comment": "Malware payload (RemcosRAT)", "value": "2b1269af63b1e54a947292e20799fcc358f1993f601d3fce7d238a1b835f8f9febac833a8208acdf8c75c64891c85324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306395, "uuid": "cad0a462-1d72-4e4b-9569-bb02810e075a", "value": "T17165CF0273C18066FFAB91734B56F6125BBC79260123E62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306395, "uuid": "ce8c8694-ab94-4977-95f4-fe5168aacc86", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306395, "uuid": "0419edb5-6f34-43da-9e01-9ff72139f0a5", "value": "24576:v5EmXFtKaL4/oFe5T9yyXYfP1ijXdarlLK26jp2RY5LiXFuyZj3Oag9O5ckJwPM:vPVt/LZeJbInQRarlLT6jwoYVO/Mdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306395, "uuid": "f1678608-685b-45e9-aee6-d7a9fa466ca4", "value": 1440256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306395, "uuid": "1eea7ed0-e3bb-4525-a42f-2e651af10593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306395, "uuid": "eb5e89ae-5bc0-43f9-b6f2-8c363d90a20b", "value": "0ffe0aad8f03e9194dbea8811fd4d28f850463ebe93ede56f193e32283203ff7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ff5ebf-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305093, "uuid": "2dc910b0-7bfc-43df-a9ee-dbea6ece8eef", "comment": "Malware payload (AgentTesla)", "value": "1b852653fd6000dbb87608cb4a72b3ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305093, "uuid": "a0fea4b0-8205-4a41-b618-e0e0551089ff", "comment": "Malware payload (AgentTesla)", "value": "102b27de67452f77077070719d446c9e7565afd5bdaee828017e15dbb19b9be3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305093, "uuid": "69891e3a-bb13-4e5a-b8e3-c77df131e330", "comment": "Malware payload (AgentTesla)", "value": "55439f6cb3f970615524268f92c1f0228f8b81ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305093, "uuid": "93e6ff40-ad0c-445b-86ba-eb00906becf9", "comment": "Malware payload (AgentTesla)", "value": "b64b4cec2e03a2fb51d5ab4ef487c1bc0d53db59f0ac782c5ac7a520fb3dd2bdf1761dd8493f0bed2e02a63d175cd6d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305093, "uuid": "cb278a27-eeaf-44b2-8e22-1de55bee5e98", "value": "T19DE41282767C8957CD2B0372DC7ACB2216B6EF4946E8634B72813E14BC73497482F75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305093, "uuid": "6aa1e458-5abd-4294-80fc-de27605a4e40", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305093, "uuid": "40f99fa4-4332-4566-b2b4-c4d054934fbd", "value": "12288:v8fOOrxMi/pTicjD+CYBfvgicpcJp0Nofj:v0rreiZ+lAIoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305093, "uuid": "b7a1a695-17fc-4ded-afb3-648d2e88e770", "value": 678552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305093, "uuid": "ee470940-7bad-4034-8d24-72fa5d345af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305093, "uuid": "1fdd8b5a-b70e-42a0-9b48-276e591eef8c", "value": "102b27de67452f77077070719d446c9e7565afd5bdaee828017e15dbb19b9be3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ff5467-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770308017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308017, "uuid": "ede3fe73-9a61-4325-b051-00e8f9a127e9", "comment": "Malware payload (GCleaner)", "value": "400066640c36be4f2ffa606ca4e12b0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308017, "uuid": "4a0193dd-81f8-4519-95b7-e931b532d1d4", "comment": "Malware payload (GCleaner)", "value": "1055cf736aa64549bf3b9ba1f50362f5cc8ca3adc7c9ca05644e0b7bd414c47f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308017, "uuid": "7f248fd9-af76-434f-a175-e8d793668d60", "comment": "Malware payload (GCleaner)", "value": "2404f2e9767269066dfa344b94612dbaeffcb298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308017, "uuid": "19d2eda4-9716-4210-bd44-c0b1add318a9", "comment": "Malware payload (GCleaner)", "value": "df85228084be7f20224ed32788eb39b7c6890f72fbdafa56e4803f7e7dfdeaaf22baea737f1577e5e1e75bef9dd49709", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308017, "uuid": "dd11ffb7-b832-4909-a9d0-0c2402f1ff27", "value": "T197058E32F6B18037E0271B789CEBA66C5436FE112938A94A37E93ECC5B763417416787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308017, "uuid": "5918827c-d4b2-441d-ac55-b15a320601b5", "value": "421f57ebeade5946b16f0c3c541d2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308017, "uuid": "882473fb-2714-4dc7-a536-5f60653ec52b", "value": "12288:z9eONBtJzhKJd6EPXNQyxbLSo4ZV6A0eLpN/DL/zFEKNU5tGG:jnzz04EGOzmV6A0KpN/fbFZNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308017, "uuid": "675c51c0-ea46-49af-a17e-7d6935e8105c", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308017, "uuid": "0183673e-6459-4c1e-befb-5f80bae5f093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308017, "uuid": "2cf6bff5-b605-47df-8440-1d49a239d796", "value": "1055cf736aa64549bf3b9ba1f50362f5cc8ca3adc7c9ca05644e0b7bd414c47f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dae349b-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (SilentCryptoMiner)", "timestamp": 1770304066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304066, "uuid": "1decbcba-c33a-44f1-a319-eb3e1c7f9496", "comment": "Malware payload (SilentCryptoMiner)", "value": "ab55d629b97c88f8049f47f1b4895e5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304066, "uuid": "ad2a61ac-3b2a-4132-ba77-d7f63eac34d5", "comment": "Malware payload (SilentCryptoMiner)", "value": "1072880ad6c65dcb3ff7721f4a1b4d44b4c1e2024c45d81e3fd1ec8a4502b2d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304066, "uuid": "fe57c030-1ff6-41ba-834d-0aa1448d921d", "comment": "Malware payload (SilentCryptoMiner)", "value": "505e5f8321a744785321b3aea1c43fea53808da1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304066, "uuid": "8e4ee099-fe1d-42f7-b546-0a85b5acf8e2", "comment": "Malware payload (SilentCryptoMiner)", "value": "57c37e2647b5de4702b68a42dca80eed01ec3c1d071a47ef8ad66112f3fd04873c1b995b02790526e6de3e8ce7eed229", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304066, "uuid": "7f4ffc75-f178-40fa-a2c0-8a01b8cf673a", "value": "T14B0733056B8AF4A1DFC0B5B2BAEC577F795607A4A8E3F3302192E79107993B6D21C421", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304066, "uuid": "c212865c-18a3-4765-9f4c-55632da45f3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304066, "uuid": "e46cbb45-3d2b-4e3e-a872-0ce905dda14a", "value": "393216:nSAMqar99mlDfgaVKlOnaG2AnxHy0FavumB4qukJLrDti:SAMl9mhgaVKlOaG2p0EumekDti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304066, "uuid": "08d412a9-fa64-4f9a-b901-f33cf0738d24", "value": 16877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304066, "uuid": "f6fc2d38-cc61-47b3-b16b-f835da81c40d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304066, "uuid": "15c6e665-cfb4-4158-8660-7b74a080a448", "value": "1072880ad6c65dcb3ff7721f4a1b4d44b4c1e2024c45d81e3fd1ec8a4502b2d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c930ac-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770307007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307007, "uuid": "948b1252-2104-4ee4-87d7-193921355a7c", "comment": "Malware payload (PureLogsStealer)", "value": "201e8056c93632c2b5d60d3389b76728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307007, "uuid": "be7596f5-f9ff-4f9e-a6d8-fef447ec1bd2", "comment": "Malware payload (PureLogsStealer)", "value": "10910355ad10c6863ee503c9dee4342e7b2767a78c0953bd55ed7b17bdbfcec8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307007, "uuid": "bb40bb8f-7824-4883-a721-ea3312ed83d1", "comment": "Malware payload (PureLogsStealer)", "value": "def98da9d9762a2bd1fa61fa118a12bf5b4617bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307007, "uuid": "7c03b7bc-b2f6-48c3-a451-64767de18b3c", "comment": "Malware payload (PureLogsStealer)", "value": "1e29407e3330fe0e414d93c2df735b718afac8ea5674561529161b137770b608a26afe9d52aae3ec9d1fc900431cb9c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307007, "uuid": "3fc91be9-0810-4eac-b875-49b712a03be2", "value": "T16525F103715ECB4FC95046B83435C23492A4EF4BA511E686BEDAFEAF75BA74C16013E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307007, "uuid": "bd483548-68c5-49e9-8767-f54791bb4f52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307007, "uuid": "08aca72d-9ada-4c97-8d1f-2731f0fc51ff", "value": "24576:dEmH93QCt+kw5Z7143xIP2aAdtUrQijkYDUPiRwAH:ymdQa0pKxk3GgQAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307007, "uuid": "f32aeb3f-ffbf-4c51-bab6-1ea2c2d46d24", "value": 1031680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307007, "uuid": "41040648-fbf3-4a8b-97fe-e2da5d3c842f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307007, "uuid": "e32fb843-f08b-4502-88bd-2c12d3fc2269", "value": "10910355ad10c6863ee503c9dee4342e7b2767a78c0953bd55ed7b17bdbfcec8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90efec5f-02d4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770324741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324741, "uuid": "4598652f-1571-494e-8968-d786c23daf49", "comment": "Malware payload", "value": "f7dbc3e9e789c74a117ea6a64f1eb065", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324741, "uuid": "7daa30bb-da90-4d8a-a817-f261a14869ea", "comment": "Malware payload", "value": "10f4a9e7e4cf92ae29289ba9c315de7565d3681345deea4f63aa4b22d245449f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324741, "uuid": "a317edd2-21bf-4c11-ab1f-e93645c0a8bc", "comment": "Malware payload", "value": "f3db53aaa2a21c91ba49e151481a7ec65ea61f11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324741, "uuid": "e5691298-717b-420d-8732-501e9b256809", "comment": "Malware payload", "value": "089f89cce690f5e0665624a95e6ab0be6416f64132a56a252c119c60c0f78f57bfb28b0e0470fdf5f7c6950f4cf1e0ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770324741, "uuid": "f0780038-fca5-4c88-99ed-83845df0bedd", "value": "T1E5168D98FD1F3C12F3DBF27C9F4AA3E1762B35D0E32790B679524209C5866D4C6A1A21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770324741, "uuid": "625cde6f-16ec-432e-acf1-7c07c6ac670d", "value": "49152:0s0+wgDN7FkvMiIlDudbgY7LkYhSklWwlUc5cc18rweMGsoK:F0+wgTkvMiIc0Yh9lWwlUN61GsoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770324741, "uuid": "02bb7664-4b2d-42a3-9459-913e859663f3", "value": 4133784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770324741, "uuid": "27e05e37-c262-4004-99b3-145c659375e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770324741, "uuid": "6eae43c1-4b60-4e51-984c-8dbe20c9a78c", "value": "build.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128e08ad-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1770303483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303483, "uuid": "b1688c22-1f9e-449f-82bd-fcbd1c2192d2", "comment": "Malware payload (Loki)", "value": "441ded56ce56c47bf81f0f1b42976cc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303483, "uuid": "f5aee498-0ece-4b83-b2f6-6d13e113f13a", "comment": "Malware payload (Loki)", "value": "1278f7bac9eea48b94dc7f05a7cba9fcc4aca109875ccb8a8d3fd69bbb967d3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303483, "uuid": "bfc909e0-55f7-48db-bc4d-05638e5833cc", "comment": "Malware payload (Loki)", "value": "64186967d3058a59d8419a787a81af284fa9b5ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303483, "uuid": "623e5eb2-6849-40a8-801a-9c49b23c596b", "comment": "Malware payload (Loki)", "value": "be4b35d10641cb324654db484a95eec43e3498aaa1419b553a328704ac011bc04dae2d70eb8eef61392b82489d073a61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303483, "uuid": "2d367f44-53c9-42aa-adfa-e91334d955c9", "value": "T16FB4F194626DCF12E1BA0BF319B1E27103B57D6EAC20E34D8EDA6CCB3025B525D90767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303483, "uuid": "c14a3e2c-bd1d-4326-8442-fb6ae6cd2fd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303483, "uuid": "3650f624-8add-48de-8107-8bdd4f76ee60", "value": "12288:9pY6I42RnwFj9vQv3GMTr+dVBQW6meWrJwlxJCm:IfwFZvQv3n+dJZfwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303483, "uuid": "8a198e8d-5a1f-47cd-8b5f-7c2dd571fdf6", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303483, "uuid": "16f8af73-dea6-4406-8b94-409e5369f410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303483, "uuid": "9f465cef-29da-477e-95d7-75e77408a86d", "value": "1278f7bac9eea48b94dc7f05a7cba9fcc4aca109875ccb8a8d3fd69bbb967d3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6ec2ad-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306429, "uuid": "ab3ab41b-92e8-4ed2-97a1-2cab9adb0e49", "comment": "Malware payload", "value": "c2614adf12349681d7746f3abdd013c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306429, "uuid": "5e133da4-016e-4955-a189-ca6da4539cc4", "comment": "Malware payload", "value": "1323bb548e5b6d0f664e66cd222dcdddc811c1f3676139b31a69364a1c044a78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306429, "uuid": "8f9b5068-e738-44d1-b8d9-ea51a25d5c98", "comment": "Malware payload", "value": "ed4d95eb15e4347fe6fe5714ffb0ee55cc5696c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306429, "uuid": "e6b34823-a9ba-4b64-9d02-9f84e9d032b9", "comment": "Malware payload", "value": "22d898b2a8267d9ae098dd6300f959f7530f4f4bd9baf5ba41e84a440a0b1b63ed3f5029e23084ccbe2c17c2184ea1c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306429, "uuid": "6eda446f-f844-41d9-b71d-2a5640db76a7", "value": "T1F686333065C0CBFEF66A2D3B40B7C3A65EB9203017B6E5E7BDEC0B492E143E29515589", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306429, "uuid": "f3124144-44f4-4ac1-87bb-f4a209fbb569", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306429, "uuid": "b3da1fe6-e1c4-4a29-8dc4-04306c838bb2", "value": "196608:B/VjYUhtrbR6VxeEJNE/pXunH+/G0Ylsz1dxigV2QxUSswpTqnUtib4:X0itrN/NGH++LlsLogV2QmBwoUAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306429, "uuid": "b92221f4-e060-4e2b-9ccf-889b9fa5eded", "value": 8526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306429, "uuid": "ca2af2c8-adaf-403a-b78a-086de8acaec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306429, "uuid": "9b15f994-44c0-430c-b0ce-a8ea59d499d8", "value": "1323bb548e5b6d0f664e66cd222dcdddc811c1f3676139b31a69364a1c044a78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942ad658-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304989, "uuid": "5792edef-044b-448c-be57-c01947c0305e", "comment": "Malware payload", "value": "4dcd60c1ba385b716d28c3c69c1b659d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304989, "uuid": "94932cfc-5ef6-4548-8eed-99a37181d6cc", "comment": "Malware payload", "value": "13b8455a49d494f7779ed76e3e4b00709f8280aba86707b43c574e48b3ee077b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304989, "uuid": "460ed9e4-001c-4982-acfb-239906d984c9", "comment": "Malware payload", "value": "87769d5622e35b5f22d5eb2a3414e2589f8424bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304989, "uuid": "78db22f6-c8ec-41dd-9b3e-944e4df2e29d", "comment": "Malware payload", "value": "c9da62f6994f91afb8d99fc4582743aca693c912d0baca38ae8eb9f83d345670a86959fc6526614bc82e15fca37ada6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304989, "uuid": "001f4c0d-7938-4b3e-ae51-3566f67fa81c", "value": "T1EE45126427DCCA03E9F75BF51A20E73107B8BE99E815C6494EEDACDB3831F4199443A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304989, "uuid": "ef32af0f-86d1-456b-bbf9-3d3e96282625", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304989, "uuid": "4fadc5a5-cd6a-4c34-ae1b-d9c10d21eb46", "value": "24576:RdV4z973bv0xDOP5ugm4P3qzL29BXka/hyDLUvHa2Axtpa:rV4zNvPwgmP32TNpsU/a2Stp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304989, "uuid": "cbebf58e-b735-4c25-b0da-ccf3ef3b739d", "value": 1223680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304989, "uuid": "97a87c33-0218-4e4c-ae26-7f9a60cc0d34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304989, "uuid": "ff323593-85e9-408a-84f0-747220e8d88f", "value": "13b8455a49d494f7779ed76e3e4b00709f8280aba86707b43c574e48b3ee077b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad7f774-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770304410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304410, "uuid": "f850dd06-447d-4542-b1cb-b4cf940a7e70", "comment": "Malware payload (Formbook)", "value": "b9ad6fde9186629b5d2f7a421c060241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304410, "uuid": "1ec38e0e-a301-4651-893e-173f01b1e7cc", "comment": "Malware payload (Formbook)", "value": "13d335504add2ad1572849d81480799152d1ad77265af1054ab32f636e8a2b9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304410, "uuid": "6f355ecc-71a9-40c7-8fb9-f759cc8aa26b", "comment": "Malware payload (Formbook)", "value": "87203f9c7ea95425455f00ada7b50a5d1833f51b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304410, "uuid": "ff2b9f96-7ba4-4a0d-9dc7-8fb00414b923", "comment": "Malware payload (Formbook)", "value": "0570a8928b1d9401ad4f5cc80711ad0ffb260df6c9d1ca8bd4eab1091c4043c9bf98d94568649d4beedd8618c6788a87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304410, "uuid": "f8994822-828c-4a45-bf9a-eba32fe482bd", "value": "T1CD45CF2373DD8364C7B25273BA66B701BEBF782506B1F95B2FD8093DA820121525E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304410, "uuid": "a072f862-236a-4d28-8f6b-a4b5bf7888ee", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304410, "uuid": "9b5d5806-572e-491d-a833-ac9f5aeb7099", "value": "24576:8tb20pkaCqT5TBWgNQ7aKJlPFf37792DwkefUaFM6A:lVg5tQ7aKJrf37798CfUX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304410, "uuid": "3134bcc6-7a12-4446-98dc-0dadd8e8a0f1", "value": 1184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304410, "uuid": "9f59ade9-fc09-47b8-8888-6df64b619923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304410, "uuid": "ab6e618b-79c1-4af2-983d-3380deb6877b", "value": "13d335504add2ad1572849d81480799152d1ad77265af1054ab32f636e8a2b9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0914fdf6-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770305186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305186, "uuid": "8a4f50cb-dab0-4436-83e6-c14ecb9dad31", "comment": "Malware payload (RemcosRAT)", "value": "db8f838364ce4b0e56bf3985082fe067", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305186, "uuid": "13773e95-e89b-4ff4-be79-7760d2988471", "comment": "Malware payload (RemcosRAT)", "value": "13d86cd98fa20c90ce941d9e3088a00abef85faed0695ca7bcf3434a704dd810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305186, "uuid": "6a2f39ff-c58d-429a-af1b-e028c04f4761", "comment": "Malware payload (RemcosRAT)", "value": "4da014ff7283a42e13876d055403bd2e711c19d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305186, "uuid": "43202304-ea05-435c-9304-9ca9f59907a6", "comment": "Malware payload (RemcosRAT)", "value": "9124db591e10115260c8d63cb92bf1bb65283516bd2555c2ec3088a446c92f09027594191744533a5a083dbce1198fe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305186, "uuid": "c435dde9-e4b5-4aa0-a047-febf2278e43a", "value": "T10C45226D63A9DA22C4C217F41661F7B62BF0ADEEA510C3878DFE6CD73420BA46444397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305186, "uuid": "1d5fc2cd-27f0-4a4f-9754-443e4615d174", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305186, "uuid": "5d71b33c-b17d-4c2f-b010-ecb7c981162d", "value": "24576:bRO3txXWkOZwz5dPju2nSAwjVwzJT2JzF1e3:VggZwz5huoGjVwR4e3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305186, "uuid": "173e432f-4fe3-4bf2-9e5b-004cc21a28e3", "value": 1203720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305186, "uuid": "bb80f671-68aa-4197-b356-d9820bc3ff2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305186, "uuid": "b22f000b-ca6c-463d-b5a2-9c6f2bba9ac6", "value": "13d86cd98fa20c90ce941d9e3088a00abef85faed0695ca7bcf3434a704dd810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b537b8-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770305267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305267, "uuid": "4a35e75c-ced9-4d06-a9f7-49ea3db9363b", "comment": "Malware payload (Vidar)", "value": "7313322745fb84b2cdeffccafac3c3e9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305267, "uuid": "f3ddd5b6-a073-4686-9c02-fee84fc2a12b", "comment": "Malware payload (Vidar)", "value": "141a5648e3e4bb365f325dd618299b7bbc5e4641dfeaa14be0654cd525130fe6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305267, "uuid": "aaf1dfc6-c938-4fc7-8335-826352227d82", "comment": "Malware payload (Vidar)", "value": "4493af985adc295524ed43e9d7889609e27a2d71", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305267, "uuid": "4d13b84c-4c96-40a7-8bef-a888258e0ab6", "comment": "Malware payload (Vidar)", "value": "9f33fe50d820bc45175f16ab3d8f71caa70c5c9a48dc0ca6e5c085798cf0e391b6d93281447f2f52fd51e916e8a7ef63", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305267, "uuid": "fabd9546-b740-427e-941d-cf67e45ef511", "value": "T1318522913AC8C13AD39E0537887B8B65766ABC354B3180CF66A07E6C5A317D3BC39356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305267, "uuid": "5e431476-2fd5-47a8-b34b-65874b2453f5", "value": "49152:Hpxx6KyitSpxpj/zC+MI8OxOGZqFtp7P5HSJ:HppyaSpXj2ITxbqFtp7P5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305267, "uuid": "313f3e42-1aab-439d-8c51-96769f3713de", "value": 1720320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305267, "uuid": "1ca46521-64b7-4abc-8120-f54efbac499e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305267, "uuid": "dbd6b4c0-d617-4eea-87ee-08b9efdaf0de", "value": "X5P2hQO.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1856d2-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770307206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307206, "uuid": "0582da19-6d9c-421b-b0f7-17f0f18426a6", "comment": "Malware payload (MassLogger)", "value": "ba06769bee821a89dd5562df2b43744e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307206, "uuid": "adf7b359-3f01-4136-bfe7-c8120c9a2b66", "comment": "Malware payload (MassLogger)", "value": "141fcfa2abaae31d65da4145a537bfe13dd01ec9759d3bc1f6dd8d5ba5c1ff26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307206, "uuid": "5863f82c-fce3-4807-93b6-a2b1ed4bf79a", "comment": "Malware payload (MassLogger)", "value": "8bfc9cedccaac4e61afa3d53b736e4e8ca007a7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307206, "uuid": "b0127239-28fc-4e8f-bffe-1de398b32014", "comment": "Malware payload (MassLogger)", "value": "5ee1f220e8cb7feab499c2a7859a3ab864a4adabd611c83094b67975e0bad889ecec1634fe16c781129dad1f2b56ba9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307206, "uuid": "8616b7b5-6771-481b-9503-f1242c26c3b2", "value": "T17B151205331DD80BC6A65AF508A0C67057BAAD4DF602E6CBCDC93ECBB5B97851B12393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307206, "uuid": "68730635-3a50-4dbe-982a-45c0169c4a06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307206, "uuid": "fdf016e8-9889-45e5-97fb-545410d11d5d", "value": "12288:YMhkMIXQW6IicrFrUTxZNZoIVCfIHlw+U46o1ZVkF/HwXIanr68PJka:Y0kHg0r8oPfo8Ho1kF/AneMia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307206, "uuid": "a46750e2-a0f3-458a-87d1-68da54be69be", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307206, "uuid": "ac5aefd5-7ca6-4403-9d0e-ec2fa468da92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307206, "uuid": "92faf1f2-94f5-4906-95f1-fd9d4306173a", "value": "141fcfa2abaae31d65da4145a537bfe13dd01ec9759d3bc1f6dd8d5ba5c1ff26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e15ee9e-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303691, "uuid": "d2dec34d-5c71-4fb8-b43e-9535cc9e7bea", "comment": "Malware payload (AgentTesla)", "value": "41ab4411b133af01e5c85219bbfe200a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303691, "uuid": "67f0b3a1-e698-49a7-b7c8-6b2a15b3f500", "comment": "Malware payload (AgentTesla)", "value": "149a430a6f9f5316febfc555e4c26b07139dd519a723bd2f11e2edb8f500fae9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303691, "uuid": "7343c714-2282-4257-b178-0c7a67f71226", "comment": "Malware payload (AgentTesla)", "value": "cf06cb32452e94b3673ce87eabfc88e2c23a2c50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303691, "uuid": "632d30c4-6ea4-49c7-8045-18dc343c7d3d", "comment": "Malware payload (AgentTesla)", "value": "60cdb4dd5801b95e1ce0bc78cdf72ed8283fbf5347b9c620899a510186959fd73e0d76a106e54315bf9cbaf552f72493", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303691, "uuid": "ec692b47-3e91-4ec2-a2eb-cfeae09c221c", "value": "T14335AE0273C1D062FFAB91734F56F6115BBC79260123AA2F13981D7ABA701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303691, "uuid": "08411092-2a75-4bf8-a8b8-e14dc2f42822", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303691, "uuid": "d0d84d82-e231-4296-bec8-2c925c84feb9", "value": "24576:H5EmXFtKaL4/oFe5T9yyXYfP1MAXDzsezky6O:HPVt/LZeJbInGizsoky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303691, "uuid": "bff58fd7-ec88-427b-b059-bfcc2995576f", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303691, "uuid": "5825024d-be03-4498-a40e-27dd1dc3fcef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303691, "uuid": "2c44a787-06a0-4bde-8fc4-e0cb5f47e3ba", "value": "d599cd22b34287261efa52b26e4ba1e7c94b31e0f06994a68ce60fe8b9cbbeec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058b0da9-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305609, "uuid": "d4bd8238-ce58-43f6-9d0d-7e6941aba977", "comment": "Malware payload", "value": "5ea8dc859367ad692c5f4f65f72c2dcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305609, "uuid": "85271af5-47ab-4292-beaf-f459a0439198", "comment": "Malware payload", "value": "14b61a0155007f6e19dd356eb215652c7eb5dba764e5f059f3e37cbd273c3daa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305609, "uuid": "3f0c5c25-5c1a-4b9f-b2cc-e5e280fb55c8", "comment": "Malware payload", "value": "d25f455a5f277b3fb394112f04ff34f7ea74c11c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305609, "uuid": "f7f4484c-5b87-4199-949c-36984be9d99d", "comment": "Malware payload", "value": "cb316b2a5e5c815ac24d5027d7d7296d4a288359cc18789cd9e26d641682a053c584dc6e85aff256a471ee0694beaadf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305609, "uuid": "fe4f860c-7bde-4479-971f-2bcf606bc150", "value": "T183250199321BD906E4A61FB80D31D2F51F787FA8A911C3578FDABEDFB8766901900342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305609, "uuid": "f88682df-d255-4698-b2a2-a637651008c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305609, "uuid": "4deb3956-b900-43fb-9f92-4177fdc6a826", "value": "24576:Cs40XsrKtA18rqS4nHV3xUwqJYlxlAlMUj:t40ri1tbn13xOQXAlMUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305609, "uuid": "ece3c365-4fb3-4251-9595-57ab31dfc4d9", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305609, "uuid": "5e96db62-cd13-43bb-9837-adc6a7728048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305609, "uuid": "c598cfcf-e52b-4605-99e8-c4069106770f", "value": "14b61a0155007f6e19dd356eb215652c7eb5dba764e5f059f3e37cbd273c3daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0f2755-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770306479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306479, "uuid": "07062325-eb8a-4dfa-90e2-6b3a7411a169", "comment": "Malware payload (QuasarRAT)", "value": "76e5cbfb19c3e3f1dd061912e7d93b76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306479, "uuid": "6aeca673-db22-4b41-83f5-9f8d5c4a5bf1", "comment": "Malware payload (QuasarRAT)", "value": "14e5fb1883ebde0d5300ac4c89deae9d3d851b74ec6b362fb47fff9f23827fe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306479, "uuid": "06de71e2-841f-461e-a2b7-063ba8024d97", "comment": "Malware payload (QuasarRAT)", "value": "2b0a2a53516b820d1e0becf82531d9b7509f13b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306479, "uuid": "13152480-4cdc-452d-993f-6f876d12044d", "comment": "Malware payload (QuasarRAT)", "value": "11ff2435ab026405044a9e3eed6a49cb77b047b52d7bd8c51bebc0aaec088b11d469a1a7372fdd0386fd5bd40b32128f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306479, "uuid": "009895c9-9ca9-4320-8c9b-49d91080b5e3", "value": "T193E533DB30FA6539FA049D39A2674D90DD519B8B3017F0069973B9E03B3915206A8FFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306479, "uuid": "3a60f57d-b435-421e-8854-f771943874b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306479, "uuid": "b69777c9-c94a-4a6a-9ace-68d2011554b8", "value": "98304:2p0ItJ0n/zdlLebsfTYvNe7j8HQ5Cl6YzSvOBkW:2pXtJ0nZVxfIo76Qu6QERW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306479, "uuid": "02210b7c-4fed-4fb0-a1cb-d092449c1fdd", "value": 3291259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306479, "uuid": "d3f34108-47ab-4669-9dc8-47e67106d046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306479, "uuid": "9ed72f2a-7b6c-4d53-b544-407c681dc3d0", "value": "14e5fb1883ebde0d5300ac4c89deae9d3d851b74ec6b362fb47fff9f23827fe7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8beb6e-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770305431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305431, "uuid": "1df1a4e6-67f9-454f-92f6-c98b60c012e1", "comment": "Malware payload (RemcosRAT)", "value": "85cd5c77764bf1a765dbf64aaa831c9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305431, "uuid": "68451c3a-da1d-4752-8e24-f4d293441020", "comment": "Malware payload (RemcosRAT)", "value": "154ebc207e7463ba7a1aa994236f83246625bb13fa365a5825715b3b56a39caf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305431, "uuid": "dd6845e0-b8bc-4dca-894d-f2aeb9607597", "comment": "Malware payload (RemcosRAT)", "value": "a42c18666aeb1bfcf7d192b9d2f8052fa0563c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305431, "uuid": "9889128f-04dc-46e9-9b8c-cc8995aaba0a", "comment": "Malware payload (RemcosRAT)", "value": "0d9756de1fe4550be1c8e7fbaad54b7159e98469aa760e2abd36ed69e4af69174ba75484bfd32556d0314e248830e090", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305431, "uuid": "5b4230e2-1f96-4247-8d0c-61aa6e302906", "value": "T198F401853350DA43E7D21774CCB8FBF06216BFADEB5B4367B6A03E0AB8762465807512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305431, "uuid": "b1c82acf-5bbe-40b6-9e14-d914d09aab8f", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305431, "uuid": "2444cf52-9a63-41da-890e-654f54269072", "value": "24576:F4rQ/uPAszXASomxBGSVF7ZAswD/tngoPiD9:CrjPh/bBJFnw9goPiD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305431, "uuid": "186cbfec-3d4e-4aa7-b892-1c3d2ac2d547", "value": 787376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305431, "uuid": "a5d54187-9b8c-496e-ad9e-71131dc1f93e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305431, "uuid": "f738ec32-ca3e-486a-ac79-0a43192b804a", "value": "154ebc207e7463ba7a1aa994236f83246625bb13fa365a5825715b3b56a39caf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77caceb6-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770305801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305801, "uuid": "d24a91cc-26a2-4102-b644-e8edb2227e68", "comment": "Malware payload (CoinMiner)", "value": "167afa5efc5c361f2b324f48e6ab7b66", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305801, "uuid": "702def9f-ed56-4798-916b-9ac8a2433bef", "comment": "Malware payload (CoinMiner)", "value": "15d953625965edbb9ca9d977dba169f2b8d237181fb84d428809632c12f4fda1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305801, "uuid": "0b1df427-5035-46cd-bac8-634d7b3ed2ef", "comment": "Malware payload (CoinMiner)", "value": "a0a729e0d43bcd0ca835f3559502f311ee867202", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305801, "uuid": "f71678d2-7fc2-4f4c-9132-8c73e1f73e04", "comment": "Malware payload (CoinMiner)", "value": "44e28426358afb9b315c840b3fa81d922f01269faed8b803437c356a0cfb1cfa60f64c09f449e018f48108f58311d2b2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305801, "uuid": "d70254b8-4e2a-4f70-8be0-88d93f2fc57b", "value": "T13F2633117FE791B8D34016316C8D1BA915C0EF961B4282DB1B45362BEAB23D5EB3D2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305801, "uuid": "107d19a4-39f5-4e60-be2a-6c10cde2900a", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305801, "uuid": "a7cdbd86-deb6-46fe-8e6f-1f0bb11965f0", "value": "98304:RU5yJcgiPIIKPYukUJl4Y2If+BWHxSlwDQe6PTfEpiLkOR9uBhGeU:RU0GdP2ge1mAxe+6b8p6kO2Bi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305801, "uuid": "addd0917-6da0-4e48-9eae-459d56f4817d", "value": 4841080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305801, "uuid": "28cd210f-c783-47ed-8f70-ee483885ddf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305801, "uuid": "0508c0dc-c535-47a4-97d2-dfc26708d12e", "value": "15d953625965edbb9ca9d977dba169f2b8d237181fb84d428809632c12f4fda1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0848b40c-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770306902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306902, "uuid": "707c8bc8-2e0b-424a-9e5b-9d6d131a8b35", "comment": "Malware payload (DarkTortilla)", "value": "649dbac5ca916e06f110ac68be4e0abe", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306902, "uuid": "ead5ba80-b96f-4969-966e-807c598b3170", "comment": "Malware payload (DarkTortilla)", "value": "15f90dcfd16ec3f33234533fc44c00d057ecb2f29682257baf061307ce321634", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306902, "uuid": "857332d0-a478-48db-b448-1d97e18f80f4", "comment": "Malware payload (DarkTortilla)", "value": "1d7722c9da0370d2a0c5499aa23f179d79fe5fa2", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306902, "uuid": "a76bdc71-26e2-4803-ac92-d554f34ea47d", "comment": "Malware payload (DarkTortilla)", "value": "3c1f3c5f18ff7f9972abeca9fecb4b52a546e63f6704aaffdf5f347b4fc32bfc890500a2f50df0be207a8df145f11383", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306902, "uuid": "d3a09c8c-bf0a-446d-b98a-08cf90304e2f", "value": "T134C5141A1AD641E4E4E9CE30E3FD26A942F0662F5525BBFB424412F8DE2535FB1432B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306902, "uuid": "a8709216-6f1f-4da5-9385-ab08ef8c8aa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306902, "uuid": "fb14298b-72b1-457b-a001-4013f2292002", "value": "24576:nCfMs1hsAdBen2pqp+8a5D8LoA3B/UoMOmxYC1xa7Rl7VL5h4gXTkZyPM2Ck4Kan:nCfTfem8g8LhB/rS87PWEPMc4pHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306902, "uuid": "d6e97dee-6cde-4463-a5da-ff5fadd83293", "value": 2530304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306902, "uuid": "7ae8fecd-47a1-4368-aa4a-3275852fb586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306902, "uuid": "e76cf246-82e9-4cfe-bd27-960621a67588", "value": "15f90dcfd16ec3f33234533fc44c00d057ecb2f29682257baf061307ce321634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d12334-023f-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770260826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770260826, "uuid": "7e2e3484-c4a3-46d3-9d2a-a94ebaad44e9", "comment": "Malware payload (Vidar)", "value": "00b699bdb53e9fdc3efad84c2621fdde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770260826, "uuid": "e5318c94-1acb-428c-b0ef-049f22db35cb", "comment": "Malware payload (Vidar)", "value": "15ffe3bae5898cc42ab5dd7edbe911e1df4ef6aff18473ce83a6a1c410b5d57f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770260826, "uuid": "88164683-1382-4479-a4bb-0047fb8979fd", "comment": "Malware payload (Vidar)", "value": "e8ace7d74649207c76818b4da7692e1ae13b66a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770260826, "uuid": "1d24783a-41f3-48a0-ae80-2ae716e5dd03", "comment": "Malware payload (Vidar)", "value": "1e9fed5ad113cf287e9ca2431181aba0c339fb112413ec037904d5663061a61d24acce9c359d1d630109e04005a4afae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770260826, "uuid": "24477e09-9e54-4be3-bb00-f88e19539438", "value": "T162165C93BE80C265D1ABE139E9B1A1A57330B80D433022D36F562EB65D7B7C4173BB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770260826, "uuid": "42e92b0d-d83f-49e7-aea0-6e4d7d257761", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770260826, "uuid": "0cf3e017-e74e-42de-b4b2-0deaacb56735", "value": "98304:TfQnA3AJ3lchtXO1Z2wd1o5II4o6IgmFcdqXO:T7xcEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770260826, "uuid": "db4b51b9-d072-4b87-9bfe-9534d95988be", "value": 4390528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770260826, "uuid": "9c235a42-59f5-4125-9891-66f5ef87c417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770260826, "uuid": "a9779e78-5a70-4178-a6d3-ee387221cfe1", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36adfda1-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770307839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307839, "uuid": "845f440f-2a16-44f6-85b5-1f4605e68652", "comment": "Malware payload (SnakeKeylogger)", "value": "b89086f06946e3ec4408bf7690f25d86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307839, "uuid": "83ea746b-6690-4415-a35d-ea7d2a18fd3b", "comment": "Malware payload (SnakeKeylogger)", "value": "167f1c3cdca7d2542e5e8dca0e24787aad4c8dd2ea3bee530d56075c278a3ed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307839, "uuid": "dd6569d3-52d3-426e-aba0-9348e1cacb01", "comment": "Malware payload (SnakeKeylogger)", "value": "4ba243365b6d68fc10081d1b7eff95cc7aa76ad0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307839, "uuid": "3b849c7b-ce35-4672-8aa9-142e473fb01f", "comment": "Malware payload (SnakeKeylogger)", "value": "a35ed6099d266c7af56520e01ef250083d0d6fdad100f24c9cd2196b1f290d1d4b01d0548b7b407782d71abe29c319a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307839, "uuid": "824e9e23-1864-49db-89aa-da03a8e9cc9f", "value": "T16635120836E9E813E0E64EF49570D1B617B87E9A9532D78A4ED5ACDF34FAB0085503B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307839, "uuid": "d4fd04fc-a28f-4e83-b4b8-c98fcd5d4376", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307839, "uuid": "41e1a53c-fa2c-4b50-a2b9-a349477467e6", "value": "24576:Kcjcose7cjz77QID6F8/4SaqALDoMIpv2sHfiiC7qABR:ee7cjzAIDn4StMonpvBHtAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307839, "uuid": "623f8be0-8e72-402f-a0b1-787241a09111", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307839, "uuid": "1709d60e-d9de-4f3b-9d5f-469cd9b91ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307839, "uuid": "1092d206-cde4-4429-b5d9-c7bad45759c3", "value": "167f1c3cdca7d2542e5e8dca0e24787aad4c8dd2ea3bee530d56075c278a3ed0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025d1405-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304745, "uuid": "503f9cd6-deb8-4e9f-ab18-733bdc09cfc8", "comment": "Malware payload (AgentTesla)", "value": "5d4ab41656b9f9c9e382b55f6185d31c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304745, "uuid": "dc730bd6-0eb3-4763-ab61-f426128163e3", "comment": "Malware payload (AgentTesla)", "value": "16b32a85c021a0974620570ec1acccc53788a728254133bae747becba4460591", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304745, "uuid": "168c07da-04cc-496d-bc88-485d09355f42", "comment": "Malware payload (AgentTesla)", "value": "beddbe6e335f60528549e8c8666a2f3ada2a4057", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304745, "uuid": "cdc689b9-c62d-49e8-8e8b-f33ad887935b", "comment": "Malware payload (AgentTesla)", "value": "e5dc1b69ac7816bff47c7f82bff346b19471778848af54e55080175b1205a7c48ebf1d4a7af68770b802ce88c0c315d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304745, "uuid": "36296071-7508-44a4-a6e5-13a3424a69b7", "value": "T18685E10273C1C062FFAB95734B9AF6115ABD79260123AA1F13981DB9FD701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304745, "uuid": "783bc0f2-3222-4685-8e31-d914090af225", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304745, "uuid": "68df7472-af96-4628-a9b1-fc32f6e75f1b", "value": "49152:FPVtRLZeJbInQRa24o9X/Q/NrDmg27RnWGj:tNYbInQhu/NrD527BWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304745, "uuid": "f0a0d868-1abc-467c-9a3c-e18ec1ae6f44", "value": 1814528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304745, "uuid": "d7d1970e-8d1f-4b20-98f1-d2f5d12f0823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304745, "uuid": "cad91788-996c-43e9-821a-c6b3a0f04ecf", "value": "16b32a85c021a0974620570ec1acccc53788a728254133bae747becba4460591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb234e7-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770307047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307047, "uuid": "0662f7cc-38fa-413b-915e-dc51bb902bb4", "comment": "Malware payload (SnakeKeylogger)", "value": "b9fec3bb1d13ef0d514413e635f40892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307047, "uuid": "3e0d99cd-e923-4054-873a-1081a0f6e646", "comment": "Malware payload (SnakeKeylogger)", "value": "16e4fa89de48bc25efbb6225c9204b04552240c096b7cf67264a4fcfef53d497", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307047, "uuid": "76f1fc21-5aff-4379-af8f-1ce02b495da9", "comment": "Malware payload (SnakeKeylogger)", "value": "bb1d95b4d257f6a0f61204229acd44f177dd1e39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307047, "uuid": "8afd5c6a-bc59-480a-9872-703b02811ad9", "comment": "Malware payload (SnakeKeylogger)", "value": "b1232d3d3aaea2ec95294dcc6fcf21ad013b109d15baf075baf1d111b667b3fe78ba9638d8ed15c9c6486f80b8e816ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307047, "uuid": "73906269-d5c0-4cd5-b638-e4340badad0d", "value": "T19A769C14A3E804A1E42BD734CA55D733CABDBD925635C14F095CE2C22F73A628B6F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307047, "uuid": "53ef18d3-dd63-41d7-8147-357e43353e48", "value": "71df1909e6d640184ce50a27d77a3c86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307047, "uuid": "c4a416a0-6520-403d-9eaf-b9e4aa56861b", "value": "98304:DQTyeQvmDHbjP15t11JfnvSYQBWpVh94qc:Dle3DHbpRXvNVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307047, "uuid": "7d99bfb1-2785-48f5-8154-7b09a88c961a", "value": 7257088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307047, "uuid": "df7565cf-a6b4-4700-bbcf-525e0ddd5426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307047, "uuid": "c7421588-c56c-4f33-950f-460cef7853ed", "value": "16e4fa89de48bc25efbb6225c9204b04552240c096b7cf67264a4fcfef53d497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a6d630-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770306381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306381, "uuid": "931adcb3-3e58-4065-b028-1c21cb297d1f", "comment": "Malware payload (GuLoader)", "value": "20b1e5e9c15b68430c5e44be42607be1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306381, "uuid": "a772579b-ba38-4801-b2fa-7c8100d4dd6d", "comment": "Malware payload (GuLoader)", "value": "17390eb75a600951e54e64224440b152a17df6510aa70fe875a11bd6d78ffc23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306381, "uuid": "37d0320a-42d9-4957-90a9-6cd82bc6e10d", "comment": "Malware payload (GuLoader)", "value": "6bc7731c65658ac51dbbcdb4e4f2f70be0066a92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306381, "uuid": "3ddb4c73-1f54-4678-888d-d29a1118d6ea", "comment": "Malware payload (GuLoader)", "value": "cfd1943f5841b0540d6a3e940256edfd0021bd5c31d5bc2dead11a2ccbfad04ea8104c37960acf51e3da3d954b5faaec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306381, "uuid": "b20bff5a-1780-419b-8ecd-2dae0f7e0777", "value": "T123F4010F3228C0AEDAF81FB0F8695CF5165D9C019CAA514E7AD873DDA6F62F4431A50B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306381, "uuid": "77c2ffc9-7745-4b2f-8be0-23376dc2124d", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306381, "uuid": "56f3ec3f-756a-4a35-8dfa-398c889a85c9", "value": "12288:yqNbOlofWfh/oLDJsruzne2yI4WqRtajQ35DIFrrl:7bO2m/Qne2yBz/ajQCFrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306381, "uuid": "6ad3de40-eacc-4624-9fa7-c7fdae5fc445", "value": 773968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306381, "uuid": "3e12bc3c-106b-4da0-b805-b8e7beda252e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306381, "uuid": "0d8937de-7c6d-4e5a-b521-e32ca42fb81d", "value": "17390eb75a600951e54e64224440b152a17df6510aa70fe875a11bd6d78ffc23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb09f42-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770307101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307101, "uuid": "6e91cffe-ea1b-488c-a11e-28505a66cac6", "comment": "Malware payload (AgentTesla)", "value": "de81b9568abb6ca244f39f23349a1460", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307101, "uuid": "8db5ae42-ca1f-4681-b840-b7f0988e0599", "comment": "Malware payload (AgentTesla)", "value": "17406103af81a1e9978c42905c1da9fb3be734fb3bccc1864b60d15a693b205d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307101, "uuid": "015b87ab-9eb3-4146-898d-0777dc5b7d01", "comment": "Malware payload (AgentTesla)", "value": "2c8b672eeda091cc60e7969b517611558c66928c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307101, "uuid": "e8175aa0-c1a9-4045-8ec6-141d188e65b8", "comment": "Malware payload (AgentTesla)", "value": "694e253d625790468bf02d1295a3cb1b0607624d9094cc301a9632029b6fbc4ff1fb8543d54d930d29b3b5ac031c0973", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307101, "uuid": "8966e067-4b30-4255-bafd-fbda90088194", "value": "T134D4228359C4D960CA6433708436CC6146797D31AD09BB2F873EE56F6CB0393EA6678E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307101, "uuid": "7a6bfe0f-8a57-4e57-b234-8b8a671dec43", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307101, "uuid": "917cfed0-737d-446f-a6be-b45a83df1e77", "value": "12288:ez7hU5I5yuNHIgzSFKxWltRohBfSTso93UuujqHXK7q4/xYA5+:ef+iN57Gtene3D53K7Rp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307101, "uuid": "7d0a9b60-97e9-4a14-ba06-671833c8ed7c", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307101, "uuid": "97d7b7cb-fb7b-4660-aa42-6d9d71793d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307101, "uuid": "30e3061c-b1a5-46c7-b647-dbc1f8debdd5", "value": "17406103af81a1e9978c42905c1da9fb3be734fb3bccc1864b60d15a693b205d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef0e180-0235-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770256340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770256340, "uuid": "b92f6091-f982-43ff-9958-5220c45dcb48", "comment": "Malware payload (Mirai)", "value": "4edf6fe327a59a247b03dc5c7e477e6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770256340, "uuid": "abc15766-90f5-4c73-a268-cf3e191437d3", "comment": "Malware payload (Mirai)", "value": "1782c7215bc901f95eaf56b6b358c7d347fec1234abeb4d58027eebb3c8840d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770256340, "uuid": "b2d54cf1-fddf-440b-9874-9a87ac3bddd9", "comment": "Malware payload (Mirai)", "value": "3b9d2e99af0b0b7865c6f52e09a1a854b9706c74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770256340, "uuid": "9ef1d81f-36a7-4992-96fb-68699b39d177", "comment": "Malware payload (Mirai)", "value": "2fa6139d8453050c20a3304641a8bfbb21548e7791d272c773e704fbdbfb3c1086974c7f706f372aea27e6a69cc39ea8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770256340, "uuid": "6a51ea9c-cda4-4ce3-ba44-00079f6ec5ae", "value": "T198A3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770256340, "uuid": "79957a13-7d47-4459-a6af-6e3a91ed0189", "value": "1536:WpaZOuT/Q30SQXa1r3J62yqPy/RWLW0edmpwje0NY0:lZzTJa1rZ62yqPy/ULWzje0NP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770256340, "uuid": "cebae2c2-1a32-4f71-81e7-697bbb5a7785", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770256340, "uuid": "d4ac8fd8-5791-47bd-9d48-c0862366680f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770256340, "uuid": "d1ee5f05-7afc-4067-a73a-02e108d45865", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca07593-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770308010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308010, "uuid": "ba4d0a2c-a3c7-4d42-a79d-67ef2c5c70aa", "comment": "Malware payload (Mirai)", "value": "c5adeaf6ec4dfcae05ba7b150ab4a081", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308010, "uuid": "92ce2f4c-5c52-4865-9f82-53e67d7f057c", "comment": "Malware payload (Mirai)", "value": "17a778c0fb299c6abe3c926664713fe4381bac378cc6daeff54dcdc2238ff219", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308010, "uuid": "405f1b99-7cc7-4e78-a39a-87ea2eded2ba", "comment": "Malware payload (Mirai)", "value": "0ac72b0b7173df85b2f2622095c72046392ae321", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308010, "uuid": "0fa34dcb-db8b-4fd7-9820-fc30e5754855", "comment": "Malware payload (Mirai)", "value": "333a765a67ed5b7e079e9e3dc4e279b1ea26c3a866bb2f096618279ba6bb55e0702883047845c15f5cf1e8bd40c42210", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308010, "uuid": "d606193f-0ef9-409c-a727-8f01453420e4", "value": "T1B2843A23FF0C1432D8A39E756D7B2BE59339E8E16175E11954096F2C2A31BB0698B37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308010, "uuid": "66170323-36fd-49e9-9afa-fbe64fe7bed9", "value": "6144:ksOf6ZfiOqbOLxfOy8Wfwjis9keQBbJZD3Tof4+IIw5id8VQn:8f6COFOSbtTyI5Y8VQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308010, "uuid": "8c9b4bf9-f26b-431f-83a6-f3c322774af9", "value": 379828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308010, "uuid": "a0b07678-644c-465e-82bf-0c9d91643d89", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308010, "uuid": "94eda436-c6ca-4188-87ea-54e324b192d3", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcc24a8-026d-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770280286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280286, "uuid": "1ce6b646-7832-4e30-ab56-bf2f4f8c6191", "comment": "Malware payload (PhantomStealer)", "value": "33b4608f5230d328e105465330b3ed91", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "bot8469606505", "colour": "#C8165D", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280286, "uuid": "b02d8ce6-71dd-4fdb-9cb9-f2a64bf919ea", "comment": "Malware payload (PhantomStealer)", "value": "18351edbd499d635aa72c66aa31134fe3525b89e279aa83a768a7be073a0ff76", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "bot8469606505", "colour": "#C8165D", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280286, "uuid": "303305d8-1fc7-49f4-a397-3ea281dada21", "comment": "Malware payload (PhantomStealer)", "value": "04176a4dfff236e1d76755da6dc18f2eb4a28a11", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "bot8469606505", "colour": "#C8165D", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280286, "uuid": "0c124eef-b251-4def-b769-c2dcef7d7488", "comment": "Malware payload (PhantomStealer)", "value": "9f3fc0cd215f6251927c4f98c12f76c476a2018298f3f663dd6f139524144d90c728a4b23ca69e34f93e51ca12512ef8", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "bot8469606505", "colour": "#C8165D", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280286, "uuid": "34b766c7-913d-4fb9-abde-2dfea7b274ea", "value": "T1CA061111DA22CDA10A2C5114246A2DCB26114EAB4C4877BA3F9E5F8E0F4F51FD47A7FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280286, "uuid": "3e159a37-3290-4762-9d97-f2d6ec02100e", "value": "49152:nNIT+NrlqUJLEdYAxtalv9UwbRzNWyVGmzXGe9eSRX:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280286, "uuid": "ed5525d1-5b4c-4f5c-bead-61053999eff9", "value": 3727769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280286, "uuid": "416c1f6d-ac7a-4c81-aad3-16a064c4efea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280286, "uuid": "882c2942-5ccd-4aba-b7fa-26778ee8fd1d", "value": "FAN.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e5e4c3-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770306972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306972, "uuid": "a60a2428-d0a4-45c6-919f-42923939fb7e", "comment": "Malware payload (RemcosRAT)", "value": "7ef3d62e00660fb7ad6121e105e2141f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306972, "uuid": "2b17c66f-e0e7-4126-aa35-df2f8167cc93", "comment": "Malware payload (RemcosRAT)", "value": "19126fee5cfe21a6ac12f8aad59bbb83610c1c2971bde33d3a6c789e3a4952bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306972, "uuid": "9b1345ae-865d-4e80-9e61-1340ed6333ff", "comment": "Malware payload (RemcosRAT)", "value": "dd1cbe6ff6d8bac31e600dad2f6ef4b90106cb7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306972, "uuid": "2ebd418f-0087-4763-9eac-95ce95412b2d", "comment": "Malware payload (RemcosRAT)", "value": "45381ae42ad5c223f89bfb4dbe140f00f2ce6373464133d83680a82d4bb83e04b5d5ee9c3747de3cc27bcd4fc73a1d94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306972, "uuid": "dd387b5a-75af-47c6-8eb0-aeb56f3d157c", "value": "T1F84523A9325DEC53D2491AF009F2C1351BF2ED89B406D2C6EEE63D9F34AAB541712327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306972, "uuid": "75394f98-634b-4090-af5a-a28edbb03ce7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306972, "uuid": "f7304b1e-c364-4aa3-b8f8-673012455c3e", "value": "24576:bmIHwjYmouQ8uf8TQrI/jpUfhUGlaWiE38RjVwDNv1jvEq5cuIvFJ:iIQjYmouVufIQrOrhXpRxO1ZvEzddJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306972, "uuid": "2cd279bb-754b-4c61-a4f7-39447a5bfedd", "value": 1196552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306972, "uuid": "ccbc7ee6-be09-47bb-ad62-f5e8b14e17d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306972, "uuid": "ca6975a8-2598-4046-913a-c3f7409eb2d3", "value": "19126fee5cfe21a6ac12f8aad59bbb83610c1c2971bde33d3a6c789e3a4952bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67105fbb-029b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770300189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300189, "uuid": "aedfabd1-dc79-460d-b1a8-bbcb033efcf8", "comment": "Malware payload", "value": "b02ced38f23d0458f1d6f10a8163c6a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300189, "uuid": "c5133b84-5ca2-4a64-83f1-16058dd00b2e", "comment": "Malware payload", "value": "19501f24019e35e66f134aac6cd959be0fb03429bd23b6b1b90b4e88cc4658e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300189, "uuid": "ded4f7d6-5466-4542-85b4-29aa70801749", "comment": "Malware payload", "value": "11aa63ee749d9e0c0c5e4c8a4839a024a80b04f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300189, "uuid": "5446abfc-66d9-4610-9f5c-989405061b42", "comment": "Malware payload", "value": "eee227930df06cae3184f475f58e160098467e5442fafeae29e96de77c0a790d643428358c8d1c50c8d2cbf2fb621272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300189, "uuid": "c20ad2c8-91c2-4b16-a160-5ffe8ef5b80e", "value": "T146187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300189, "uuid": "367c17fb-4c11-46fb-b207-bcce83a43729", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300189, "uuid": "7283c2c7-8779-4b77-ad64-04e2ac436ad3", "value": "786432:4AZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXWWh:4AZui3zQz2jOZKftP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770300189, "uuid": "d4befdf3-1b1d-4c3e-b3ef-2bfa7862de10", "value": 90454016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770300189, "uuid": "45ee33e4-75d7-4b8a-957e-ed87eae6e584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300189, "uuid": "5d8accb7-bf58-4d3d-8be6-d51ef23fb85b", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff7d9f6-026c-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770280098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280098, "uuid": "739bddfa-864e-4981-bf34-a9f0047227e8", "comment": "Malware payload (PhantomStealer)", "value": "bc3083d40e80d0217dd0dc046826aa48", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "bot8195252587", "colour": "#244CB1", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280098, "uuid": "aa502a99-0f45-438c-b296-9bc7fd7548ca", "comment": "Malware payload (PhantomStealer)", "value": "195bcb3c7d1c263ae05679c48fcca088d8fea34d263a8b52a6aa8e225bc1b050", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "bot8195252587", "colour": "#244CB1", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280098, "uuid": "0438762f-4148-45a9-8677-1b88a968912e", "comment": "Malware payload (PhantomStealer)", "value": "134f19669c6eca4ccd169dc603adc340f86b501b", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "bot8195252587", "colour": "#244CB1", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280098, "uuid": "46b9a7d6-7ecd-4f5a-a459-38c79e72ece0", "comment": "Malware payload (PhantomStealer)", "value": "b5bcdde07c1fb42120ab655bef289892073d3d9aa64e7fb1619185bbb43d407d9e0c11013522066875e82677b55373c4", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "bot8195252587", "colour": "#244CB1", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280098, "uuid": "690c9472-8356-4047-aed3-891ba39f1e52", "value": "T14E061101CA16DEA5065C5124606A0E9B2A404EB79C183BB97FAF6F8E4F4F50FD0762FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280098, "uuid": "7a3fc3b4-00b9-451c-b3b7-c976c8074dc4", "value": "49152:Kt5quAo04sn7ZDX9JamGmpcAs87FYFQx23NknbE34oupz+:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280098, "uuid": "a8418a72-220c-481c-aed5-ed09e992e1c8", "value": 3726809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280098, "uuid": "496ee8e5-90b2-4254-9b3e-0d8b230a3f02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280098, "uuid": "d063e77f-97e2-4ee4-b6cb-ee1e50679f2a", "value": "aryaphan.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e1a6af-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305173, "uuid": "5cf47f36-b1f5-40a7-bde5-facb13caa439", "comment": "Malware payload", "value": "143a6059c7aa638d8e6248f744db8575", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305173, "uuid": "697b3b2f-eb2c-4b34-b62c-e3031c994928", "comment": "Malware payload", "value": "1977061e6372841cdb5762fb9f177efe2e9bbbb4603fc1fc66b2880f9c4ae5a2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305173, "uuid": "de32fb6b-9529-4a35-b697-dae0f9aaa552", "comment": "Malware payload", "value": "94dae0219abdfd6fa55cc56824b75ab115cc5ddc", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305173, "uuid": "687d2aa2-9c3f-412c-b498-03c6b835ad5e", "comment": "Malware payload", "value": "35bc84a5ad5c6d9a110ddef978bf4b1cebfb1aa935b69d0bb617be1be1ac721764e717fdca3d3b30a2b9b83b0c6ff123", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305173, "uuid": "cd7505b5-5655-496d-8c8f-2342e6509669", "value": "T115F51111CA45CD65066C102524AA5E8B25500EB79C4837BA3FAF4F8D1F1FA5FA1B83FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305173, "uuid": "78df293b-195c-4ab8-b443-9f25934dda97", "value": "49152:/NS9VdNlB8DqqZU3fLesfJGuFXHf/5+IJx3prB01ENsZ:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305173, "uuid": "cd94bf8c-be49-4b03-a019-8a38255371ac", "value": 3590481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305173, "uuid": "854894d5-a761-4e02-abfb-ff76157503a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305173, "uuid": "6be79305-3a96-4aed-950b-a17ac7482962", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7723601d-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770307947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307947, "uuid": "3d68b5c2-4ec8-43fe-98dc-cc9cc689f8fe", "comment": "Malware payload (GCleaner)", "value": "43ef8997a5a9c85b285b3a015e94a087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307947, "uuid": "58a72a12-6b8a-499b-9eb1-a8212c3cc421", "comment": "Malware payload (GCleaner)", "value": "198264d55b0b4ceb6772603c2e0bf46d3815a1b6059ce06aa5b62f10d6c3f1ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307947, "uuid": "c75c1ded-fdc8-420d-9bd9-4f8f847807a6", "comment": "Malware payload (GCleaner)", "value": "6350fc1f47aeabb812c4eb27b5ed734083714662", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307947, "uuid": "f3ef2a61-a5e7-46f4-9241-8cd44def4d58", "comment": "Malware payload (GCleaner)", "value": "6dba3c0ce54ce0b91c3dc00b4f90b307c046e14f69b1db3d5fee6b858d8384630a003d254f7cf8a4687643781fe2cf37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307947, "uuid": "230ea502-4722-45fd-b4e8-bd06b9f64147", "value": "T1E9056E12FAF5C433D1A7167A9C6B86EC742E7D103D38B84A27E529C85F763C1242A787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307947, "uuid": "d768bffb-3cb9-4088-938d-887f36c81b5a", "value": "421f57ebeade5946b16f0c3c541d2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307947, "uuid": "175b5998-1c22-4f6c-b413-3fdeba188939", "value": "12288:P9eONBtJzhKJd6EPXNQyxbLSoPZgRgnczhxm3UKc4SG:fnzz04EGOzxg6czhxn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307947, "uuid": "249cae70-7819-47b1-826f-027ed9275ff5", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307947, "uuid": "f32b7cb3-b9bc-43ff-8dda-b7ffd8094d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307947, "uuid": "0c7f7c04-a817-40b9-b016-0b7d255a43e6", "value": "198264d55b0b4ceb6772603c2e0bf46d3815a1b6059ce06aa5b62f10d6c3f1ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54860309-02d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770326787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326787, "uuid": "de4c2355-7b8d-43cf-a6d8-997c120f70a4", "comment": "Malware payload (Gafgyt)", "value": "36b305e0fd54405ec48042c45a6f7cb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326787, "uuid": "8b4edab2-64a6-48c8-8def-7783e9a70faa", "comment": "Malware payload (Gafgyt)", "value": "19a21f96ae3d3cd7fc0944aba895256186fe8867be4a7bc0f07152e09985eac6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326787, "uuid": "89eb0cbd-c28d-458f-b2bf-414f617ac32a", "comment": "Malware payload (Gafgyt)", "value": "59ab6ec671aff0db4193e04ba61f315512429d84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326787, "uuid": "2a13f984-21d0-47a5-86d3-a7605b7304ee", "comment": "Malware payload (Gafgyt)", "value": "2fdef6fb658b8a04698bc68445b3fb03acd527b9d241d918ad5cd6c7cf5065448f2f0ccbb43584f17420893972b6c5b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326787, "uuid": "6e95c611-d8c8-4be4-9584-12f0a40de4eb", "value": "T1E7F34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326787, "uuid": "99cce1e8-0562-4b9d-be7b-9fa699a79c0d", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBhYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/XYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770326787, "uuid": "91ebcf6c-f40c-4eb2-8cb7-fc06333164ca", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770326787, "uuid": "dae106cf-2651-4ee9-8a0f-0fa4414f2a1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326787, "uuid": "022969af-3072-46eb-abce-0de933ad9e0e", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553b0671-02d9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770326788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326788, "uuid": "a77eb0e2-d1df-44dd-afc2-d79e339580c0", "comment": "Malware payload", "value": "5d1526a5ce2231e42d191713b6aa93f6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326788, "uuid": "761a7899-3f69-443c-a5f5-0874bd01fe0a", "comment": "Malware payload", "value": "19a8dcf148d2755275417e781421d78de2ca5d3a316ea83aa403359fc70ae7ca", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326788, "uuid": "20a20097-eaaf-4b85-9f3e-c1bd80a13ff2", "comment": "Malware payload", "value": "6187b3c5d6c9ec1e776e3dfa919751623eca40e8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326788, "uuid": "c474ed72-a520-462e-9957-77a26839bea5", "comment": "Malware payload", "value": "3881691aea3f263bb55c731e62ea7d3321c461ac56a6bb286f2befb6c247cc8f3e8567e0433ccc78b1fca9193f490725", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326788, "uuid": "894b474f-4b76-436e-bb2a-ed3145c25f83", "value": "T133417FCB12A107F76CA0AC37727588A0F8E0A15598C55F867AEC3CD448BEDEDB446693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326788, "uuid": "3cc98e83-7251-4ad1-83b4-2c149bcb1f55", "value": "48:1Hd8RgRttQdMRgqbDCpLTuDD2BwoL365vBwDs7DFT:1Hd8R6ttQdMRgqbepLTuf2Bwor65vBwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770326788, "uuid": "e113f8a3-ada0-4d58-b751-c1bcbe28957a", "value": 2140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770326788, "uuid": "a31cd6f4-40da-4d63-bdaf-0353281c1127", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326788, "uuid": "4775ff94-ecfc-4685-a4db-50bc34dae20a", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c20f8d-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305601, "uuid": "caa01df4-0eeb-4a30-8aea-3b4d8672ea37", "comment": "Malware payload", "value": "05b3cf1a5fb18a7dc52af11f15426d70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305601, "uuid": "268288d0-e5b3-4b5a-bbe3-15328958bca3", "comment": "Malware payload", "value": "19bfa8da0d95458f8bc55724308d83120368ecfccfbce3ea0b92c10642a5f89c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305601, "uuid": "310dd7ed-1bf4-4ee5-97d8-250c9aebb8e4", "comment": "Malware payload", "value": "89ff49705157de544346b29bff823b6b86fe8738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305601, "uuid": "69088018-164f-4c74-bfb5-4deb663bd03a", "comment": "Malware payload", "value": "b49d79cededcf293b677c154f093020d75e1fbbaee7d2403be10f601e0e20a2f6dbe44e167525c94bc4bc65241042810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305601, "uuid": "f2ff8f80-dfe6-433a-b670-2438f63d4529", "value": "T1B445BF027391D062FFAB92334B5AF6115BBC79260123A62F13981D7AFD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305601, "uuid": "54e13396-740c-4b78-93cc-926b1e43af22", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305601, "uuid": "77f830b1-1256-46ea-8bd1-f959586a9825", "value": "24576:F5EmXFtKaL4/oFe5T9yyXYfP1ijXdaa34hy96PS3cMd41Ixzy:FPVt/LZeJbInQRaa3Oys6ssl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305601, "uuid": "b9e3f4c5-fb2b-49a2-bd66-1ff5a8332f7e", "value": 1251328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305601, "uuid": "5f678a35-fac4-4c95-b954-822cf6ec7b80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305601, "uuid": "b3a84e16-656b-4645-af1a-9af4f27809e9", "value": "19bfa8da0d95458f8bc55724308d83120368ecfccfbce3ea0b92c10642a5f89c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c972542-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305326, "uuid": "f4ad5b28-ae15-4dac-a730-851023a363c7", "comment": "Malware payload", "value": "3e388f409daa3bd93be9f6911786b33a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305326, "uuid": "846f98e1-0069-46f0-8838-43257f06158b", "comment": "Malware payload", "value": "19c6aa014138c287046d611ae8cdd77803a8251fe63b8174aeb085da1a2e0f90", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305326, "uuid": "f5a496c6-8b02-4467-839f-dadc300dc2a0", "comment": "Malware payload", "value": "975fe44bf6ccfadd3c519543d0fd9468c30fb27e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305326, "uuid": "8c7c4eb6-79c6-4829-a477-c9982e8e19c4", "comment": "Malware payload", "value": "efb84b29c4c028cc1227c314a24bfab9e50fbe57d54a4aadd91cc7ea7250c5fb92773643aa4ccde1da3dced9b0d1d94b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305326, "uuid": "4b3d3b3a-82eb-40e9-848c-0e5dd014c47f", "value": "T1DCF512C0C8432970AB3D5421CA5FDB39201FB4B226266A195E55B2EC7E5C4F7CDA62FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305326, "uuid": "f36970e6-99fb-455e-9071-d35b937a51d6", "value": "98304:UruM3Li5YXEMyvloUuo2Cl5Gfj3VZgDxlICerAi:t0glrGD8HIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305326, "uuid": "20317eee-89fd-4427-9f0a-4c3bf69e8a20", "value": 3614196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305326, "uuid": "9c4dd583-909e-4fa4-abfd-b7b0c08cb435", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305326, "uuid": "1f6185c4-40d3-483a-9e13-bd58d7e805e0", "value": "P03 - K132.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64cf5702-0231-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770254659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254659, "uuid": "229f1312-35fc-4bf8-b651-38ea9b2e08fa", "comment": "Malware payload (Mirai)", "value": "ac69be56a01b88c5fea7cc80d41df745", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254659, "uuid": "4fa065e4-785f-42e0-ac93-bf8706ec0d98", "comment": "Malware payload (Mirai)", "value": "19cff90d701b015b2270e1f84d8da5c1bc6fe6dc1d950227d030c03d19c8842c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254659, "uuid": "32246be6-28c9-4079-bf6d-0f574faf0cac", "comment": "Malware payload (Mirai)", "value": "9878f61bafd81b145a61032d4ebbf1db275956c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254659, "uuid": "996d34f6-88ed-4262-9e60-9894d6db0e9d", "comment": "Malware payload (Mirai)", "value": "cf3d878099acd305f7452783a81e13e5c201905851e1b212c1be2c9156b578b3c849a04f86873e6370d308205cfecd2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254659, "uuid": "6bf06751-0462-4ecf-ae27-601c6557c7d8", "value": "T1A684FA6DF4809F7ACBD0617EFAA502CD33374F68EBD9720589356B3437E6A25943A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254659, "uuid": "d3346bea-0379-46ab-91bc-a6494c971475", "value": "6144:kYtKIBaRqHwl0LQRSU4V2Fh7uXCDx/1VFLcQpAUvrKCUQNIXyEZ31qbWpuhhgIKx:kYK6QFLcQpkxyKTufwjDExjM4lC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770254659, "uuid": "c86a9e11-bce0-48eb-9636-ccd8c378d30e", "value": 373588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770254659, "uuid": "50a2acd3-e481-4bbc-b651-545f9c009beb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254659, "uuid": "1962c274-85f9-4c3a-b106-ee5db10f707f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5482130-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770308105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308105, "uuid": "2b17df60-43b2-45f7-a8a2-75499d3ec487", "comment": "Malware payload", "value": "5c821510e0645dfbf2a20276158ec88a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308105, "uuid": "f4542a6f-37f4-4ca7-b6c8-6c157acec077", "comment": "Malware payload", "value": "1a14add7f90c2b8996860cf6d45f5472208ffd26a2abe1c9c199081d2d801517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308105, "uuid": "483d1fed-7ef9-49b6-aff5-a226c87fdb64", "comment": "Malware payload", "value": "21401d7ac3569662df6deddaeca2fd0c95f811b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308105, "uuid": "ec2ae266-f5ff-46f9-a129-edcca7162048", "comment": "Malware payload", "value": "e05bafd77d674cfe844ecb991f60c2249847f18fe2de93206438652e360c41441df4e275639cfd3b5d9e4e91d22cc879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308105, "uuid": "ed34041a-9c7f-405e-aceb-48480f2d3ad4", "value": "T13794E516EA20B0A6F89345703DB9A257392D3D3A2640EC0BB78D9F463A7199371F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308105, "uuid": "b76af7d4-7e23-4f7d-be72-c58ae7f0ef2e", "value": "6c0d218025ca9cc7bbfaca4b638f44fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308105, "uuid": "540db82a-47ca-4b66-bd35-172f63994005", "value": "12288:QUl34wGTwXxFdXGbZ4nGT0urETQup/zEHI:3sinJCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308105, "uuid": "f1ca00a2-bfd7-4f7a-b11b-f536ff2f7da1", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308105, "uuid": "7fba35ad-f669-4533-a09b-a56a2d6c3bbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308105, "uuid": "e0e6bd1b-d7bd-43c7-83f1-1fc1007d7e05", "value": "1a14add7f90c2b8996860cf6d45f5472208ffd26a2abe1c9c199081d2d801517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f052305c-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304714, "uuid": "8166f1c6-ff06-4d00-9ec1-21138753212a", "comment": "Malware payload", "value": "29e58c735afd8fad09a6dfd4cb698793", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304714, "uuid": "17525249-4888-433b-8efc-8c237808fadf", "comment": "Malware payload", "value": "1a1bab2ab18299cc4729f33d45fd4bac83db69b88451813608cf0bbc866022ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304714, "uuid": "dc8dfcfe-d1d1-44ba-a3d6-682f25ee38bc", "comment": "Malware payload", "value": "8b31b5381e726c8d492b5470a0e4ffb6bdf09167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304714, "uuid": "2cfd8670-a19d-4ada-bc67-c2405236b226", "comment": "Malware payload", "value": "3cb1cfa27502ef0c431a6f1a341a35e9fe1bd95b3cc0c519a5a805dfc555aebf6210842e3a65eb9620b2c3fa3425bab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304714, "uuid": "83e3ed47-fd72-4fb9-a790-432888d8e734", "value": "T19294F616EA607866F89345742E78A247382D2D7A3681EC4BB78D9F0A32719C771F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304714, "uuid": "d11a5b93-ce32-4a9b-8b90-dd6b7181bd94", "value": "a0fb42aeb8daaef9fded848ceb5e1b3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304714, "uuid": "5d9b7929-8db7-4f70-886a-169e83d0421d", "value": "12288:r0rbeNy672YZlzQqWgD4cWdKChM8TKRz:iCzOcWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304714, "uuid": "cd0fb0f4-ca37-479b-8dbe-7a0347970a74", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304714, "uuid": "7bf5f7cd-49a3-4087-9b60-a4934e8854c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304714, "uuid": "759d2c82-0c16-4342-906a-3f3d6e37c2c1", "value": "1a1bab2ab18299cc4729f33d45fd4bac83db69b88451813608cf0bbc866022ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b7f6d7-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770304665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304665, "uuid": "133c22a3-7a97-43b7-ae8e-79053f8df256", "comment": "Malware payload (RemcosRAT)", "value": "82cba08ed09ccb1d4c708b83b04181d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304665, "uuid": "ffb80691-55ea-4b74-acf5-b8a7df2b5282", "comment": "Malware payload (RemcosRAT)", "value": "1a87669db3798931f99742c6bc0c40eaa097243f85fbd11af2f524fcbb57bba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304665, "uuid": "fd30d296-27aa-4c94-b45d-3a77b6e95f87", "comment": "Malware payload (RemcosRAT)", "value": "9af0fdebaf75e16ded49c05a748ad17dcb28f78a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304665, "uuid": "190e13d9-3b78-48b0-8f97-4b1df0a6d354", "comment": "Malware payload (RemcosRAT)", "value": "7db3bc0b3af373fc84e9d07a92bf30c2d8751bd5bbd7d48ff73e29133ae79e0f771ac8d1666d6244290993f128d5667f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304665, "uuid": "ac91904f-6960-478d-8e66-694d4b1024b4", "value": "T19405018477A9DB03CA6A0BB00960F179137A6DDEBE51E2039DE57EDFB974F005900A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304665, "uuid": "74132ba5-f3d0-47fc-986a-69d731b8d187", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304665, "uuid": "5178ff20-a245-42e9-8a1e-906181850782", "value": "24576:D58fmms5x3ZdK4myUFXs6RjaEsTX2lAf75T:umt3u4my56ROX2q7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304665, "uuid": "bd6bcf94-55e6-45f9-baa2-89c79ec31220", "value": 816648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304665, "uuid": "c4f08881-60f3-4066-8798-01286b47a6f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304665, "uuid": "9a5cbada-694d-496c-9be5-585d01df4dd1", "value": "1a87669db3798931f99742c6bc0c40eaa097243f85fbd11af2f524fcbb57bba2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8902d3b-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770307305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307305, "uuid": "748e22a5-36b0-474e-93d5-8c2f8ed12a80", "comment": "Malware payload (AsyncRAT)", "value": "e8e67a5f85c4a1dcd9331407b73c3674", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307305, "uuid": "b7821f63-c2c1-42f9-87b1-7bdcbf67ba13", "comment": "Malware payload (AsyncRAT)", "value": "1aa219be60d23b7a354a927fc59b5af1ed98f78dab91a71fdd5ac1dc3ba23020", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307305, "uuid": "1ebce950-fbbe-4063-9492-5e8b50dd590e", "comment": "Malware payload (AsyncRAT)", "value": "e22d8aced3787e88ad5030937c8d477398af0f01", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307305, "uuid": "1f7ba54d-3758-40bc-b144-62a25071f73d", "comment": "Malware payload (AsyncRAT)", "value": "4227d35e42f98adcd6d6ab70cb2b5ba624b05476e3ead25f35d4a292c82fe15264ed71ea195743631f2464aa650aa0a6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307305, "uuid": "aa370c13-67f3-403f-a157-61310d186bea", "value": "T183232B003BE8812BF2BE4F78ADF26145467AF1636603D54E2CC451DB5A23FC69A426FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307305, "uuid": "34ffc77a-bc51-49c7-954e-52fee53bbfc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307305, "uuid": "01d3cb03-0a34-4c23-86d8-c86c0019104a", "value": "768:mu/dRTUo0HQbWUnmjSmo2qMwKjPGaG6PIyzjbFgX3icGdU5rIlICoQ8b2ymN6zvQ:mu/dRTUPE2kKTkDy3bCXSnUuymN69dyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307305, "uuid": "dd97f5d8-8df9-4d2a-a92f-4437dd6cd7e4", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307305, "uuid": "f9facea1-dfc5-4dcf-93e9-26fdcee90429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307305, "uuid": "061b5d84-9ae5-4d32-bf80-91e17eeac3f6", "value": "1aa219be60d23b7a354a927fc59b5af1ed98f78dab91a71fdd5ac1dc3ba23020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cbbd5d-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307114, "uuid": "3832a6a3-6717-42ad-87af-d6ebef287044", "comment": "Malware payload", "value": "6db669344849c85e28ef0210d5442c75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307114, "uuid": "e631f797-93a3-41f0-b611-31c1fd8a8dde", "comment": "Malware payload", "value": "1acc71fbc254d0d70f331a0f73a23ea16e751fa8ab9c2aa0482fd96237a7a76e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307114, "uuid": "8d993273-9765-4114-be44-377bca731b69", "comment": "Malware payload", "value": "38885c699d498fb1df18363e8657e7ccdecf56e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307114, "uuid": "4708ebb0-7e33-4b31-b3b9-4e51c7a0c5da", "comment": "Malware payload", "value": "9e7d742d085ac161e725454971c33133bffa9c32d8ff04fdbee947a07e208c594f37f3f5202c7a6489aa87d4c1190487", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307114, "uuid": "c449e255-3fa5-49a6-a904-ec2ffe71864d", "value": "T1C894F616EA50B5A5F85349703D79A25A682D3C3A2640EC4BF78D9F4A37B1983B0F470F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307114, "uuid": "390676af-a299-4b1b-b2bd-ff64add4a3b4", "value": "126f9e9170645160b2b5af018f72a2dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307114, "uuid": "81f54d7e-5988-48d1-965b-f82edc833dfc", "value": "12288:zuofjfImjXm5ftolCn7hLSlvqro5QKmLwpV:Lr07hLSlmo5xL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307114, "uuid": "a446374f-c213-4d8d-a7d3-a1860d264591", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307114, "uuid": "88feeee2-9b33-45e1-b0d2-e5802bef7a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307114, "uuid": "69cf9e5d-61f5-4509-802d-88e605423613", "value": "1acc71fbc254d0d70f331a0f73a23ea16e751fa8ab9c2aa0482fd96237a7a76e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c828bc-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770303376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303376, "uuid": "a7817080-ca5d-46fd-83fa-c5ba055b8805", "comment": "Malware payload", "value": "eaafc56f873a66ee62fcc8a7f64daa8a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303376, "uuid": "44aa7c52-c55c-48a4-b5e9-efb0c5ca9c0c", "comment": "Malware payload", "value": "1aea7d7dc796653652780ab61eb130e1c577c6696f1e3615af9729438f476f56", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303376, "uuid": "ca99ea50-12dd-40d6-92c3-0216cfd3da92", "comment": "Malware payload", "value": "a7ed332e96b1503fc6093e1df47daa8994e9f6b4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303376, "uuid": "83411eef-5c17-49cc-b810-abec150c8e67", "comment": "Malware payload", "value": "f9dfac568526ee656e9e98752e7748ad52b1de0f1c3443a8b3e3c6adf91819dbd518b57f214822e80a818f12bc818b8c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303376, "uuid": "c530e4ee-6365-4783-91fd-859f12d5c096", "value": "T15C55121E66A20C1D4F6CBBEB71B9BC022EE884CE742F90CDD7CD7051BFCA5A545A4468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303376, "uuid": "ec0d4962-e17a-4915-b8c2-52f2d57c7086", "value": "24576:HLxpGGsfRBRqtG1C1vMi9jQsntvAYOSB5hg3+eXCZQbdtdc:HGG6Bk/PjltvSQWd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303376, "uuid": "0b2b6b68-9e4d-4f49-8e3f-99f0d7544f69", "value": 1344433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303376, "uuid": "97c07fe1-3a14-45e1-ac5d-6e8114260580", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303376, "uuid": "77cb2eec-720f-477c-af57-1cd48cd93701", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a526cdf-0268-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770278264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278264, "uuid": "ff6418c1-7ea6-41e1-838d-890bb3f0cb94", "comment": "Malware payload (ConnectWise)", "value": "e8edd38bbcde1db8e7d63b93cf2cd6ee", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278264, "uuid": "c4f37458-1910-4209-ba29-b3aaeccae18a", "comment": "Malware payload (ConnectWise)", "value": "1b73e75f62d558a4890ab0968428c7d89e3f5b0ccbe0d1a5029e46a5297f830e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278264, "uuid": "c4142e7f-f52c-4a59-b5a6-bf5d865673e3", "comment": "Malware payload (ConnectWise)", "value": "8ce7994d0fd7a25ed8aac15569ed1033f088099e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278264, "uuid": "8e6d5353-8a14-4350-9a99-3652775e24a6", "comment": "Malware payload (ConnectWise)", "value": "9b079ba6e8d487e460b4d0bfd7fdad3d7c7c67b751226e1f9a851e7ae38f7412fdfe7e425f31bcb6616ed7f070c1cd61", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770278264, "uuid": "8c61f6b2-ca95-4c83-8d29-3d26a1e39048", "value": "T116A6233066F8D226F1BB0A31FD3991B14C7ABC64E922C15F0364391E1DB5E81AA72777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770278264, "uuid": "78aa3abc-8087-439d-9df7-42fe787ddbdd", "value": "98304:sqPUuYs+fvXPYGyOQ0G3L3WsjOW9BMQYqPUuYs+fvXPYGyOQVqPUuYs+fvXPYGyl:sgnsvfi3WsH9BsgnsvfYgnsvf7gnsvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770278264, "uuid": "27597837-c0c1-4ada-9e44-9f96c6c8f50c", "value": 10063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770278264, "uuid": "9669f779-3b2f-4136-9b8b-09a9981b0b18", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770278264, "uuid": "61b3243c-4aab-4f7c-a86b-09f595a33617", "value": "DocuSign.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8a9e43-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306270, "uuid": "162b8d93-158d-4bc6-bc12-84676b410d0c", "comment": "Malware payload", "value": "f205f00efb42229778d523896722dfc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306270, "uuid": "7596e090-bea4-4563-b072-b80168fa7372", "comment": "Malware payload", "value": "1b7b93eb32d9969e2293c521c2b010ac5142ccdd8f9853ea418bad64c056fbf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306270, "uuid": "be0b80d4-cd9b-4a72-8e84-23027f254c2b", "comment": "Malware payload", "value": "70e142d2c24a0fd8dacdf65be82e5bce87fd22ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306270, "uuid": "304bdb7a-7dff-4deb-8354-558009f4cf02", "comment": "Malware payload", "value": "3106818ff8f31beff20d1fa8b08aa2ea02034829c7b972ec3385d16278e52add865220546cff3808a3dcc7927b848e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306270, "uuid": "8fa8844b-954d-40ed-bca8-9a516e3eb12c", "value": "T1E195239E7AF12733DB97E73EA515A59E5C018053B603F7EE70603AA92E203D9E01DC18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306270, "uuid": "5a10b9a5-07fe-49bf-80e7-4fcff086e7fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306270, "uuid": "6268337d-1cb3-4369-8c82-bb33b2a6ba64", "value": "49152:uUYdj95lult9S4TQXl7/d+T6BauUEMxzZS:+dj95avUXJdg6Lxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306270, "uuid": "f1ac599c-5369-416f-b1d3-35b3db1d9203", "value": 1969664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306270, "uuid": "34d64c9b-86ff-46b6-9e57-f94ca8651efd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306270, "uuid": "97b56e1f-a1fe-40fb-8f2d-17e3153afbfc", "value": "1b7b93eb32d9969e2293c521c2b010ac5142ccdd8f9853ea418bad64c056fbf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127f953b-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770303913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303913, "uuid": "f8ed44b6-e860-4b01-a330-f09564a5bb9c", "comment": "Malware payload", "value": "88d469a0d7f4bee0c8f50dcf5a9883f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303913, "uuid": "6a67d1ae-4ae7-4eaf-bb5d-2d18fe3519d6", "comment": "Malware payload", "value": "1ba7b11eeef611157b460daf8bed0ee6187130897818242fdd6de9ff91f78e16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303913, "uuid": "1e44f9f1-cc5e-4036-93dc-4ac46b4162d9", "comment": "Malware payload", "value": "ae94f8446fde16ad9521088c73d71526ac0f3855", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303913, "uuid": "8789e855-ef54-409b-8f07-7dc88371b1c1", "comment": "Malware payload", "value": "fcc5bc186e196b4da8ef76a420fe82ab759fe05e3085f5daa3a3b28a5a0c41d051270dc3b27ab5851d90d97016e9bd4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303913, "uuid": "e2a235bf-cc11-4830-a953-c9cbbfa4bb94", "value": "T10BE4F141F3C0FDE6E4A91973A83EC7651E03EE1A80A6471B5162B50A6CF36D23617EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303913, "uuid": "a1628a1a-6b7a-41ac-9f34-584ec421421f", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303913, "uuid": "9dc71795-7a61-4198-a2fa-d819e78fc4f0", "value": "12288:KbkS1rk0Ex1IMQz5GNPtnAPzXZMTv5lsm8wJsWZl7MeeXGv:KbzgZQz5QxAPrOTT8wJDZ9FX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303913, "uuid": "e78ba8ad-21c0-43ec-9680-2c367b4d0b56", "value": 719384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303913, "uuid": "7eee34b1-99e3-4218-b2f1-2be35e4aafd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303913, "uuid": "bb714e0f-7131-4dce-9db3-f55d4c98a68e", "value": "1ba7b11eeef611157b460daf8bed0ee6187130897818242fdd6de9ff91f78e16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d2cce2-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327321, "uuid": "bdce8804-3ef2-4868-af04-b98abb07d2a1", "comment": "Malware payload (Mirai)", "value": "b590de7e8cc166e045d9a6ae72ef6871", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327321, "uuid": "a285c39f-1961-47e7-8388-058d5df46fb9", "comment": "Malware payload (Mirai)", "value": "1c12061703f7b72643c940912ca639c61ec8efc32c774864449ad1d9a317f752", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327321, "uuid": "b123faa9-0c78-4e30-838c-8c50479ad9d2", "comment": "Malware payload (Mirai)", "value": "076ea431c88a8b4860506fba6f42b2b69f500416", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327321, "uuid": "f12bf7a7-cef9-4299-b7c1-2b22e34c498c", "comment": "Malware payload (Mirai)", "value": "15201dad67b77e96d766854f8ce1aa88088de632f15088c2e4cd75426a5b149979ec9f6045e0d33114db01a696fa5c00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327321, "uuid": "407263b1-ffd1-4cda-b012-4830be933c74", "value": "T159B3E84E6F219F7CFBA8C23447B39B25965923D237E1D685D1ACD6001E7024E642FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327321, "uuid": "3677f936-f6bf-4527-a79b-eae822a55edd", "value": "1536:fMcpxRXRB8huBmOElgZ1oszQOxJIAj7LA2YXkvDP5L3zr/q49FkreH97vlTKq:lpThVgOEWIAj3A2YX8F3zr/q0FkKlTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327321, "uuid": "b66d0f28-0a54-41f6-ad0c-304bd071d4b1", "value": 109764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327321, "uuid": "9d3d6254-9506-4343-bb4f-12830a6b5575", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327321, "uuid": "5e5287bb-9a54-41f4-bab7-1f10e8a747cd", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e92c38a-0276-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770284176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770284176, "uuid": "438debd1-7b5c-4334-9e5a-b406ba0a9e5f", "comment": "Malware payload", "value": "aad2704dfe951b1b5fecb1fee8227129", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770284176, "uuid": "48422748-c869-4cb6-b43f-c85762c2b7b4", "comment": "Malware payload", "value": "1c2fe37aeb01296746d7b14f041caaf73ff282b3c973683fc74d0ae6ee23e368", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770284176, "uuid": "2e2f5602-aefc-4470-b688-a327e2d91bc4", "comment": "Malware payload", "value": "011148a1b17e965d70a7e417f3a260904e2dcaac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770284176, "uuid": "35656558-0a23-4586-9a18-67a51425942a", "comment": "Malware payload", "value": "950e8083d253ac3f8a1832afcbe54a7b4cc766343e3bdf449eb81c28f6f84a0c24be275eb124443c2c5dd643f91073ba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770284176, "uuid": "fb2aa9ae-c966-4146-b688-9f8d2074f5c0", "value": "T1CE2523CEE6E126F8E465217C0E7F7F1C88AD9D346409DE2682507FEDBC25E05206725B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770284176, "uuid": "4b2b1d8e-b663-4bbf-af26-bbeacdf2bd54", "value": "74179e0a8fa4b02eb430f615d9ea4730", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770284176, "uuid": "96bbab52-af53-44c7-8a8e-cc0ad499eaf9", "value": "24576:O/gZhxhL+cW9JdFvN8/6WsgzSclWKGsAnvqsY6xP12DFO+7Vkl2:W6hxhL+cWHdFF4ygdUKGsiisYQ2pO+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770284176, "uuid": "2bf248bf-4478-4084-936b-77c9899df0a9", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770284176, "uuid": "a4308ea6-d089-494e-9c4f-386dae7288e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770284176, "uuid": "028a2336-2b45-4e46-b8e7-605a3a1df1b7", "value": "log.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f626eb-02ae-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770308235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308235, "uuid": "ac0c1d1b-b3d3-45a9-9cc0-c54a61a4e668", "comment": "Malware payload (SnakeKeylogger)", "value": "732a5e9f7020c249a8a8a431f369cb17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308235, "uuid": "2206f82d-9f43-4246-bf88-638750ab139d", "comment": "Malware payload (SnakeKeylogger)", "value": "1c3fae6e24114ba4b4e5f1aa7b1ab0ad416086eda658b218e14526580c8f4072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308235, "uuid": "fca176da-48dd-4e79-9dd5-e828c540f13f", "comment": "Malware payload (SnakeKeylogger)", "value": "87c5a07ba04cc176a086056c515d11c988338521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308235, "uuid": "7c4a36f6-bc54-47f4-a7b8-d5c8a87a51ba", "comment": "Malware payload (SnakeKeylogger)", "value": "2ac3e49883fbb283e452cc3c55474fb5b3fcbda38d5f3eab76e63def47d07aacd27aea0c9b30d42945788bd499ff5613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308235, "uuid": "36072eac-8d47-4a78-8d4e-be115f8efa57", "value": "T16A85E00273C1C062FFAB91734B9AF6115ABD79260123AA1F13981DB9FD705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308235, "uuid": "e0ccdf14-d121-4388-9ba8-dc758543d95d", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308235, "uuid": "49e49eba-c598-4db8-8d68-4ebeb732fc4d", "value": "24576:o5EmXFtTaL4/oFe5T9yyXYfP1ijXdaNXm0LP3mGxxlsqjnhMgeiCl7G0nehbGZpv:oPVtGLZeJbInQRaN2um2Dmg27RnWGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308235, "uuid": "99aaa74c-3790-42b0-8dc8-8cb0794d4d6c", "value": 1752576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308235, "uuid": "2c76c81c-5bb7-4382-a96a-64eab58d817a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308235, "uuid": "90e98832-7657-4ab4-9a91-3a67f8507071", "value": "1c3fae6e24114ba4b4e5f1aa7b1ab0ad416086eda658b218e14526580c8f4072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61bfbd93-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307482, "uuid": "bf767f59-5ad5-4214-969d-f97db120baa5", "comment": "Malware payload", "value": "80491faa282a0975e12a720b2544443f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307482, "uuid": "b244202d-8207-4b1b-a98e-faec2e4b5039", "comment": "Malware payload", "value": "1c6f57f7686116d7957fe013004126a7112bb54e689850ccfeac982c40bf469e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307482, "uuid": "2e5888d4-c583-4c5b-8a15-5933d4113c75", "comment": "Malware payload", "value": "b87b595a20a33edf974d076c50badc93deb7aaa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307482, "uuid": "314a2a59-d52f-4d92-bad5-202b1923bc14", "comment": "Malware payload", "value": "889b36f06bdf1254d58bfec183ad43d374f33ac8cd3698fc0b337f967b506926adea9585e125bb505098f1b7ad5152f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307482, "uuid": "473b3b37-e133-473a-a1bf-3e3cd1b71ea0", "value": "T194247A67B42CA7AFDEDA2F32ADDE8A2353A65FC4C991103E0C44730E3C671095E39566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307482, "uuid": "f25eebc9-4cdf-4b98-a74f-8758ffe6b2b5", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307482, "uuid": "f383ee40-d9b8-4603-87ab-5d71f3820672", "value": "6144:vynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g3N:anO56dyO7Wc8oNrRHwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307482, "uuid": "6ebe0726-4ed1-47c0-914c-bc4be2e951c1", "value": 227800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307482, "uuid": "165d3a2b-9870-446d-9efa-6f99ff17480a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307482, "uuid": "11f92c04-2c37-4144-8df4-80001bd1cc2e", "value": "1c6f57f7686116d7957fe013004126a7112bb54e689850ccfeac982c40bf469e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d5df49-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mydoom)", "timestamp": 1770303653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303653, "uuid": "eabcdd88-6789-474f-8013-ba7bf02eed24", "comment": "Malware payload (Mydoom)", "value": "ca278f89824635b4a3d4cbf347695a93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303653, "uuid": "1695974d-51e7-4c4e-bc28-49338056fa28", "comment": "Malware payload (Mydoom)", "value": "1c805c1ea96436b23fc0859c4f6fb618502b6d6eea272fb5622c044ae8b31247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303653, "uuid": "b0ce77c9-af13-411a-ad7b-83e52a9bbe35", "comment": "Malware payload (Mydoom)", "value": "592615d6d0b02e33af8b8d2d479d03e3fa01e8bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303653, "uuid": "f4331a3b-6464-4dee-b1d8-ed0ff8ab4639", "comment": "Malware payload (Mydoom)", "value": "035f7d7eef07e3043047262879a6189372b1f1e1d92ad8197510462a52b1676e2df88ae9abf359e3327c59a66d58cf03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303653, "uuid": "79c42520-c0d6-4ff8-b0de-3b68a495d246", "value": "T18DD2D0CE6607ECE2EE0FC3714B1782A91041D8744ED1A73625E17FBE6C70298B96D155", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303653, "uuid": "c40e911d-d812-4f81-9fd5-ade179bad0db", "value": "12a80370f74bf0dfc88c4d492bcf1834", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303653, "uuid": "c818d309-7081-4476-8842-82512e44eb15", "value": "768:3ozIdit4r99vNtjU4aMd9wi2vXQ5mSrit8az4:4zOs4hNws9gvDSraz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303653, "uuid": "48c54cdb-2315-4cdb-978f-d238703eca2f", "value": 29859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303653, "uuid": "ce495ea0-5307-4668-9c32-820d0cd4f0c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303653, "uuid": "b27a9021-2636-4053-9696-bcc16f6fdb18", "value": "1c805c1ea96436b23fc0859c4f6fb618502b6d6eea272fb5622c044ae8b31247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e286ec7-0285-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770290833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770290833, "uuid": "b394faa0-a003-4a05-bc98-024ef60c55c1", "comment": "Malware payload", "value": "827cca22875ad849da744755416e883e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axis Bank", "colour": "#BED76C", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770290833, "uuid": "4492dd2a-06e9-41ea-bb44-ec0602cc9163", "comment": "Malware payload", "value": "1e60421e83a317cfbfce980fefa926a847964bcc7b047908db65161148d0f624", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axis Bank", "colour": "#BED76C", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770290833, "uuid": "e2be58c0-abcf-4c0a-90d7-098928012a61", "comment": "Malware payload", "value": "c838c2fff82773f826cf9250522af5786920b38d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axis Bank", "colour": "#BED76C", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770290833, "uuid": "cafcf0cd-e52b-4bef-86fe-78c7f4a199c6", "comment": "Malware payload", "value": "fab5b5a327023f379a5fff67f67b6c21e05aa33ab0f6c84a5e78f16d399eda2df7c3744a6870a851bc202a6c7b5415f9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axis Bank", "colour": "#BED76C", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770290833, "uuid": "9abba49f-9bf6-4b8d-88ba-ac8bcb530a5f", "value": "T13307CE23F50969A6DEC6A135F5E3479136340D580793A229271FF026FDF21CECA76AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770290833, "uuid": "f01ca799-72c7-4593-a8fe-72ed73baf4d4", "value": "393216:HrCeWWK7n7dHgB9du0S2GyeiDbC7HsvPMJ+zPTiRkmAgDUm:meW/7dH+K9n4bysvPMJc2RkmAgDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770290833, "uuid": "99c4337f-7e4d-4b7a-8e4a-1e2ece0503cc", "value": 17757778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770290833, "uuid": "1da4cded-b481-4df5-ace6-bec362094882", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770290833, "uuid": "0a1b745d-a7ea-4ff0-915c-0e5e69e24cac", "value": "Axis Mobile.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab3c855-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770306987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306987, "uuid": "9d16ed8b-c634-424f-98b0-7a435f3fd8e7", "comment": "Malware payload (AsyncRAT)", "value": "31a70b06d091ce9670daad3f038afa5d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306987, "uuid": "4b66a7ed-063c-4e47-8a7c-114c4956603c", "comment": "Malware payload (AsyncRAT)", "value": "1e92c5d7ad812ca338b0e85bf1decfa613ecb31376cf21888d45f474a06921af", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306987, "uuid": "1660e626-b5ef-4c82-a296-a139e0707ad3", "comment": "Malware payload (AsyncRAT)", "value": "ae8a853f7a4dce451a97028b4148af01d3b586ca", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306987, "uuid": "756d0728-8d0a-46aa-a827-bc12df392a3d", "comment": "Malware payload (AsyncRAT)", "value": "9d68d61af1ba8f0c2ab87ffc4359fd3bece7d8d6066ff1dddb1d56506444199bd4db52d18ea8932e6f5aab429547578a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306987, "uuid": "dad6f706-860b-49df-9069-f527b7c51d2c", "value": "T12A05DF0813E88658F8BDAB34913736154BF0B40AD936EF9FA3C464BD1836B94D697723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306987, "uuid": "848164eb-f852-4990-9a92-42f8cccb5b10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306987, "uuid": "aa9841d7-55ff-42fb-ba0c-67207957e448", "value": "12288:4goCnolCsoYdAA9mJadBeFZYBpqEC1xv0oi7QgYzclg8eGiMahkrwK:4lfMs1hsAdBen2pqpQwclgbtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306987, "uuid": "d607ea70-6d40-4580-b600-a352f2404561", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306987, "uuid": "64722e75-7ce6-4fd8-ab5d-eaf9682e8b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306987, "uuid": "1cf20aea-b788-403b-b8ba-8cc5b3ddd247", "value": "1e92c5d7ad812ca338b0e85bf1decfa613ecb31376cf21888d45f474a06921af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b81247-02ae-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770308220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308220, "uuid": "5b5f9c2b-f4b1-4753-93f0-229e769da413", "comment": "Malware payload (GuLoader)", "value": "aa35917f9e2986db1105ea270882d267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308220, "uuid": "4ea0672e-4626-4d1d-9eff-4c6309650731", "comment": "Malware payload (GuLoader)", "value": "1f8097ccc932fecf1b0ba2997ac3ef35b5d99d2d58408a6a0b45131fcedfc599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308220, "uuid": "a9a4a2ce-6cd3-4da7-a5f5-7765987b4a39", "comment": "Malware payload (GuLoader)", "value": "0ef9e9e113f8c9c18d956dd39a8d2d05194d8352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308220, "uuid": "a96e96ab-6a69-408c-8316-8ca7f4851620", "comment": "Malware payload (GuLoader)", "value": "2496a65815dc6d9c7651d0d27b1fc6ed1b578266f295cad9a8f5f6a875833c55b31112a0e026ae6574a28aece5e63f43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308220, "uuid": "9b45b095-37c7-4996-b8b7-1b4e033ee596", "value": "T1A4D4E11EB124448EF9114B3400F7A21FAD99EE94BE739A5F0337FC565B729112DC3AA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308220, "uuid": "5c768516-8d5f-4c17-bf10-7c9ee9522ada", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308220, "uuid": "e009a7eb-6c45-4b69-b6f7-e2cb04f4313a", "value": "12288:04nN/oHxmO8EKQyJTvq7qrEA7VVf7G16EHrx4F:LNAHQOrKQ0vYmVfrW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308220, "uuid": "39dd045a-fab3-4d25-9782-8bbc7af81213", "value": 634248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308220, "uuid": "d991085a-04a6-4330-a17f-eac355dcf827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308220, "uuid": "28cd0ade-7f7b-4381-b0ee-f51da0e286d5", "value": "1f8097ccc932fecf1b0ba2997ac3ef35b5d99d2d58408a6a0b45131fcedfc599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b52dc3a-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770303928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303928, "uuid": "31f15e6f-54e7-44d8-8cc3-9abc01cee0a3", "comment": "Malware payload (Formbook)", "value": "95849a50fd3796711bfe62d567cba130", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303928, "uuid": "6ffb0c07-7072-45f0-bca3-633a31efff1a", "comment": "Malware payload (Formbook)", "value": "1fc9b63e2a96896034fc104fc42361d36278aebafe2e9afb72e37efe05f37b6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303928, "uuid": "21857442-a1d3-421d-9301-cc6c0e20793c", "comment": "Malware payload (Formbook)", "value": "2cde403224503b6ae5d19dfd7a687ca44fa8f956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303928, "uuid": "d93fd557-017f-4776-b93b-aa4f99ecc80f", "comment": "Malware payload (Formbook)", "value": "8c901dd2225a355a8839bdda22ebda9a9c509140b12e4daa1410dc62f426389a027c72de7ef3015c3da694684dbbec2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303928, "uuid": "b91abd40-358e-45d3-bea9-5fa277f3825c", "value": "T1FC35C01373DE8361C3B26273BA657741BEBB782506A1F96B2FD4093DE920122521E773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303928, "uuid": "b233d20f-29c3-41a3-b59d-817127b2f145", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303928, "uuid": "9ac71bf8-1405-4ed7-ab63-cd0476ec2c5e", "value": "24576:Ltb20pkaCqT5TBWgNQ7aZWUmD+Xg8k51GsUmNQ6A:IVg5tQ7aZWjD+XvmW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303928, "uuid": "fd38dc82-22ac-45b9-9f36-ea6eceb343b6", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303928, "uuid": "a67705fc-3f60-42f8-8056-752b71f74e48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303928, "uuid": "95c542af-e419-4812-bb65-1765f5e986f6", "value": "1fc9b63e2a96896034fc104fc42361d36278aebafe2e9afb72e37efe05f37b6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6326f6f8-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770305766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305766, "uuid": "e98d9cc0-7989-488c-b51b-acde8e674dc3", "comment": "Malware payload (a310Logger)", "value": "54bef49f5b79f8c14bb3ebd5ed226375", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305766, "uuid": "2387bf51-9b20-463c-b80b-2db031ca3a4b", "comment": "Malware payload (a310Logger)", "value": "200ca802b37584347c7e48aa09469811d2b699db7cbc35f8cd0367d7efb108d8", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305766, "uuid": "a02d3206-c76c-429d-86d9-a3e6bf18ca3a", "comment": "Malware payload (a310Logger)", "value": "7ee33ed9ae6b190ca5173f00b911f6cb5ba101a4", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305766, "uuid": "bb9256fb-3358-4e80-8c11-8023ee8cb611", "comment": "Malware payload (a310Logger)", "value": "c0dad40ae6f12ce321db027b5b3db125772d91715b5d65701c7af6d58b0451b142d414f44b2cdb44c5429b1e24ca6145", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305766, "uuid": "6b08ad9f-20a3-434f-97d5-c9fbd97ad9a9", "value": "T1C3845B13EA50A11EF1A3C9F1A9B4925668693D351AE8ECABB7415F5834301E3ECF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305766, "uuid": "784fa70a-9ad4-4f71-9593-0ad87784af9a", "value": "4e88637d5094cca5de1556f3666ec73c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305766, "uuid": "483ef863-38dc-4929-99a8-31b1aaaf9715", "value": "6144:c8d1/w5KA81IJ8GpF6nuTmOOUWTkT4D5W7mISVADsBE30hyfXuHqDpHZhdpFh5tD:vjYKkJj6GmZUWIT4RIo5hyGHQDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305766, "uuid": "ebb3e167-a469-4e5a-868b-5f107305b6be", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305766, "uuid": "d65ac395-ef2b-4bf2-9d05-f11ca9cfefbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305766, "uuid": "483f6049-31e0-4121-861e-439fee8969b3", "value": "200ca802b37584347c7e48aa09469811d2b699db7cbc35f8cd0367d7efb108d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c34363b-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (Loda)", "timestamp": 1770306613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306613, "uuid": "7eba1802-c738-4528-aa6d-aa558986d9ad", "comment": "Malware payload (Loda)", "value": "68980cc1fae3e918a0d3410a2055dd72", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306613, "uuid": "043eb555-8103-4a34-b355-d95eadf0c095", "comment": "Malware payload (Loda)", "value": "201e75a316d1c62447fa9de32e0780771a183bc1bba49b20982a0c87ff3a644f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306613, "uuid": "318a21af-9863-491b-9a90-340bc155779c", "comment": "Malware payload (Loda)", "value": "9d1bdfdb2ae9e2c42cc6a8db1d02fe15f112d660", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306613, "uuid": "c81a9ad8-7815-4147-92ed-48f0560dc4a8", "comment": "Malware payload (Loda)", "value": "593f7bf937ca592e70a7e675d5cfaf6a56edaacbda7cb699ae7e971c535f181e614e0c30e3900eb2c4a93b11abd6b34c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306613, "uuid": "395428f3-6f78-4f30-923f-a491663fefe0", "value": "T19DF62331957A3C761BE88E6DE41B2EF83D809BD38484A5954948B3F3E3C575487BE0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306613, "uuid": "bbe99a23-8851-4e37-8ab1-c993cc4be2fd", "value": "49152:tsljG4N6N7aywppzzzAzltHRlf+m5Aome+Uz8Rj+eOrp8N92kepPZalGk1cYX432:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306613, "uuid": "165b9edb-b0dc-486f-b35c-4e6090c90045", "value": 15343860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306613, "uuid": "ebb607b0-c73c-41dd-8c85-daa43b6651b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306613, "uuid": "9828bb69-5aab-40b4-8fe7-351555084f06", "value": "Output.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e82ecd9-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770307074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307074, "uuid": "2cc21978-5424-44b1-bd2b-a8b1647a42d2", "comment": "Malware payload (Formbook)", "value": "6a5dd64734a849531beb1d908346f9d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307074, "uuid": "ca9dcf4b-9f3e-414c-9752-c760f768f97f", "comment": "Malware payload (Formbook)", "value": "2077034a0acd8cf3f3e55b2e2487e15f3b477f0c6f3cb780e60b555e4b13a579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307074, "uuid": "f5fcc7e2-1227-4d40-9952-579fc3962d1b", "comment": "Malware payload (Formbook)", "value": "bf8b4e2310ac8b4c98f2aed2ccbedd7e8821d11b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307074, "uuid": "7d08d479-bf6f-4fa2-8837-04c8993a2c81", "comment": "Malware payload (Formbook)", "value": "47fb8177cb65cff8ab23db94a7a5b13437d081b47d5047d038bcbcf17850d50860a9863a12dc0ce25a37f6cb3fc003f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307074, "uuid": "62e4b9ef-9c58-48ae-842d-3b3012b91814", "value": "T19D45BF0273C1D062FFAB96734B5AF6115BBC79260123A62F13981DB9BD701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307074, "uuid": "948e7093-6ac2-4823-8af4-1b2623ec3203", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307074, "uuid": "a6519bc9-da61-45cc-8e4a-998189d19a53", "value": "24576:05EmXFtKaL4/oFe5T9yyXYfP1MAXDzj6pOdDVRn0X1FA8wnu:0PVt/LZeJbInGizj6pOd70X1Nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307074, "uuid": "9816a7c8-7d36-4bb0-882a-9de01077af3b", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307074, "uuid": "68f61b08-871f-4e92-af3f-20cbcfabb759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307074, "uuid": "a1a0cb7e-1972-4d3f-8049-85ab41c3363e", "value": "d6be19e4748309721d2cb5df8bd120a66573cae0847bec201e63c0811faa9fc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f9872e-0231-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770254689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254689, "uuid": "9b3a7574-2e55-4809-b0ba-70f76ea27f80", "comment": "Malware payload (CoinMiner)", "value": "f65d0262d12b37f0d4f513e550bddfa7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/CoinMiner.N!cl", "colour": "#929C98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254689, "uuid": "c576b35f-0a13-4657-9fc5-c9dde9fdc926", "comment": "Malware payload (CoinMiner)", "value": "208fbb1b50982f53fd65c6437e43147bc74899ad5f40863d7d95d9c6dfdc1bb3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/CoinMiner.N!cl", "colour": "#929C98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254689, "uuid": "814f694a-07bc-4506-b028-28f035d7603d", "comment": "Malware payload (CoinMiner)", "value": "a5bfe6c6aeca2dedda58d66f06d6d0ab55869134", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/CoinMiner.N!cl", "colour": "#929C98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254689, "uuid": "b20b336c-8f6c-4dd9-8c15-7eb7e7d98e06", "comment": "Malware payload (CoinMiner)", "value": "63465dcf99fbba72b907b7bba101e3bed64a64d0b75922826418960581b9abea4b8c726887a51cb78fdd3c5156239d47", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/CoinMiner.N!cl", "colour": "#929C98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254689, "uuid": "3c8657ff-3064-4916-baca-938fe4284750", "value": "T18666AD65B7A400E8C87BC17CC64A9A13E7B2B85A5370A7DB17B456791F33AD01E3EB04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254689, "uuid": "85218d79-2433-4f6a-af27-bc8e47a5ac26", "value": "9e2f1b9d266905576bf3b849716dfbe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254689, "uuid": "b19d6b22-db65-479c-bb45-0e597fd5d00e", "value": "98304:e3pMoBjbVmMJxtV7hBjFsjlqajjvZj3sjF6aIHatMQXfMC65AKqiWK48YiEZ3TJi:WBmCZKqi/48rEtai2Gfls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770254689, "uuid": "1f119718-19c4-4c28-8346-67cf2e475487", "value": 7050752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770254689, "uuid": "e3f635bc-d458-419f-8e00-975f6a1eb53a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254689, "uuid": "7cffba12-9509-4ec6-a075-e40217a86caf", "value": "xmrig_launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c75c7c-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305172, "uuid": "1c70cc4a-3b49-430f-bfac-cc6c09a8928e", "comment": "Malware payload", "value": "2c1619a59c334aa09326809de733f7c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305172, "uuid": "717d1d8c-8cd5-4ce8-a045-5d8f506819b3", "comment": "Malware payload", "value": "20ad2bce1be83037e2b7d5e20d5e1e3ee59e41ddad264fb36bf6c347cf19cfa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305172, "uuid": "1e6a052f-d397-48ce-a624-29ec3c2c3551", "comment": "Malware payload", "value": "1bfd0b47ad65f9a75e3d94633bb95ff0db0e5f79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305172, "uuid": "63084cbd-26a3-44ef-8f1d-7f03bdc9029e", "comment": "Malware payload", "value": "98f8810b9a66866cbfaa0ad8069a3aa2ac4510246c33157f46363f925720903c94912d914c027fa340638007cfb45101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305172, "uuid": "c2dc7f32-1bed-4a33-8828-8b93c14f463f", "value": "T18966C0CAD16B40D6CC067FF598142BC39B3056324A34047836ABBE595F739FA811EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305172, "uuid": "2eafa597-d7a8-4245-9105-c63577991a8f", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305172, "uuid": "02bcf7d7-b0ca-4c10-b085-48a91f789dff", "value": "24576:JWnHfmWgGjpx8dCKUGduGsnYq8UK+o92a4Un8njeiKSdjExutWqdqM/Nue7cub0z:nzQZKNiEQktCV0MLI0kQrLo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305172, "uuid": "66e01ccc-8a26-461b-aa4a-f67c35d4b79f", "value": 7067648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305172, "uuid": "4ed8de03-41f2-4061-80ff-1823c9337911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305172, "uuid": "4dade519-2d07-4c98-a44b-ed2777e2e07a", "value": "20ad2bce1be83037e2b7d5e20d5e1e3ee59e41ddad264fb36bf6c347cf19cfa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee4ef18-028d-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770294404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770294404, "uuid": "65341be1-6ea3-4cde-b176-8b24bbb09dbf", "comment": "Malware payload (AsyncRAT)", "value": "997352f25957b1c049ba69156c1e3cdc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770294404, "uuid": "194f1af6-3b87-4c1f-917c-9e756078c8b3", "comment": "Malware payload (AsyncRAT)", "value": "20ecb87866b8002d5bdc52a3db1f13d3d12825eebe86864ede4fdef9140e8d98", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770294404, "uuid": "6ad10cb2-8feb-4ef7-bf90-552bab1401cd", "comment": "Malware payload (AsyncRAT)", "value": "30a8e072e7f687a1f6eacee82cb16f5cac879a9a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770294404, "uuid": "d74e98dc-b6d7-4977-84b1-29c1b822fc75", "comment": "Malware payload (AsyncRAT)", "value": "427d0eb38371802457a9b7b2dbeeed10cdac3e8cfba9c7e5b5ada70d4975121a37c52a986944c102a6943b8d11e92ccc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770294404, "uuid": "a8848e92-59c4-49e4-9b08-5ff5844ed8dc", "value": "T16C535A003788C966E2EE4AF4BDF2560006B5D5732102DB5E7CC414DBAB9EFC64A166FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770294404, "uuid": "bdba4a1c-b8bf-45b8-a426-40a3dd9f8d18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770294404, "uuid": "828186e9-b29e-4c83-bbe3-829668978aaf", "value": "1536:AXb9cBDZ+uJDiLnyVfbbnwS8GmEIVclN:AXuDZlJ4n2fbbn/SY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770294404, "uuid": "f8840725-e679-41d6-929f-cb11cadc3178", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770294404, "uuid": "8500c7fb-de6b-4f16-98e1-676aa8323b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770294404, "uuid": "a2922887-e62b-4df0-a7d7-f1f209721c9b", "value": "sextop1.page.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c3bc08-0283-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770289851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289851, "uuid": "54806a9d-1780-4b0c-a5c8-6e86157cb1de", "comment": "Malware payload", "value": "f980dbfb786461de56eea0bbb9f762bb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289851, "uuid": "047fb842-0ad8-47be-9151-91b7eed0b3a2", "comment": "Malware payload", "value": "210806a4a2e34b5197a8ede758653ac79d80c306611b0cbfa692188a4a53996d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289851, "uuid": "c815d724-6b5d-4cd6-8e2f-24215bc6e206", "comment": "Malware payload", "value": "a876b8cfa4005d18834480084b990484af9f6829", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289851, "uuid": "e98125f6-74d4-4fd7-bf6e-e342bc0467d8", "comment": "Malware payload", "value": "a78697359e91a777794dcfd06ce2f687acc3699a07189a1d9fb633755773dd27bec0bcdd24135de62ac11a000abeacb8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289851, "uuid": "6e9ca61b-5b34-41e3-bf7e-490af3580da8", "value": "T182E4C787F1208AC7F84FDABF145042106EF0E4704607F2561B6E886A2FEB9D89F557E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289851, "uuid": "380e8b0a-fc36-4127-b0d4-828a2631b479", "value": "6144:u1eMX5Uh/W94gpr2TEPjhMoIlAZOekWhxeW0eOxOTBa14yU7Uw+1/1Pp3x1ZjG:udwbeTWth/1lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770289851, "uuid": "1dd54651-b38b-44ad-a72c-4144198f8256", "value": 689113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770289851, "uuid": "8cbbcc0f-4fdb-4b46-b2cb-1e93ca2cdd2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289851, "uuid": "2b342d95-fd7b-47d6-9611-290230f74db6", "value": "Item-Duper-V2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f38044-0263-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770276028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276028, "uuid": "df2a2df6-e0e1-475c-9040-166a5cd40484", "comment": "Malware payload (Vidar)", "value": "677e42a7b172abdbe9954c83787d690e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276028, "uuid": "8605fed2-9731-4321-a872-2ce22849ca5f", "comment": "Malware payload (Vidar)", "value": "210c92e4450f1ca2a080e3059fd0ef40d61f68dd6b243a49bb2a788b1f75ee93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276028, "uuid": "1ca1efa6-377f-4586-aaeb-0b1e944f958a", "comment": "Malware payload (Vidar)", "value": "55e3424b4018805e89ce78679f3375927a64e4af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276028, "uuid": "8bc1e2bd-9ab0-4ce7-9be1-3c13071e0af6", "comment": "Malware payload (Vidar)", "value": "dbf7e8558875b26778a586a64977f8b413669cfc1bc4a88773a3ef95903ec80bfded33b320ae93fe1b8a3fc33abc58b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276028, "uuid": "fedf9e01-0909-4b7b-80db-9c8dca3ce924", "value": "T133C41A7EAC14E327F60CA0BEE287D3534F6578110236BA931CBA972411495739B877EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276028, "uuid": "33aba15c-4427-4438-bc79-577095edd714", "value": "fc960b9f00b5c476474282bb39f86c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276028, "uuid": "e041a3c2-2fe4-42f3-9de5-8997290f0d23", "value": "12288:fcVR9cLXtGJKYvFSPXLI6zavBjR2+Q40S:fcVR9lKocLISavBjR/2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770276028, "uuid": "685d511b-28a0-42b7-be9d-c669a9955d99", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770276028, "uuid": "75d7eef6-3dd4-4d40-bf06-2c49365c0fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276028, "uuid": "32ce1068-7a9f-4821-9432-7ba6d1c89164", "value": "7610a777e23fac9a8679372ea0a61d6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2928b840-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305669, "uuid": "d876f425-c97e-4f0d-bb98-8b761bf80ddf", "comment": "Malware payload (AgentTesla)", "value": "ab48458f2dceb19842b8dd9c4a917864", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305669, "uuid": "51c4af17-0f40-4f8f-90cc-f8b502f2fe4f", "comment": "Malware payload (AgentTesla)", "value": "2149082bd465488986c63102738d1ff04722b77d4c89d0a82a00616fc6d05abc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305669, "uuid": "97554375-9f1c-4861-ae0c-d7fdb354814b", "comment": "Malware payload (AgentTesla)", "value": "adf9d6355be2d474c3d343c8744cce26c6895ff9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305669, "uuid": "ff1d58bd-1ad6-4b96-af77-c2fecac82227", "comment": "Malware payload (AgentTesla)", "value": "86dd47bab5b0131a9cfa3df8d0cc08ee07e725dae63922e2f1872f350f09851a51460ad0e836bd67c1242cfd2d939e7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305669, "uuid": "68270e04-3d8b-4842-8b2c-ba4289b56b9a", "value": "T12EE4124577344DB7CD3B0774DCE38A29227AEF1A4BF9428B2355BA19BCB341B021B256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305669, "uuid": "812c039c-8465-4716-8f4c-472ec612b854", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305669, "uuid": "5c21b153-4a2d-4363-8389-f59124f389ca", "value": "12288:yi5/I3bXDN2PSvpqOnvbf/7jYFL2jogtxCCidI2OD5tjS5:yiRSzN2qRnvbnAZ2jogrX128LjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305669, "uuid": "01afd61b-e644-45ef-94f9-fea767b1c46a", "value": 694608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305669, "uuid": "d1ce7ee6-8f44-44e6-9f23-f901475a6e83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305669, "uuid": "a05dfff9-91e1-4baf-a727-3853510ce3de", "value": "2149082bd465488986c63102738d1ff04722b77d4c89d0a82a00616fc6d05abc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8051ba1-028f-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770295278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295278, "uuid": "94a54742-9f92-4e27-9229-140c54633477", "comment": "Malware payload (AsyncRAT)", "value": "0bc804104962027d5475c0293e75a60b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295278, "uuid": "ac621558-47ed-4031-a57f-18bd2d66b04d", "comment": "Malware payload (AsyncRAT)", "value": "21b8793df780bda49a0cd6678d8960437a05d8a675234e2ba7532964a963db0d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295278, "uuid": "5bd0dec1-7168-469c-8d18-e045ae3f58e4", "comment": "Malware payload (AsyncRAT)", "value": "4f139abaf6788652b3572119fa24e9900b4a788d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295278, "uuid": "bf31a626-04f2-49da-b22c-3f29d7302c8c", "comment": "Malware payload (AsyncRAT)", "value": "cb4bd7e46c07961dac9f5d5b92c29b8834a820371110c7dc41df63cf2623cf38eed16b988a4eaacc97dcf7d205274af1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770295278, "uuid": "c41ccb4a-0516-4b67-be03-6aca7d33d020", "value": "T1B2C349003384D535E0AE4ABCADB285404EB59D73250DDA4AFCC436DF6A7BAC179126FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770295278, "uuid": "763cb800-8ff7-4003-ae2f-8aad3f57c8a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770295278, "uuid": "213dd813-06b6-42ba-9d42-c0b42603f693", "value": "3072:f4MrYhajlGbb3Uk8HkdFSs+5FwyEED0dhmY:ACI+kbEEdFKfT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770295278, "uuid": "f3c5f327-b2e9-463d-9223-4ac1d934e1f3", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770295278, "uuid": "30d53622-1852-43b3-9737-7cf5ff2f37d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770295278, "uuid": "33091d8a-0f91-4a91-ac5a-e1415cafed55", "value": "cambodiaslot.jp.net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93aeffe3-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305848, "uuid": "854add30-d5fc-4b57-8b98-c037c23c6382", "comment": "Malware payload (AgentTesla)", "value": "ea61f27490ca76037d9c34b70d97947a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305848, "uuid": "e4a85733-6292-4adf-b45f-98b6b2e442ff", "comment": "Malware payload (AgentTesla)", "value": "220b96820a5e01182e733274f7851f094dd516973796fb3445bf7c7eac2f4806", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305848, "uuid": "f750a7c4-1cec-4e6f-8a7b-ab0efe6795ad", "comment": "Malware payload (AgentTesla)", "value": "ff2787c9abb403d8edb09d8d909a80a894dba6a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305848, "uuid": "dd84e7a9-9e9e-4138-943e-f1dbb7d7e714", "comment": "Malware payload (AgentTesla)", "value": "f922d37f1827bda71dc0a5d2142ca31578b5cd15a792419cb06432a246c3df2a67cd8dc396b9f2443c8914955ab7979f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305848, "uuid": "8f1aca1f-478f-48e3-8ecf-96bcc8fe854f", "value": "T16135AE0273C1D066FFAB92334B5AF6115BBC79260123EA1F13981D79BA701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305848, "uuid": "860c5252-220c-41d0-a97b-4c190ddcaa80", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305848, "uuid": "6def2edc-2b6b-4918-b6a4-fdba2f0b29e2", "value": "24576:M5EmXFtKaL4/oFe5T9yyXYfP1ijXdarhfmvAcudCCNwq:MPVt/LZeJbInQRarhjzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305848, "uuid": "b6601036-c528-45da-9e17-6a9bf7d22d99", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305848, "uuid": "972bf87b-f33d-4e9b-a902-3349885cdb37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305848, "uuid": "2c346439-461e-493a-aaeb-0e41cb82cb06", "value": "220b96820a5e01182e733274f7851f094dd516973796fb3445bf7c7eac2f4806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c781508c-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770306794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306794, "uuid": "c7d09c9c-6476-4cea-b525-120d7824a41e", "comment": "Malware payload (SnakeKeylogger)", "value": "ad56a1f2d132cf7a6c41e6579d4ac2a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306794, "uuid": "e3c0cebf-006a-4510-a6eb-849b6eec09c8", "comment": "Malware payload (SnakeKeylogger)", "value": "222924ad313b2b60d64e8178d897b170db156a4131d91949f3d6a861655e5266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306794, "uuid": "af9897a1-2c2e-4277-93c5-59160b104bed", "comment": "Malware payload (SnakeKeylogger)", "value": "fa5ae49e54974696e55e0fc3e94ab9d62016366a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306794, "uuid": "98017db0-a91f-4525-a745-e218384bd771", "comment": "Malware payload (SnakeKeylogger)", "value": "b665f9f0436b627ec0bb843f157ef4c5065d2b1160df2fea7bc69e821ec33112d22e61e77b245f7d48c4e8f1ae3a8bb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306794, "uuid": "dccd8860-cf8f-44b9-b5a6-1025f64630c7", "value": "T15C2512A4335AF812D4951BB60971E3B062B8DE9CA551D7038FF9FDEBFC5A2C228451C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306794, "uuid": "9ac27171-277e-4b0a-8fdd-1c3589098b3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306794, "uuid": "dd17077a-f6e5-4e6c-8985-687bd3f2c5f8", "value": "12288:COTTieHaDImNIJnXxsrzRoXddGSgNd3cjds7RJ0HmgHzDBSyQ89vAfB3Ii:CQTGj2XdkdMji70HmYDQyQ8vG3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306794, "uuid": "af297d97-b7ab-4a56-b10a-bbd4a2043ca6", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306794, "uuid": "c875fca2-a745-409c-ac15-56cba0fea3c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306794, "uuid": "b42b021c-a208-416f-9a87-e85ae38f7922", "value": "222924ad313b2b60d64e8178d897b170db156a4131d91949f3d6a861655e5266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853db14d-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327298, "uuid": "b02c8180-5244-435f-ba14-573016e73f8f", "comment": "Malware payload (Mirai)", "value": "252a97c657dfc3797e9f318750d9a752", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327298, "uuid": "f6d42afc-1009-4570-beb4-c3af88a386d0", "comment": "Malware payload (Mirai)", "value": "224e7c9ec668923f469e68873b278fd40321af61d53040b6d4a528dfd6ea2359", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327298, "uuid": "ce796d5f-4346-4626-8d65-c526662009be", "comment": "Malware payload (Mirai)", "value": "1b0a05c6359545485636b5e014df041aaffadea2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327298, "uuid": "81868c3f-9596-4612-b74b-37f2ff25eb73", "comment": "Malware payload (Mirai)", "value": "aa8bd8624107ba65f65cad8334e8cd8d046a698b5fbe9baa5025c8336517a0156a97936c19ba294c94423c1316fb2ef8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327298, "uuid": "040d18c6-e1b5-4a7a-8a57-8a35ad0f4c24", "value": "T1F5F33B46EB818A13C0D6277ABA9F424633239754D3DB33069928BFF43F8679E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327298, "uuid": "0f349d45-576f-4662-a077-a8ce8e6ab030", "value": "3072:072NZ8hzaVCirxFxw36gXHHCfHn031yJT0M/9ce4:07gCzaVCirxFCKg3Cvnk1yJAM/934", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327298, "uuid": "481b7718-93ce-4599-bac3-1477d73616dd", "value": 170812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327298, "uuid": "03c31d4f-fe61-419c-83d3-38ef0275b3b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327298, "uuid": "f1db86f2-99ec-4f3e-99c6-de6c74ad0bac", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a94edd2-026f-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770281351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770281351, "uuid": "e7e1b5e6-ada6-4bc6-80f7-186d99745d1f", "comment": "Malware payload (SalatStealer)", "value": "f0729fc5ec92cb1492702ab7bba116f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770281351, "uuid": "48afd044-0856-4261-8961-e7faa6ad070a", "comment": "Malware payload (SalatStealer)", "value": "226572b877494b34e482c1714fd34aac102adccfd42d6883895f31a56911781f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770281351, "uuid": "f76d9134-1bd8-45e3-b666-6b285c4d5a44", "comment": "Malware payload (SalatStealer)", "value": "0c6318a1297c6a996b5a3ed0c89dd3ff01a9e3f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770281351, "uuid": "88fde0e4-3ace-4bd3-805c-6ca19aace2ea", "comment": "Malware payload (SalatStealer)", "value": "f784f30671f8ef8895dd926bae38f4f0bbabca0f0ff98d02862c18ceaf14e0ad71a55c993e6ea8f46acb1d5674b355ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770281351, "uuid": "d93562f2-c660-42dc-9cd0-9ec59c3b3fd4", "value": "T10AE533D3F607558BEEF73A700537AA9F120B4D788CB56B4C23E037EE56898509478B68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770281351, "uuid": "e52a79f4-1cdb-42e0-b19b-eda013281f88", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770281351, "uuid": "7f214171-ad76-4f80-9d4b-89895604626c", "value": "98304:zGkfqjETeuPbQjN4IkySz+0shJXNo5lHWl:zXfpTMXg6DOHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770281351, "uuid": "c0e1222d-2cb9-4588-af9f-235e2f68739c", "value": 3295744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770281351, "uuid": "3d9d5695-3ec9-485d-a599-ab3dc7326911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770281351, "uuid": "feb92700-0ede-4462-a3a4-2dd5c7f1f343", "value": "Prem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f8fe58-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327216, "uuid": "556ea41a-a6fa-4507-b7fa-4e9812933d8f", "comment": "Malware payload (Mirai)", "value": "b64274104eab1c5d52928575c4fdecd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327216, "uuid": "a1097378-506d-4a86-ae86-56b943e2bf60", "comment": "Malware payload (Mirai)", "value": "2285a464e228cc2763d330336c7143b21b5f769ec30f71b5c6d636ce95761d2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327216, "uuid": "ac165354-7a81-4969-8590-ae6a15854023", "comment": "Malware payload (Mirai)", "value": "08c83f1d09b3df01b2bd2c5b9253b77119912a93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327216, "uuid": "6d6c6e34-01f2-4479-b27e-42635208c754", "comment": "Malware payload (Mirai)", "value": "45e2655f4aaeed86534dc9b969dc913f59dc9b594378cbb64b634ef011062714624a724114913bb562109003b9a56313", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327216, "uuid": "96cee5ac-1828-4a01-b26b-7cc381973576", "value": "T1BB836C21B8391E3BC4D4A47B22F34336F1F6478A24A8CB1E7DB10E8DBF2559026576B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327216, "uuid": "3dd839c0-e75a-43e6-8f65-8f582c6b0bd5", "value": "1536:yx9LogDMUl3lbWnrtefQd0BEt1aYm5v8ok9yt7k:CtA3d0q3aYOEEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327216, "uuid": "1bb7b496-7f2e-4de2-9844-c5245f8b1653", "value": 87352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327216, "uuid": "266ec04c-c2a9-4af1-ad11-314e44f7d867", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327216, "uuid": "04cb828a-d586-4417-9cb8-d9d14a68a2f1", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400a9f83-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304848, "uuid": "4b3f92f2-5434-4fc2-91fe-a9fd0ba17237", "comment": "Malware payload", "value": "8cf48ad9060899458ec983a772edd977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304848, "uuid": "1c873fc9-8ea9-4124-ac7c-a0dc5caf1fc2", "comment": "Malware payload", "value": "231bfa0f986095500a349462caa6ab1bf2ad75479453a823ed8ee236257a6490", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304848, "uuid": "b1d93533-2f70-4124-aeb7-0591a8fd7c44", "comment": "Malware payload", "value": "d048096ec93a8d9ff2cae6806fb123f839b9bdca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304848, "uuid": "a1b5da66-a1db-4081-9281-6dac8af585cf", "comment": "Malware payload", "value": "ebaf459d2703a27522fedf007b102be950429b205cfe54767e41f0cbcf1442a4d433162ea415ef92892bb3f8ae0eb62a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304848, "uuid": "724bca19-9c48-4a1b-9d21-96f5aba7dba9", "value": "T17A94F516E620B126F99349B02D79A29A392E3D363181DD0BB78D9F4A377198370F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304848, "uuid": "498e5848-8af8-4a47-b18c-0504e64704d2", "value": "cfe83fb5a2ef3b5fcdf366f13d7ee013", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304848, "uuid": "292deb97-0026-41ed-83e1-64fb0704e547", "value": "6144:OBN4SqbhiDNq746u/z1RnUSEFclh1Ce4wYP15YJ8C5VDYIDM4K8oOHRbcW//dm:ZSqbYsU6u/z1RnUSEFclhwH8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304848, "uuid": "38690f05-ee1b-461b-8788-1f7720ca2f25", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304848, "uuid": "4fc2c874-7ae5-48cd-aa71-f1ebac161570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304848, "uuid": "48bcdf17-cc7b-48f3-8a5c-2cadcd5bfe4f", "value": "231bfa0f986095500a349462caa6ab1bf2ad75479453a823ed8ee236257a6490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c565f398-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1770305931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305931, "uuid": "4a8dc171-f0bb-42d5-bf4f-633a6505eefd", "comment": "Malware payload (SimpleHelp)", "value": "ab13a24663d0dc9e09957a97f3ef61fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305931, "uuid": "09ec37aa-f0b0-40e1-99f1-6359c5880eee", "comment": "Malware payload (SimpleHelp)", "value": "23cb148fe8ddacc2ad816b0bd587f013b89914d877e371ec04071227db805bae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305931, "uuid": "df0c2f15-0687-4826-a291-a999ba6c7213", "comment": "Malware payload (SimpleHelp)", "value": "c439053453838f0028cc412148818b6a74896a89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305931, "uuid": "8321d4ab-169e-4a34-a604-7655c9785726", "comment": "Malware payload (SimpleHelp)", "value": "961348995c5e8e7a579e6524da34e1bfbfcc5e5a9c192250308d64c85912fbfcaeadb691740ecf8fe8eb96fa78275e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305931, "uuid": "87b509cc-aa55-49ff-ae15-b23b4278ae10", "value": "T190873329F39599FECE33D0FCC0854487EA96B9E54385412717F085EA4E206E58A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305931, "uuid": "f544feaa-8763-43c6-9879-bdd8670cd3eb", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305931, "uuid": "feb2e810-0684-4a90-9559-801b96d3beca", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1b9:/uRf+nAu2FuQd73XyFeDMnKT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305931, "uuid": "0ac19a89-fc41-40eb-8dbb-1ed82dc1ce0e", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305931, "uuid": "ddcdea19-12de-4c0c-8717-386ef8997db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305931, "uuid": "337c960e-df3d-4b31-a483-8995ca837514", "value": "ZoomWorkspace.ClientSetup.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7674674-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305907, "uuid": "3b6af229-89d0-4450-beb4-bf22e0cdc196", "comment": "Malware payload", "value": "f1d94e1d2bce9a10414456d9bd4a11d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305907, "uuid": "6de4e96b-900b-4452-8a18-c7b587903a12", "comment": "Malware payload", "value": "23ce2879c26d1a99a5ba43588e2bc42597795689926684ca9e12736d0a50d174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305907, "uuid": "579389da-c187-4a51-b16d-f081f5f5f825", "comment": "Malware payload", "value": "3b16bb0fdb23bd4602386f9ea10cfe68e219b288", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305907, "uuid": "be73c540-572d-432f-9044-2cab536d2616", "comment": "Malware payload", "value": "8f9084c36c5e927b98a9d78c3478a132c3b5b1b8c86a8d76d4ab6630cd46e49f09e9eb09e81f4eb4355eb21987ad5ed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305907, "uuid": "f6f58582-f50a-4828-8e27-8456f0bf7213", "value": "T1BB741913E7607025F85386B02EB8A65A68293D3A1581DD0BB78D8F493B72AC774F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305907, "uuid": "1604566a-31d7-4612-9e9b-6593a281369b", "value": "c78b630dece819c7ac84649e6af0d303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305907, "uuid": "556261a6-9765-4368-8e55-a6876f69db58", "value": "6144:t0IqXiACRY1oYgm1E45DV+AQmt45tPdTWTlMuPSpp00qdGqu7J6J8YZ:Pq/Pgm1E45DV+AQmSvXcGqgJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305907, "uuid": "8b91fcbc-d2df-4602-b414-2f3f9fea29e6", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305907, "uuid": "5e3ec103-129b-4bd0-b442-62558d326b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305907, "uuid": "1fa62cdd-b34e-4ef0-bf9a-a6bad2e92aef", "value": "23ce2879c26d1a99a5ba43588e2bc42597795689926684ca9e12736d0a50d174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48dc7688-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327197, "uuid": "e3604c33-fa82-44f5-80c7-6de97eafdb0d", "comment": "Malware payload (Mirai)", "value": "9ea3bbee01cf7aaabeef7d852ae671d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327197, "uuid": "10acce37-1cfe-4ce0-bb98-4be5e8693f92", "comment": "Malware payload (Mirai)", "value": "23e0c2ea87f14093cdb260227edce41edf22c68da305b32e66f896cfab377c11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327197, "uuid": "f7c4fa5a-e098-4264-b093-b5ac0d1eb9ff", "comment": "Malware payload (Mirai)", "value": "656e32e7f02d07ca0c0c063f458f9a9ca57dfd7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327197, "uuid": "28cb6db3-b233-499f-b61b-127d0cae590c", "comment": "Malware payload (Mirai)", "value": "5b6889d4ad48eacab245fb5fd5a0eda2789b6e66b97baadd3d200057b3a51b4dc6dac70797e2de44ce993c72a6d4178c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327197, "uuid": "49953c09-c401-4273-a424-deb3f942a916", "value": "T1F85301D2A480E5E7C75903BF2598D807FBA11BBC79DA306A257EC2486193D4C7CE3AC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327197, "uuid": "52983a7c-2d58-42b4-aeb4-b9294a4a7012", "value": "1536:zVQSmwtMJXmejtVmM7dLTM5Tfv83KJ2crl2EWI:zVywt8XZGMZLgTX83KHl2EWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327197, "uuid": "246b7731-e759-4684-bd01-bf8c9be28b44", "value": 61844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327197, "uuid": "021712cc-b285-44f9-aaae-7205b1d2a4c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327197, "uuid": "eeb995e9-a8b0-418a-bbc8-fdeea29cfe45", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262b6273-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304805, "uuid": "f26b1eec-1b17-47a9-a791-8ec12834d82d", "comment": "Malware payload (AgentTesla)", "value": "df3dbd773779638853895367bd9844df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304805, "uuid": "7076631e-aa9d-43b4-a2ce-cbb4daece26e", "comment": "Malware payload (AgentTesla)", "value": "23e95b4bfcb913ff25a67fd4d57e2e84c5b001b9fc6789649df80c289b8efe10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304805, "uuid": "b7728f75-6f15-4a19-9d8c-23f7120d88e6", "comment": "Malware payload (AgentTesla)", "value": "b5ba87f5fc21ab613add2195153d6f23258ceb18", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304805, "uuid": "8dd2e005-29d1-4134-ab49-3c3904e882cf", "comment": "Malware payload (AgentTesla)", "value": "9e49b3ffc18dd32b6b3827fcc7b15579692fd0f6471bb61b01319f90751f3132ee4149328660b7faa1b3e840c6af6542", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304805, "uuid": "068b96a9-5725-4c9e-ad83-4102e127478d", "value": "T1BCD4229296A0C924C2517330C436CD628A793D709E1563BE476CE6AF7C71383AE6B78D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304805, "uuid": "08f8846d-3856-4ee4-90b9-53865aa099a4", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304805, "uuid": "8bcd80a8-f29a-4603-8e09-3f85c4073aa8", "value": "12288:ez7hU5I5yuNHIgzSFKxWltRohBfSTso93UOHO3PESDlhblLt6OeZZ:ef+iN57Gtene37SVtMZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304805, "uuid": "b1aaa3e9-a5db-4805-a856-38ac352d72f4", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304805, "uuid": "ca17c94d-3640-4fd9-9a98-7c5a159d3f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304805, "uuid": "fda99bc2-8317-43c3-b218-906f74ad90e9", "value": "23e95b4bfcb913ff25a67fd4d57e2e84c5b001b9fc6789649df80c289b8efe10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79859f7f-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327279, "uuid": "312b5763-256d-4088-85a0-da1f985b1d95", "comment": "Malware payload (Mirai)", "value": "fab868df72ae81f302b91ada29ebdccb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327279, "uuid": "e7d8839f-d776-4db8-92a6-0e92a4bbfd4e", "comment": "Malware payload (Mirai)", "value": "24105acaa92706f91a3fe2551835788ac0b6e3b13386257c62b9479681e7a328", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327279, "uuid": "12008101-66b6-4aeb-b3f3-f3ba84272463", "comment": "Malware payload (Mirai)", "value": "d6e670fc516fbcbb95df03d6c5a7469e74447970", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327279, "uuid": "dfa8cfce-3cc4-40bf-8ca8-d9a41886c65d", "comment": "Malware payload (Mirai)", "value": "35614a4a93d2c952077977a0e7ac74e59dbd213f0422d3a2d734d0c48c3926404ca3196522a3d7983586e2ffdd4a2997", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327279, "uuid": "fcaf8528-76fe-48fc-b94f-b309166d6f04", "value": "T1F6F33A46F6418B13C0D61779BA9F420533239BA4E3DB73069928BFF43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327279, "uuid": "dbb07afe-3a41-4deb-afec-ada17ae8cf64", "value": "3072:i2bmltnY4BRae/xGPZ06v/mYp+C9T6MjqHDjyoM/9Gc03:xbmltXRae/xGPd/z+cT6OqHDj1M/9l03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327279, "uuid": "68481148-2f90-46f1-82e8-8fe275ce086c", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327279, "uuid": "631fdf46-0ea5-407a-a8a1-e5e7baa5578b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327279, "uuid": "97cc8ed0-5caa-43dd-a24c-6bc55793f7c4", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cc314c-0255-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770270179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770270179, "uuid": "1597bd3c-e408-426d-a473-cfb7fa5a67b9", "comment": "Malware payload (AsyncRAT)", "value": "ab45c00da155aa574c8882873ff78a04", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770270179, "uuid": "c84a73aa-c1dc-4a54-90d2-dda4853e2305", "comment": "Malware payload (AsyncRAT)", "value": "2422241a9f8464c752434aead901dafc221956149c5a9d13128fc60958bb1377", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770270179, "uuid": "bcf14a9e-eeb6-474f-91c6-5b80c038194a", "comment": "Malware payload (AsyncRAT)", "value": "5ef54baa2a4774115eb48105ecdc14c6bcbb42fa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770270179, "uuid": "20f4db62-a10c-4cd9-9d4c-3509cb729ed1", "comment": "Malware payload (AsyncRAT)", "value": "4f24448811faa5d91205f120443a6e424dcaa7c7b6ae361fb47ab948c76f8525054cb68bbf0518f61849b935661d016f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770270179, "uuid": "61f8ef3c-d3e6-4f9c-b131-3ed98d4c7d98", "value": "T1E4D23A08B3D88551E1FD56B94D7293048771EA4BA973DB9E1FC440AE2A23B88DF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770270179, "uuid": "8ff60900-a797-4c76-8a63-67b7c5ec7a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770270179, "uuid": "0cf02f3f-09c4-4503-a57c-be6fde38c07d", "value": "768:LuGRXHMMVEo8Yg/cIRGqo+/Rb7fB/dTm/+:6GRXxVEo8B1iwRbN/I/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770270179, "uuid": "a4d47a3e-3f0d-498e-aa48-141ef0b9bdaa", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770270179, "uuid": "1a458654-7424-4f5d-a4a0-c9818012ffdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770270179, "uuid": "5ecb4b6e-4c4f-400d-bb21-6a41b95555dc", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e808bdf6-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770307278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307278, "uuid": "2d2c8078-a2f6-4fdf-bc8a-b4d6697dd7b6", "comment": "Malware payload (AsyncRAT)", "value": "60177aa7381004c1bd6061746f7b82da", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307278, "uuid": "3e74c4de-cb03-4cf0-9ef6-24ce229d1480", "comment": "Malware payload (AsyncRAT)", "value": "24366cbcf950d6b7d6d12e2342d6a1b346a010b9a94af8a02e24a8104687bb8e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307278, "uuid": "4ba1234b-7cdb-4914-be11-0914ac7f0882", "comment": "Malware payload (AsyncRAT)", "value": "e9adc29d9eefa421026761f27ab4abb7eb15e376", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307278, "uuid": "4c79e019-913a-406a-90a2-564584d8802e", "comment": "Malware payload (AsyncRAT)", "value": "1bcdff873c48aa83463a7914302c3f64bf2373978238f7ff44763f987689d94425edabd0469bee2244d8380d74258cfa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307278, "uuid": "2badc5f5-9454-408f-b2dd-44b352d924b8", "value": "T1E4834B1877E90125F1FFAFB05DF47283CA36B6636903D51F14C9428B1A26A84CE917FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307278, "uuid": "ffbb4f25-3243-4722-96cc-90f5700207a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307278, "uuid": "e179cdbe-41ba-4f20-aa88-29ac6a38c574", "value": "1536:eZlFBPItNP0MH/blZbmtfhgeNhL6RTxhIO6yjOOs:eRBPItNMMfbjbmDJPGHIO6yjO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307278, "uuid": "d04b7d2e-4f43-4932-beda-005f4e981d92", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307278, "uuid": "1a3d7855-34e0-4726-a78f-d345a2cf08ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307278, "uuid": "6cf90295-f44f-4811-ac7d-5de1479c36c6", "value": "24366cbcf950d6b7d6d12e2342d6a1b346a010b9a94af8a02e24a8104687bb8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e041fd-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770305875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305875, "uuid": "51f7e52c-a3ba-4378-8aef-4d97e0755638", "comment": "Malware payload (MassLogger)", "value": "04adf03afb17e949728e8292dec92810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305875, "uuid": "1afc9d33-5d1a-408e-88b7-072925173554", "comment": "Malware payload (MassLogger)", "value": "24f311baff086935d9e08a98a08b8d2d64d41ff1ef950a914f7205238bc5552a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305875, "uuid": "4e92402d-6134-47f1-a75d-2216487edf86", "comment": "Malware payload (MassLogger)", "value": "904050d77217b6fe5723c876af8f5256334f41a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305875, "uuid": "90c8b1cb-a06f-4e96-997e-218885500025", "comment": "Malware payload (MassLogger)", "value": "bb38736f40292dc4e26f1ff85ab815dc7f9ed8d8bca641a40b58ed06818ec56167607150f33495f33205c1fc2f2bf243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305875, "uuid": "2f86a376-eb1e-4134-b43c-0af2d54c46d2", "value": "T1E6E42352A5C49E58C624B3758437CDA08A7438716D45773EC36CFA6BBC70383E96632E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305875, "uuid": "85c5e830-f150-4ca9-8441-fe8b37288cf6", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305875, "uuid": "d12119c6-054b-46c5-95a9-fa8e7bf12f5c", "value": "12288:Hz7hU5I5yuNHIgzSFKxWltRohBfSTso93UOeZgDJtvKdexigIYZ0gmCQnV5wPL:Hf+iN57Gtene37eyJtS40gmCeV5aL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305875, "uuid": "a762786e-c3ab-4556-b77e-9f8ebbe0c8a5", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305875, "uuid": "a39a3289-2474-45e8-b6b1-f74fb4ca8d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305875, "uuid": "361bea6b-6f6d-4762-8eb4-4aeb65b1a48c", "value": "24f311baff086935d9e08a98a08b8d2d64d41ff1ef950a914f7205238bc5552a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfecd9c-026b-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770279666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279666, "uuid": "737065fb-a7f9-4652-bab9-5b4c1ab9a88a", "comment": "Malware payload (AgentTesla)", "value": "1b8d484049109b797419b22e725de94b", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279666, "uuid": "c4e8a56d-5610-4abc-ab69-1c45ac73d92e", "comment": "Malware payload (AgentTesla)", "value": "250e023b57224a5e4a30f65ba130b36f130f578ca35bb3f58fb3bbc7ffe08f52", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279666, "uuid": "bd972b3f-cad1-4bc8-8026-fb0b6f50e10d", "comment": "Malware payload (AgentTesla)", "value": "6b02a2d90fb39bc13c709496dcacd509900d51b8", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279666, "uuid": "003fa844-4c5a-4fe0-8635-c40c98d3adc0", "comment": "Malware payload (AgentTesla)", "value": "d2dc3ac74ef843c14eb66d7db39d57478a9985bb547443d0767121b943d8eb33ee12604d1046d5674096ea1f405ae71f", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279666, "uuid": "18a0f4ba-4eec-467f-94e6-e7555b547dbb", "value": "T14DB2D03B8996A240C1717FBA9E9AB580A29D74003D84FE1E6B7D01BA537D03DC316796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279666, "uuid": "762c79e8-b048-4b05-9a8a-e8ccb0c10cc6", "value": "768:mxLan6jGLQv2kD6gMKy9F44KTILad4HIMLvWX:vn2DLAqXTIWd6IFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770279666, "uuid": "3e6e118c-8cba-4ce7-85bd-0ab70f50a467", "value": 24982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770279666, "uuid": "65693943-547a-4fcf-997a-991f99686deb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279666, "uuid": "ff6d52e7-598b-4cf6-a8c3-bdff66c6dda3", "value": "INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8215920-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770305506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305506, "uuid": "05ae3677-cfa2-4d8f-a5c3-3ee6ea7dda0b", "comment": "Malware payload (Formbook)", "value": "4e0834281ee060b8af12d0c41bc81678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305506, "uuid": "532d8dae-897a-4370-a008-d43313c97860", "comment": "Malware payload (Formbook)", "value": "258d6bea9e93caee50bbcbbc9a5573e82e76d141f2f151626c45d083c34d0c5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305506, "uuid": "7d11d291-95b6-4ff9-a21d-1eda850a5ce4", "comment": "Malware payload (Formbook)", "value": "002b7f3004202ebd9a844341f9e6c226a6c1054d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305506, "uuid": "777afba7-c993-4858-aff4-f4d6ab005072", "comment": "Malware payload (Formbook)", "value": "8094ad41b313bfa253a948b460f9f53e9d7fec664f5c642501323acaab0588686d83aaec65d171bc998e2b7c6972d151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305506, "uuid": "f4218894-8919-4c8f-b93b-04310526ae7f", "value": "T1BF35DF74EB7EE706C0217A35C426D6F21728FEC9A915C31ABFE5BE9F78305520726242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305506, "uuid": "638cab43-008b-42ab-9657-db3b98762902", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305506, "uuid": "180ff5cf-1822-4740-bc11-de5fa0c85b0c", "value": "12288:YP+s4V3yPotxgs172LHdu0fFEVntyJUY6LjY44RbnkIXlqTZjxBmARFN14ZkqONX:Ts40Q3wLFontzERZUbFNCEbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305506, "uuid": "1329626e-e693-4aa8-b2c8-78d6102b3ce4", "value": 1076736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305506, "uuid": "fc7b3332-269a-4db5-ae2a-f03af0c27094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305506, "uuid": "1a8e4155-a43f-4309-b938-4176d3e50ab8", "value": "258d6bea9e93caee50bbcbbc9a5573e82e76d141f2f151626c45d083c34d0c5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f360c05-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304095, "uuid": "b8792107-92ee-48fd-8c11-28e298866872", "comment": "Malware payload", "value": "1bb138f2a2f2c7bb9d7391510e49f6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304095, "uuid": "b607d578-4492-4896-8525-e110de344036", "comment": "Malware payload", "value": "2592dc5a7fcf08f0f86c0faff98a4c71a964957a73fb8768fdb914d598b6f08b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304095, "uuid": "a97e0678-4065-4fcc-a9fa-98bc723a67ca", "comment": "Malware payload", "value": "5b9524f9a9b224eb4112d538a2b2efbc40488352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304095, "uuid": "16060cc2-28f2-414d-9836-6a1aa4457b11", "comment": "Malware payload", "value": "5122f8fab4152e6531e2943856c3987e9d33669faed81e31ec15223473e16cec459f675ef47ada20c4d01130b139d890", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304095, "uuid": "69b1ed18-9ac2-4fe4-94b5-83750f93816f", "value": "T16094F713EA207169F89349702D38A256382D3D7A2681EC4BF78D9F5A37B199361F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304095, "uuid": "19c5edb3-443e-4ed4-b2d8-0c7322dfd486", "value": "11f43c9987ca94ea44385d1d83666b7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304095, "uuid": "1a0d977b-f301-4443-95a0-54adca9b9501", "value": "12288:raisSAdamXIulHIOmRZOFlF0pjhtxkh2L:kMOQmll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304095, "uuid": "ed3995b5-6d28-4c23-adf0-d6434f4409a0", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304095, "uuid": "40b4c978-e58a-42af-a0a3-f2485312614e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304095, "uuid": "603cd26c-d726-446d-afc0-e99b8454276d", "value": "2592dc5a7fcf08f0f86c0faff98a4c71a964957a73fb8768fdb914d598b6f08b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecb2fd4-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305141, "uuid": "78f45701-a46b-4f3b-8d35-11fd2a7e1719", "comment": "Malware payload (AgentTesla)", "value": "335b0adae5cfa2dfc0a4fdb2ee5eb44e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305141, "uuid": "d5686e9b-6e1c-4f54-8591-09940db0d029", "comment": "Malware payload (AgentTesla)", "value": "25b6c97e4123841f86e355391dc50962582bbfef6ad2663a5952d3c8a4335a10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305141, "uuid": "24af5816-ccc7-4cbc-8922-ab61f7184218", "comment": "Malware payload (AgentTesla)", "value": "d6474e9c266935188653bea6f3843cac872b29ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305141, "uuid": "e9520570-dfa4-4c76-8a6c-871d0d2fc79a", "comment": "Malware payload (AgentTesla)", "value": "5444453317f0342c6aa61dffaf0df15d12adf4074af665005f3f6c3929103ecc682347017c82d3cdc92119ec72f06ea3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305141, "uuid": "fa96688d-3fa9-4332-91d4-b8e36acc1577", "value": "T12E85E1027381C066FFAB95334B5AF6115ABD79260123A52F13981DBEFE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305141, "uuid": "e0f1eaf6-14b4-489e-b5b5-8913fd44745d", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305141, "uuid": "8208a165-6f48-4178-be36-a252c2a67d9f", "value": "49152:sPVtxLZeJbInQRawg6/nAWeuANDmg27RnWGj:StYbInQ5/nxeZD527BWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305141, "uuid": "2dfdbce1-27b0-45ff-b85f-4ef0021b9be6", "value": 1806848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305141, "uuid": "0812b605-063a-4258-af02-51cf44a926a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305141, "uuid": "12d1331a-f257-4f30-a997-2d551f9a2c32", "value": "25b6c97e4123841f86e355391dc50962582bbfef6ad2663a5952d3c8a4335a10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc4e897-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770305868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305868, "uuid": "bfff9484-2d64-4156-9f6d-992e75985b9b", "comment": "Malware payload (SnakeKeylogger)", "value": "e048521447b53b2340b0c014606da12f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305868, "uuid": "ecf831e2-ac5d-423b-8e6b-6225d61acdaf", "comment": "Malware payload (SnakeKeylogger)", "value": "25b86402f8de04cb7ce3be089f007c8410ab83f14fbdb587b76a03043bc024c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305868, "uuid": "478f7b51-d31d-44e6-8a34-ed320eae3a9b", "comment": "Malware payload (SnakeKeylogger)", "value": "daf79dfc2846d8ed5c8adc7dab1b0a4b5e474b1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305868, "uuid": "d5618080-e636-401d-883d-135ceb8b457e", "comment": "Malware payload (SnakeKeylogger)", "value": "022da2140fffeb86b67474a96b60d438181d4e14a6aa641d5e30d1e42229f3c1e29f5fe36dda7096503cc605e22a013c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305868, "uuid": "0d2039f8-44da-4292-948c-80d507629a79", "value": "T1A385AD15E3E901A8E567DA38CA619333DAB1781A4731E58F0B98D7562F33ED09B3B311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305868, "uuid": "a49fea80-e586-4b8b-9b61-841dbdbec048", "value": "b31fa30c377b7584dd6c4a686890d3e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305868, "uuid": "2eb5f1df-f367-4f8b-959c-740aeb3c9bc3", "value": "24576:1jRx4nY0w82SCLQMb/CPCLyBtbWw0CGc9IcLzQBRGSIqxFMusAaiJwU0yKuj5:1jRx4nNICdr9IcgBPIqSiJ2yKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305868, "uuid": "3596df5c-1eb1-4137-bdf7-eac264b79ffe", "value": 1789440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305868, "uuid": "15011781-b309-4140-81d7-f6655972bbe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305868, "uuid": "14bdfbd3-57b8-4de0-8844-cbc84fdc317f", "value": "25b86402f8de04cb7ce3be089f007c8410ab83f14fbdb587b76a03043bc024c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce716213-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307235, "uuid": "bc5e7042-05d1-445f-854a-01975d86b3e8", "comment": "Malware payload", "value": "0746a3ca2bfab50bc5c014bd4da3eabf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307235, "uuid": "e3625727-16f6-47c3-a894-b60cdbc54772", "comment": "Malware payload", "value": "2648d287d21717fa390d4dc3281b5ef2b5a87b4f727ea3a04439937a712b35d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307235, "uuid": "9d190dfa-6574-420f-bd93-7147ffd68e5b", "comment": "Malware payload", "value": "f2edee3bbefda7d68b73850ea6282c9f4767f10e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307235, "uuid": "1a6f50ea-7649-4479-89c5-811f1ac257df", "comment": "Malware payload", "value": "b38430af2a90157b72dedadb3e173027c39dc374fc4ca203914414f162678bb200d9004d19fbf5ea1a66f9c8d29194c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307235, "uuid": "362b911a-eea9-4bf7-956c-d8b7c8c089c9", "value": "T11E551229A2426F31D05F92B04CD7826AF537EF444D2AC7DBB2D85F05FB3229A016578B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307235, "uuid": "7c55df23-81be-47f7-b542-7c8aad8c2ec3", "value": "b8494300a1f7342d4c600a7b12e15925", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307235, "uuid": "c9413b4c-9d4a-43b0-b589-696930e36584", "value": "24576:eX48QE+UTJ4nrlA10oOcJhL+Ugb4shsU0yd0Og3fuZCRFEMAtcOo1Xx:eXz+e4nrlA1ccJYKOd0OgBHEFcOoxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307235, "uuid": "98dddf57-5ca2-41e7-8b36-247ee401b1e4", "value": 1404140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307235, "uuid": "b7d4e716-5bfe-4ade-966d-234271631b9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307235, "uuid": "37c1dd5c-e30b-4357-9945-b6456054daf6", "value": "2648d287d21717fa390d4dc3281b5ef2b5a87b4f727ea3a04439937a712b35d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72984ead-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770306651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306651, "uuid": "9a1be5a2-d154-4bac-8ee4-5111d6293c6d", "comment": "Malware payload (Formbook)", "value": "8c0a7c6e825a528b780ce8b1f1d28ce5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306651, "uuid": "a3546ee3-9201-4c75-9c95-004ba78a1660", "comment": "Malware payload (Formbook)", "value": "2668721d7e8e28cfb96a302d08e439c4e2eaa2c12075e3d44d39d2178aadb985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306651, "uuid": "ce5794af-b5ee-402f-a073-23c8a2e7d019", "comment": "Malware payload (Formbook)", "value": "da7aa56218c9dd927421f9317c510f8f8a3d3bf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306651, "uuid": "71cb8082-182f-4d81-888c-dd9678de1715", "comment": "Malware payload (Formbook)", "value": "061b6e0e94090c228fd564d7a1ae2fa6d35659ffbbc331b9a6b1231b8d6e88f1c7f3dd3d87583087e68374d813afa93b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306651, "uuid": "19934d11-5a3a-49d6-a664-be030aca6750", "value": "T14D45BF027391C062FF9B92334B5AF6514BBC79260123E61F13A81DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306651, "uuid": "2a5e88b5-d584-4e0e-9547-727e3f81c26f", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306651, "uuid": "47dd1bae-8fca-4aff-b87f-349fb53a8c59", "value": "24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8aBQsRhx3:UTvC/MTQYxsWR7aBQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306651, "uuid": "be48ddde-7d25-41dd-bb84-c377a34f507d", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306651, "uuid": "fa16a13a-1d55-4680-8eca-706619c3f658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306651, "uuid": "2f047c1e-21e2-4877-85b2-f7b6b460f2d9", "value": "2668721d7e8e28cfb96a302d08e439c4e2eaa2c12075e3d44d39d2178aadb985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fdd0fb-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770308002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308002, "uuid": "b82e5969-a3d2-46cc-bd63-d988b71a1baf", "comment": "Malware payload (a310Logger)", "value": "6f43a9b362d5b769b9da6deef3e667d5", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308002, "uuid": "edd9ab0f-09b9-4031-a3f2-f76056e87cac", "comment": "Malware payload (a310Logger)", "value": "26828a85e5a93890ff167453f90a9fa7fa02995b030a8812321a5ff7385920a4", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308002, "uuid": "05d0348a-f3de-47b0-84b0-2aa0359f440c", "comment": "Malware payload (a310Logger)", "value": "ef6ba9c701f34aba421db6c028cdb03f6f07f295", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308002, "uuid": "b5eb0341-4665-4060-8d6d-d4885a8cf7a0", "comment": "Malware payload (a310Logger)", "value": "a8f71bf72c4313d85acc8398a71ce0dd613ddd2d168ae4e6ea5843dcd88674f455125a2696f1de9fdc29a4eff809dbe0", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308002, "uuid": "e361fe6a-b6f0-4265-9fb9-22863dfd5b10", "value": "T140845B23E620A12EF1A3C9F1B9A5A25728263D3A5698EC47F3415F5834715E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308002, "uuid": "c762e712-66c7-4668-b14f-47b82854f716", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308002, "uuid": "35a4e98a-4c8a-4362-92fd-60c57cb9a714", "value": "6144:p8d1/w5KA81IJ8GpF6nuTmOOUWTixcBfbbNcknSrnGRyZXPFnUY:yjYKkJj6GmZUWGCbcSRyZXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308002, "uuid": "8d146bac-5626-4098-b21b-ad4888cc96de", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308002, "uuid": "f5e9c084-d666-415c-914e-499c444cbbe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308002, "uuid": "73ec2105-5246-40e7-8913-578ef16406ad", "value": "26828a85e5a93890ff167453f90a9fa7fa02995b030a8812321a5ff7385920a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2798a4-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305192, "uuid": "fcd348b3-430a-4e4f-ad44-c99af2f91d76", "comment": "Malware payload (AgentTesla)", "value": "2650e3012a002449d96c1d93956ecae7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305192, "uuid": "3315de93-4fb2-4e85-a7e3-216216e213d9", "comment": "Malware payload (AgentTesla)", "value": "269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305192, "uuid": "5173224b-69cf-41ca-a96e-4360843a48fc", "comment": "Malware payload (AgentTesla)", "value": "bc760ca7ebe6d01c9f56911f6f73c6f1b02d3e24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305192, "uuid": "d89d7d57-b2f8-441b-84d1-d49fa9fe0799", "comment": "Malware payload (AgentTesla)", "value": "b3739996cb7c82363df772769e774b9ee50f80530199f2c2b7c75bcf7e6ba51f8e855fa5b40b0f2f658b1b175c592ae9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305192, "uuid": "e07b6b95-9163-453d-a04f-832d7c7e2474", "value": "T165151290779AEB03C0D55BF40A65D3B52BB09E6EE820D3564EFEACE73135B5528843C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305192, "uuid": "b5848295-8d99-454f-b171-d92e4621f3b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305192, "uuid": "87066f3a-e1f8-41ed-a44e-e13cc4288769", "value": "12288:V29y7hqZuHR2ye5/qOSzhca53zn6zUSWqknCgeDwNgdzOhlmhZZI9/GCFGJFTL2B:V6uHR/e8luAn3etyfmhZzhJ9aP69QN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305192, "uuid": "600d8f84-b5a0-4227-ba8b-a628f818cf40", "value": 927232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305192, "uuid": "5f668f6b-caff-4a83-ad05-0104be52fe24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305192, "uuid": "9a9e5b0d-85a2-4167-8ff5-3f1c145658dd", "value": "269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94859dae-025f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770274496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274496, "uuid": "5939c365-fa5a-4883-987e-120642f29974", "comment": "Malware payload (Mirai)", "value": "0f150a5356ac2876a94421b7707cda16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274496, "uuid": "b5e60c53-fab1-40b2-bd50-d758bf224634", "comment": "Malware payload (Mirai)", "value": "26a534d1779b556b747fbe2cc7b5bf30cb21e3eefc70df60b4124135009ce6c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274496, "uuid": "755c55a8-31a2-4751-b6b0-e3d262c60bc0", "comment": "Malware payload (Mirai)", "value": "197327954178e876a6355babfcbd1f4ab5ab5992", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274496, "uuid": "f8e55843-2be0-4d6d-84f1-a0a3f9c87e82", "comment": "Malware payload (Mirai)", "value": "86ebe3c9700c8c22ff45a401550e61adf2aa39dd6ac3d0b4f201481d9f4500489397755feb6d9cd2db3ff8c0583f6744", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770274496, "uuid": "789d3065-50f7-40bd-bdb1-b6f3a5ca666c", "value": "T165E3137359E8988ED3BC3D79C698A90977C0B6C62E6306EF32775B85C8F81ED4540AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770274496, "uuid": "0e5b35b1-cd1f-48de-baf4-2365fd6acffa", "value": "3072:L1UO76Cv2URoDHlKpJXaXIJA/Wkx1gUHLpjdsCDt402gh3ZI:L1U4v1RoDFKzKXIJA/WcXpjiedZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770274496, "uuid": "aa327682-d1bc-4780-a6ae-4ae24d4f2b3f", "value": 149196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770274496, "uuid": "d0a71b68-61dd-4f84-a96f-eff0caca8225", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770274496, "uuid": "efdf88cd-aac9-491f-a400-83c3b5f1a9c3", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c121751f-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770303776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303776, "uuid": "67ae3777-c17a-459c-89e8-ae937b415407", "comment": "Malware payload (RemcosRAT)", "value": "6f04b6e18c77f02df2124ea4370ae02e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303776, "uuid": "76da9dfa-965f-4382-a389-d70630454f47", "comment": "Malware payload (RemcosRAT)", "value": "2705f75704043f80705fd0f19b3c38b4253c5c072edd8b183a8664a972107599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303776, "uuid": "1cf11d92-769b-44bd-84af-0ed9d262f880", "comment": "Malware payload (RemcosRAT)", "value": "e41475eb77d4c17a833e060575e7c56e516fa47e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303776, "uuid": "880d6189-45cb-4355-9ed6-5d745c999c36", "comment": "Malware payload (RemcosRAT)", "value": "d7309351754ab1993d52149ac71cbeb483fd6c71dae1662c5661983c1360b1814ed9a5ace4414cd5a40409771e9f7ee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303776, "uuid": "7405269a-1d35-461e-be28-88d613573901", "value": "T1BFB4019923A99B12D6F24BF210B1E37157753D4EAC21E3194EDDACCB34A67A06E04B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303776, "uuid": "2e8bc6b8-b00f-4b1e-9d34-552e651940eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303776, "uuid": "fb12d5de-467b-4fb8-977d-e679d7467b1b", "value": "12288:7xsA11D+yCKSF7PWivWiSlf4zAjo1V3+RYkR:VsA11MYiCxy1VORP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303776, "uuid": "eb1fdd20-e998-48ee-8318-d4c21280d302", "value": 517128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303776, "uuid": "9152309c-f107-4151-b463-88c16c3d6888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303776, "uuid": "f9961099-4c3d-4d65-949e-0d2408730453", "value": "2705f75704043f80705fd0f19b3c38b4253c5c072edd8b183a8664a972107599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee88c97f-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770303853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303853, "uuid": "8f8cc7db-bd7d-4c9b-acce-1e7734329d82", "comment": "Malware payload (GuLoader)", "value": "40d82567079d9b37aa60a5de2f933b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303853, "uuid": "09be15e6-4fca-4270-b2f1-8a89ba0f4056", "comment": "Malware payload (GuLoader)", "value": "27635ad785cc552e1f820d5aec89ba081930d4bd81782932f813fe8f8f0893f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303853, "uuid": "7413e53b-878d-436c-9299-8a09a9b899c0", "comment": "Malware payload (GuLoader)", "value": "f0b66b230f356385d88f1f2ced60c00f85fd4a90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303853, "uuid": "440fa0c2-4d6b-4ebd-aa05-ef09afc46896", "comment": "Malware payload (GuLoader)", "value": "0b77b9411741dd5fa88b9fe4c334f5a3788be1ed12a62116f52604a6c92485b10bc1db0760f305800e76c49a61eaab96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303853, "uuid": "37fb47ba-becd-46b9-aed9-61b835f0c28f", "value": "T101E42382A7A1F8F3E5380235DE7A19B7BDF6D78595345F1B17C1A38E7C62900826ED40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303853, "uuid": "f130053e-5d2a-4105-a24c-3f3e3e90e4ba", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303853, "uuid": "1841ec68-5d26-4461-9fa8-fa0e47145b61", "value": "12288:yFnTYkDxanQr/2wtMdxjQEJIirZbCrgXGKXMZcJ1US2GDCO3xJVQYEzHi8LjlHuC:yFnTzxRqiMdx9rNnGK8ZcXGOhJV2zHzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303853, "uuid": "f20eff7e-a650-4b15-a7dc-4d85380c353c", "value": 691216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303853, "uuid": "584dd67f-aaeb-49da-8f54-c438967c3db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303853, "uuid": "68ea7f0c-fea3-4e14-a231-47e86a47f7d3", "value": "27635ad785cc552e1f820d5aec89ba081930d4bd81782932f813fe8f8f0893f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffe0f31-0283-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770289762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289762, "uuid": "b13adf19-103c-41da-952e-f2d0eee9a407", "comment": "Malware payload", "value": "db12b448150e5549b09730f9520a7c8e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289762, "uuid": "e47454c2-f0c4-48ef-ba02-0d97dc31accb", "comment": "Malware payload", "value": "279144a2a073b654093ff45c991ed72e746a868a93993be661ba5c712a97a2a9", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289762, "uuid": "879b27d7-3985-4099-a356-650652f75b98", "comment": "Malware payload", "value": "3fbcdecf3c60c6587e2023bff98bb36030ae5789", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289762, "uuid": "b193e333-9e81-4874-843d-610238b23d41", "comment": "Malware payload", "value": "7d5f975f9d2871ab29a60f5b12d11d8709938adf202c9c581fa00095caa61b867c298621ef286c444344d00daeddb8bb", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289762, "uuid": "85618eed-9378-4622-9dda-4a8e32c2c80f", "value": "T18A44660022F58214E072CE3DAA37B3A1CC75BD4DCF25B79D0264A90D9C60624E926F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289762, "uuid": "a7964be0-fff4-4a0f-b391-941577d11e14", "value": "12:8d/r0oK/VUbX4SKo6Ss8X5SniTXt4CluNBXf8XQLyD+ssMh/4xj3UFcgYzFmsK:8d/i/lfSuiTsNBP4DnPCfHzFmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770289762, "uuid": "f38772a8-9d05-4d58-8488-882ca19328ba", "value": 271433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770289762, "uuid": "d2c63e94-fdd0-4e5e-90fd-a7a1d04ec5bd", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289762, "uuid": "1f4f7256-676f-4fab-8a11-be28414705ac", "value": "Projekti_kuva.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e04dba0-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306536, "uuid": "f7f70ae4-3553-43b9-9bd4-75c398824499", "comment": "Malware payload", "value": "62736d9a11c3e7fc2f882f3441eab51a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306536, "uuid": "98eec951-26dc-4860-a1f2-da6d9d770a21", "comment": "Malware payload", "value": "27ebae45af11d71be3f94e11afb89c2153c653910026ce75a0518aac3fbba069", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306536, "uuid": "3c471660-6da2-4a88-8da1-02a73ae9020e", "comment": "Malware payload", "value": "bf4022a73132f1b035d739658a57791fa6aa8a87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306536, "uuid": "8d03a6df-7fdd-40e4-920b-f67599c87381", "comment": "Malware payload", "value": "63c973d6e7d37f0f9f30895c4940947fb3508e2ecabf2c1363a0b8adb667c206ba2d5b2a67a6db8d037d6a88cf6e2e3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306536, "uuid": "76409de6-8c01-49a7-b7ca-e31f7e8bea09", "value": "T14C26E02F6F40A595CA792EB97E3F139D63D5F632CCA6880B6EB01DC4867632031965F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306536, "uuid": "6c97c38b-1514-45f8-9885-5dd72ac6e3bd", "value": "90d3d45c4128e324bab07310ba2c236a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306536, "uuid": "e7b3ea57-697b-4eaa-9b90-e236b0ac60a8", "value": "49152:ZjdW0VqeMwXnPEPCQDV3/VkebpM1PQdpaB3QpCsnGELaEKOioNdQZ7vlEn:FdW0D+R3/VbCJ3Qw7toNdy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306536, "uuid": "ffb95ff5-21fa-40f8-9f9a-a2da09c68f55", "value": 4778496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306536, "uuid": "bb3a5c2b-dcb3-4118-97da-3b9522343fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306536, "uuid": "f87d95b2-3e7b-448b-9ae1-d3fcae8251f6", "value": "27ebae45af11d71be3f94e11afb89c2153c653910026ce75a0518aac3fbba069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87adc4a-0257-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770271174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770271174, "uuid": "59cc79ef-a488-4d05-91b6-26ceeeb71b80", "comment": "Malware payload (Mirai)", "value": "acc2761be4f10a8ab8ade7109207a912", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770271174, "uuid": "84a5476b-3873-43a3-9f1d-82a7ad87ff82", "comment": "Malware payload (Mirai)", "value": "27f619221277bb49ca993d373967a39ffdf38013cebe4cdc30c1f37f70ac7335", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770271174, "uuid": "813319af-4f0f-4b9b-a130-8cb76fc50de8", "comment": "Malware payload (Mirai)", "value": "fbe93e37ce0508dc660150a7bb6efb2d658cb5ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770271174, "uuid": "ad7b8ebb-68fa-47fa-b8fe-97ef3435033e", "comment": "Malware payload (Mirai)", "value": "e0bd25a85a65702b3b5229a2983cb3084651234750edc0aa7c5f8fba178db6938d3298b7417092a0aa8e2370b26a44c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770271174, "uuid": "b5d87017-f182-451f-a54a-07345f7d06db", "value": "T1A40412E52A19F1B6C9F43FB899E6E3849B42479F9A39043E201D161B70B50749F4B38E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770271174, "uuid": "585baaea-ad49-41ad-9485-d03011de8d39", "value": "3072:XTuZttStV+a2W109Xx0dNY7CfQXPzy4XmAuMI5uZVzymxUWzAND9TOFwVlXQH0Lh:Xet8rq9AN4OGmSmAu9NFWzAbflX09i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770271174, "uuid": "e54e7e82-c752-475a-99e5-628dd7ff2698", "value": 176820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770271174, "uuid": "bbbef83a-f8cd-4c91-a033-5ff36b7aab62", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770271174, "uuid": "f8ddcf46-dbab-4975-a949-4eafe3a28ff0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac14e17-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327227, "uuid": "5ce2c6af-1cd5-4af6-a4c0-3b49d235e93c", "comment": "Malware payload (Mirai)", "value": "c4468e60c68346722726e12e755eb789", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327227, "uuid": "4ab26c84-def7-436d-aa7a-ba635a8c36e3", "comment": "Malware payload (Mirai)", "value": "281915328259d20f2b7cb94061a4f4f4bcdf908423418146ccd0abb86cdbbd75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327227, "uuid": "b472c8e8-3c92-41f6-b67f-a1df1bbe4c83", "comment": "Malware payload (Mirai)", "value": "3acbcd191789c1c59e296b447da665af4381b174", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327227, "uuid": "65a32ccd-8f3d-40fe-9ac5-fd10bccf93fc", "comment": "Malware payload (Mirai)", "value": "4bacbcb2c332ed67cb2f8d61d0802495043f71cb5f3061a10106c85a3021b854805b59298321b05eb254a780b09938ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327227, "uuid": "9138c270-a2eb-4114-b8ff-411495b3f301", "value": "T195932ACAB401DD7DF80FDBB74423490AB531E7621A831F27676BBD93AC321A44957E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327227, "uuid": "9b2befed-f31d-497c-8301-1317ecadb705", "value": "1536:Jo1lgASXXuKbM4c81hUqHd7NQjnbJIGYfoYHPhK+8r8wB4iWrE5woW5vkMtWyBBI:JFMd8vr97N6XSoYvlU4Q53WNrP4rZCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327227, "uuid": "e1ec5c83-700f-4051-9608-46d763d08048", "value": 91932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327227, "uuid": "aa8ffe6b-e94b-4785-8e08-7fcf35ef5869", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327227, "uuid": "df4258fb-2319-4161-aea2-44174d49004e", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd933970-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304737, "uuid": "a5a2bd92-9c13-444f-b73d-0f8d665f8f4e", "comment": "Malware payload", "value": "c373065716bb494bb89a84e8753cde65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304737, "uuid": "6722455f-0735-4277-b18c-91480fed0334", "comment": "Malware payload", "value": "2849e2c01d5c876e9c63cd08ae7c42578373b018b7a4ba98e79cab70a7b7bc12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304737, "uuid": "0b577a77-f31d-43f2-afda-0555f1fadff6", "comment": "Malware payload", "value": "dbdcf6bc5fbcb2e18df638a7ff54cbc397c1877d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304737, "uuid": "962679b4-3ffb-446a-b2c3-a8d5987ee830", "comment": "Malware payload", "value": "365a6ede5842b011183bb6480761ac422370de6b8031efa8e8923ab14257f205c31a0bdf048ea27dc91b2325673c385c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304737, "uuid": "c6d686f7-da10-4068-97a6-9772ca96d9ea", "value": "T15194F626EA60B465F89705702D789257292D3DBA2540EC0FB78E9F5637B098BB0F530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304737, "uuid": "a61f382e-5fc5-46e3-98f0-39a818e3424c", "value": "9dc25258d505a6eec0986a3197c020b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304737, "uuid": "be177ba2-6566-4d67-ad8d-994989c299dc", "value": "12288:Zy6sAQQnhI6UPW+gEtmUF5p3OZWubnxw:ZyMkDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304737, "uuid": "dfbb4b35-4a81-4c39-9191-534cdfb2608d", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304737, "uuid": "f193e898-2a31-4891-97ee-7cf61543ccd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304737, "uuid": "3ebbf181-fe62-4f5b-9724-23f70e54d7cc", "value": "2849e2c01d5c876e9c63cd08ae7c42578373b018b7a4ba98e79cab70a7b7bc12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67aa10e1-02e8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770333262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333262, "uuid": "de6094c7-a701-46b1-b9eb-6ebeff778f8b", "comment": "Malware payload (Mirai)", "value": "7843c1b51a6657dc295432fd7807f01c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333262, "uuid": "f104f708-fb38-47ac-84f7-be374ac8cd03", "comment": "Malware payload (Mirai)", "value": "2868f7232eba1a6a9a4579b54d95c3b41a34a101295ecc6ef9ec59bdfffaaab6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333262, "uuid": "edaf991b-2b48-4b25-bcf0-81469bf5f1c2", "comment": "Malware payload (Mirai)", "value": "14d3ebc248b70b205671e09132edf3227b54580e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333262, "uuid": "bf817b77-207a-4dd1-9e2f-94cf2d5b1c4a", "comment": "Malware payload (Mirai)", "value": "ba781668c4f82da44df2e79c80b2b96d7773e05854712ee08dcd6551864beb22604b7bb318488158333cea1c673023cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333262, "uuid": "89e764ea-de51-4b48-84c8-a7cd8c0532d8", "value": "T110533B02B2280A5FF9D319B0343F1FE197BEEAC035E0B689695ED7558635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333262, "uuid": "a7834dcf-264c-4699-96c1-40095c9a7dfa", "value": "768:PtMLxtiRFwLoDnud1kvSeq7Q4dPfGAsLmZ8BBSzjrYiyR7gHX1SPgIaalH:VMLSBq14Se4GHLTBygfGXAgIVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770333262, "uuid": "fecc6fa1-ab94-4eef-9cee-2f9c9b4191af", "value": 64248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770333262, "uuid": "73151478-c7ac-419a-af5d-c8a4aa20b472", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333262, "uuid": "ef5e64d6-0292-45a9-a425-73aeb21b3e6c", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31200afb-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306112, "uuid": "7ebcfd24-daac-41f0-9115-74969f5706de", "comment": "Malware payload", "value": "e6cb050781049d570b01be0846ced71c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306112, "uuid": "8290b815-8e5d-4b7a-9328-c6d615f5fa31", "comment": "Malware payload", "value": "290ee34d5ec670e16dd64844069f1e280310a1600e0dd1086561d92b48fb5c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306112, "uuid": "80ae3b0b-4db6-4288-9505-4f010f8454e0", "comment": "Malware payload", "value": "e1384ed64c002e44e9e5c52445670088491dad55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306112, "uuid": "273cd004-351c-4857-810c-6bcb46cd6163", "comment": "Malware payload", "value": "13c017bd7b075d9e70e6b02c40cafeae6390c70df09d503c8f7ea2b34ff5586d556acee0b63a3117cced1523c9e32c0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306112, "uuid": "22306e41-dd63-4fa9-a37e-654a9f4f4e92", "value": "T19D247A67A42CA79FDEDA2F32ADDE8A3353A65FC4CA91103E0C14730E3C671095E39656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306112, "uuid": "d9402db6-6567-4238-929a-6a1ab9c15410", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306112, "uuid": "8766d0fb-42bc-4df0-87fb-ceba36f49cfc", "value": "6144:fynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g3E:KnO56dyO7Wc8oNrRHwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306112, "uuid": "88c17f44-adcc-45bf-9615-518874ec57b8", "value": 226018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306112, "uuid": "66cd2184-8878-467c-909b-c8ec5f7be395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306112, "uuid": "514539a9-fd78-4e36-a660-e7a96d5c53ac", "value": "290ee34d5ec670e16dd64844069f1e280310a1600e0dd1086561d92b48fb5c58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91499935-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307562, "uuid": "b6b52789-4b26-4644-a981-393d161cbf18", "comment": "Malware payload", "value": "a16065e1a4dae8ed70e899e251718ecc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307562, "uuid": "fbed64b6-a6c9-47d6-bc8f-8e9d553c7c48", "comment": "Malware payload", "value": "296663bffbaa720b1c857acf0cc46bec7355f1af1962f214e41a75cc5fe35817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307562, "uuid": "3784367c-c0ad-4995-88a9-2992f1088016", "comment": "Malware payload", "value": "8a73ba2f0b44033178dd2988be679b18ed0674f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307562, "uuid": "140d082d-3bab-4632-bfaa-5c78592052cb", "comment": "Malware payload", "value": "15700917e2967b18d0bd4d94c110c80a7d5d5be174ef1bddd2710987ce9f07482bca05012ec31596d5543b37c27ecee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307562, "uuid": "a6f3ea14-71a4-4717-b8da-4dd546b3e7d0", "value": "T1D3E4D00613F84A69F4BE87789075102197F4F996C236EB6FAD4DA0F41E32B90DA56333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307562, "uuid": "7d4aa34c-730e-4358-a34d-4402785be96a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307562, "uuid": "54dd969a-1305-4bed-bd37-67bdaa71fde7", "value": "12288:GvFKBXNjJOTazMA84SVJDypS1WcHgOhH6/pXHMNR3j6YdAyPEh1zPLSR:EFx1RHGAWq6/p3ojZP2TS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307562, "uuid": "6bfd1809-a8d1-46c9-8178-c521facfb8c5", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307562, "uuid": "409818e0-dd86-45f8-abcd-e2b257779283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307562, "uuid": "f8df665d-4eea-4a51-a1a0-7f0822587ccf", "value": "296663bffbaa720b1c857acf0cc46bec7355f1af1962f214e41a75cc5fe35817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476c13e8-02d4-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770324617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324617, "uuid": "3c2d76e9-3d8c-428b-b7d2-e717811d958d", "comment": "Malware payload (Stealc)", "value": "80279dfbe1822d7056fec0c3c91f75bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324617, "uuid": "65d9a1cd-107f-4f6d-ae3b-8cf459a37bb0", "comment": "Malware payload (Stealc)", "value": "296c1f9234d3605216825597770584efcfec9de2dbb439aba3f3fd433c7b9077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324617, "uuid": "b764971f-d0ec-4b3e-94d2-0afbfd992153", "comment": "Malware payload (Stealc)", "value": "153b4ae25f794be05192ad964b99cee6f1891d9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324617, "uuid": "ade47f85-e82a-4569-97cd-a218fddc0e90", "comment": "Malware payload (Stealc)", "value": "57461574ed12364ea5163b27f5f03c2f56977c86a37be6a588c785fbbfec0156f0f405b847edd997794f978fdb12124e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770324617, "uuid": "339e84a2-156f-4e11-abb7-7a6f83a51576", "value": "T15B77121037F452B3D05597B6E46266F53A327EB62F05811B2543FFEC3A2E3A8293171A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770324617, "uuid": "789d05a0-9456-4254-9a24-0a51e8acc0af", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770324617, "uuid": "1a80b50d-7ee5-4c1e-9046-593716c53620", "value": "49152:fdOX5PGDCowloYe7sOzJJZlcTbW7eZOGjfl617utfMc:1uoVrZFJZlcH1ZdfQefM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770324617, "uuid": "741ba913-30b8-4306-a8c4-3efbd7a5d459", "value": 35651584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770324617, "uuid": "757f8e49-eae9-4fd1-b4a6-7872523be5cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770324617, "uuid": "73002592-a2e4-441a-b106-8bd101da3b55", "value": "FL.Studio.v25.1.6.49971.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "572b2871-02dd-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770328509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328509, "uuid": "d34f2688-a5d1-4f34-9866-e90d56cb22bb", "comment": "Malware payload (RemcosRAT)", "value": "57cfd6903b89b1033ed5bef1e4386b72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328509, "uuid": "f8e1b8a1-6cb6-430a-978f-65bd68d973d2", "comment": "Malware payload (RemcosRAT)", "value": "29b124901c803bb961684de09d69bb0d12c4eb2424b2167c692d4e795ea1f051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328509, "uuid": "6153f339-327c-414f-ae94-47f803a62255", "comment": "Malware payload (RemcosRAT)", "value": "98db58f3aae3d9b491424bbb5b73d511eca2ebe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328509, "uuid": "83728d4b-d5f0-4826-a562-93c27c9ea0c3", "comment": "Malware payload (RemcosRAT)", "value": "50eb9f8500e5126a4ca521183b57dfd0988a26c076c85c0d6b66152a0a928fe2db0667b55612bb76ae0e00da305bf878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328509, "uuid": "f4b4eafd-bdb1-4e79-9382-d3a1ab43931e", "value": "T14345F14DB24E82E3D8D00D38E3A3B3411715BC7F6A35D49BB1887B68D8FD154DA89A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328509, "uuid": "70c3584a-abb7-42e0-af58-0c4217c0c416", "value": "151cb684d328118cbcb29c80e832621c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328509, "uuid": "631ae8c8-bb7b-492c-84c0-7a1b8131f542", "value": "24576:XH3zHNpaOW/vbO0bU/9yKLUL7yKU3CAK7AaEkBEM5sHD0JDQ8gOPYXn1:XH3zjaJ3bg/cHyJQ7AM8D+Q/OgXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770328509, "uuid": "96c275e2-bd86-4a33-af9f-d3df271aac41", "value": 1186304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770328509, "uuid": "f4515f67-c2c5-4093-8214-7cde0084687f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328509, "uuid": "ca3e5132-e245-48bf-84ee-f1464181bee3", "value": "PDFsamBasic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8c6c0f-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305322, "uuid": "5091513e-27f8-49cb-a639-0f038fe2e3a1", "comment": "Malware payload", "value": "b7e5f73e4dfadd77a2230c6e474a2aa8", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305322, "uuid": "d8c17657-43e1-4f28-b77b-1e759340527f", "comment": "Malware payload", "value": "29c3098dd8c8ae564e5315d07dfdf07a6dc43455dcfe844e74675a632ad29efe", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305322, "uuid": "c023ff82-811f-4473-94eb-86313a318b6d", "comment": "Malware payload", "value": "651b52cb94c5210bab93b624afa383db2c12b712", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305322, "uuid": "c9cf8c3d-775c-4047-9902-969476cd86b1", "comment": "Malware payload", "value": "a70c1420b33ac0e2439178504083581cdcf782105890f8f9f2c8358edd0e15b1c2c9b6a44c4354ef16f20aa73334ad1e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305322, "uuid": "93b142ba-26c3-4a9a-95de-29d5ea34d745", "value": "T190C3023DCA1CCC09C695807F941904B6ED19A9FAD6B0AB0F381EED1415C4BCF19A99EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305322, "uuid": "ae94879a-5ec3-4b34-875e-f52e33466f5e", "value": "3072:weRfa3+mgK2qizN2JL4xc2qszTO97pUTv24:fRzQizoJLhlI+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305322, "uuid": "6286c7f2-94a4-4c40-8780-3edc3cb74ab8", "value": 120590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305322, "uuid": "d623535d-d648-45c3-be78-720155c01845", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305322, "uuid": "596f8d33-7387-43bd-9a24-a51a4d8b605b", "value": "F-DEFR0001.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77326cf8-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304511, "uuid": "70ac254b-70c8-4dd3-a928-d87e10411d3f", "comment": "Malware payload (AgentTesla)", "value": "4eae810ffb75a8548a409f1cffa2f533", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304511, "uuid": "c5bbd514-a3b1-4fa3-b137-7d168572c772", "comment": "Malware payload (AgentTesla)", "value": "2a4d1110d2c4a719dfc35e7a6542885a442834df4b1a36a8264ac825c121f323", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304511, "uuid": "22bc46c5-2b54-4a31-affc-bb14d161de0c", "comment": "Malware payload (AgentTesla)", "value": "e6a5d9d170877247f6bda6587a3a09ee3cdf9364", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304511, "uuid": "2882a3e6-c185-4f1b-8e8f-ab7123e231c7", "comment": "Malware payload (AgentTesla)", "value": "9f36923571f0eee8bd7bf7aa1b844ba79c27e5f5928f7695e21850259ab40fab847443d6f9f45b6b0263fffa2fa016e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304511, "uuid": "dbb0da3c-30b2-438e-a8bb-586eba4eecb1", "value": "T19A25F1986B0AD406C951D3381FB2F7F8192C1EEAB901E2139FDDBEABB9B6D174D44041", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304511, "uuid": "8aeadb29-e51f-4d82-9c66-7de060048989", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304511, "uuid": "8abccdfe-9dfd-4f23-915a-cd689701203a", "value": "24576:cvW69C1y0XSH7kVdz73HKHaS9BAoHV71gklhDQ8savW:UQ1y0CkVBDHjQVO4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304511, "uuid": "d6d25169-8bca-456e-b026-2673a9c7f776", "value": 1031168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304511, "uuid": "4134229d-2a72-47e1-a179-85818ae4cc9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304511, "uuid": "66a5a24e-336d-4749-9bea-ea27353047bc", "value": "2a4d1110d2c4a719dfc35e7a6542885a442834df4b1a36a8264ac825c121f323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183dcf43-02bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770315519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315519, "uuid": "a5afee75-a22c-4764-aa85-8ae53ad07614", "comment": "Malware payload (Mirai)", "value": "a6fbe5a1e2e0878fe130f58165a168b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315519, "uuid": "192b8472-c410-4cbb-975e-77e3382918e5", "comment": "Malware payload (Mirai)", "value": "2a69a8ea97f711836cf398e5290c4a6b593721ee82ffa55a4316c48bfc38f7c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315519, "uuid": "54eb7edb-071f-4fb9-8909-2620c502500d", "comment": "Malware payload (Mirai)", "value": "ce942a7c310e9e2a3bc3d2418756e0fbb529100b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315519, "uuid": "7d40ae92-ae15-4844-970d-c3c88ff0a82d", "comment": "Malware payload (Mirai)", "value": "acb9072d24520bd5dc895ff9f893a49d5879ec77aaee6ce6d4b00bb3d234475e3c14c7025819b166dd38bfe42841ccda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315519, "uuid": "5bb56447-01dd-49e8-ae23-da3881c6d4c4", "value": "T106C423F52149628BD40B42FAAFBBC0A1B692B87DCD4B00E1EB49EE1D273C457111E71B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315519, "uuid": "b1854aa3-7a3d-4072-8d66-a90c7527a2b0", "value": "12288:5jeMqw+wLOCeVQPGlrScBDsSmSRPsfh/xeg9iGELvK+wK:5jQZ1tl+Ko1JxekiGELxwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770315519, "uuid": "d09f4391-c534-40b9-873a-4e37b28e1883", "value": 553160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770315519, "uuid": "fa009ab0-7eee-4c52-b2cd-d322a38a4d93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315519, "uuid": "022dbe16-ad9e-411e-92de-24596b3413ba", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716f7614-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306220, "uuid": "dafc5b28-a47b-4b10-8939-8e912bf4f4f8", "comment": "Malware payload", "value": "fb0248b3fe96d71d1326b4900a9705f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306220, "uuid": "dc9517a8-81b4-47c7-aecf-e56163c0f08f", "comment": "Malware payload", "value": "2a783ecdc442951253a2deb38bb9a9b213f4ca57fa1dd72b329c06f643a19e30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306220, "uuid": "08b58edf-17be-4e66-887b-96111845b66e", "comment": "Malware payload", "value": "3783c52940102ae994f2a0430e6187b7a63fbeee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306220, "uuid": "bc5818f5-9e28-49fa-80b0-85b7dd73f0a5", "comment": "Malware payload", "value": "d34142792829594aa669b9e1a4351e3a0f2a0a061f9d3784e6cca29db7a0b5d969aceb475de13a5e8ea6104a27628e2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306220, "uuid": "a429b93b-c3f6-4521-b3bf-fd7f7cd8a88d", "value": "T1B9E2F80353E5CC16D1965A342EAE8BED1573B91A7FD7ED0A32C137580822FA28E23357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306220, "uuid": "d98ab8b3-a05c-4c68-a5ab-f25c51f4afe3", "value": "87e75b8ffd4de41739f8a1b4c2d9f619", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306220, "uuid": "993a5c8c-b883-4169-9804-d44c9bc296d5", "value": "384:Pe/aOaOhwcyBorvh5SoPux8H4nrA/ae/0:PEBa0Blr55HErqxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306220, "uuid": "e613db72-33cd-47dc-8e6c-fcb67e06aacd", "value": 33485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306220, "uuid": "64541f42-8b78-4ff8-a831-07bf3d5c5cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306220, "uuid": "87862a84-534e-4a89-9d3a-4fbe6b215886", "value": "2a783ecdc442951253a2deb38bb9a9b213f4ca57fa1dd72b329c06f643a19e30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c223542b-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770305067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305067, "uuid": "41f44c8f-b4a6-45d3-8708-1e80ea14b4b8", "comment": "Malware payload (PhantomStealer)", "value": "8441a0b4afd263031a044ad899b688ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305067, "uuid": "e8cad254-7937-4cd6-94b0-4f7b1fbab189", "comment": "Malware payload (PhantomStealer)", "value": "2a86c8ae8cabbeb5909a0240fef9bd50fbf422f9d3d6a54c4a4e5c255dae3ddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305067, "uuid": "f1f6b8b5-e37a-45ed-9172-ca7931b85a1a", "comment": "Malware payload (PhantomStealer)", "value": "d4a51a5a540c2e0cb13ff3d06f21629efab0c8dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305067, "uuid": "5f04d8c8-beab-4aed-ae0f-5d9ed9771b93", "comment": "Malware payload (PhantomStealer)", "value": "8139292641505e8589bb622d42f003067f771806d6a3f590e936315719ec62cd34e747e95c13cd9ae5af48520f97ece6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305067, "uuid": "d2e156a6-ecb7-4db9-a4ae-d2369766563e", "value": "T1B6652398234DDA12D9D71BB00AB0D77127B5ADBEF810C3468FFE6CE73066B562944683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305067, "uuid": "f872c030-4499-45e8-b856-2e85378c91a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305067, "uuid": "88bb87c3-2eb1-4b86-9abb-111556ecdde6", "value": "24576:cYEzbwGTgc/g4WfX5yq3JCcNyuBAsKAoT3/QmLury3sPrSbFiFrx6BHsrQ:REXdkiWPdbyMARAoT/QS3ZbFmrxYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305067, "uuid": "e0dcfd4e-a1f4-4102-882f-f74109d5a91f", "value": 1459712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305067, "uuid": "e04698eb-a5e6-43d4-bfb7-ccaa20663d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305067, "uuid": "7ec60673-f042-48ca-99e4-260d31278fc0", "value": "2a86c8ae8cabbeb5909a0240fef9bd50fbf422f9d3d6a54c4a4e5c255dae3ddf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b69310-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770307468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307468, "uuid": "d3b9974d-24b4-44b8-a08a-a958163af363", "comment": "Malware payload (Formbook)", "value": "477fbcd22ae5049d7196b682aa1ab887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307468, "uuid": "180b7670-e19b-4146-9cf4-b503560db871", "comment": "Malware payload (Formbook)", "value": "2aacda1b316e079d3ba974dfa6c4a93fe6899ec6c26a17f8f6e881f032726a74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307468, "uuid": "ee333752-85f6-4cca-8c05-017db6693fb6", "comment": "Malware payload (Formbook)", "value": "94173695c52978c9350ae3054edbc312a2b4b7a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307468, "uuid": "528090bf-abcc-477a-8f87-7626dda280e6", "comment": "Malware payload (Formbook)", "value": "9c8c76ce46039311231d8f19475d5b4bae2b5d7a3096a8e256ebd27b14c2a665e20c49880a1ffb3f499b79907d4915aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307468, "uuid": "be538f4e-e362-4255-98be-7f4e898ad27d", "value": "T18235BF027391D062FFAB91334B56F6215BBC79260123A62F13981DB9FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307468, "uuid": "9283743e-e27c-42fa-bb4a-e04d6752bc3c", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307468, "uuid": "d1f76a5b-a83c-4818-8478-add5299004f8", "value": "24576:15EmXFtKaL4/oFe5T9yyXYfP1ijXdap8c+b61QLxgf:1PVt/LZeJbInQRap8cX1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307468, "uuid": "cfafb9c2-e6af-45b4-944c-4fbbda31d017", "value": 1163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307468, "uuid": "19f2968f-6bef-4203-8026-d2f14288f31c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307468, "uuid": "8b4142b7-c6d6-4ec4-95b3-e936342ff2ba", "value": "2aacda1b316e079d3ba974dfa6c4a93fe6899ec6c26a17f8f6e881f032726a74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a21722-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770306061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306061, "uuid": "20bb2ab6-1b06-468e-9d6d-daf0a3cc8497", "comment": "Malware payload (MassLogger)", "value": "da098f6572a365ded1e62afc5e9689a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306061, "uuid": "15635175-8bb7-4c4f-844a-15f42272962c", "comment": "Malware payload (MassLogger)", "value": "2ae5d7a2c53dae715a36f67b8cdf5b6f861acb5b79792a74d34a1bcba03fd2ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306061, "uuid": "ee1caa99-974b-47d5-9786-4095d14d855c", "comment": "Malware payload (MassLogger)", "value": "4c4c38c2770d1f07d2c94f93fab1fcd5eff0a85f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306061, "uuid": "887b148e-3854-4e82-9c11-4eaac693a8d4", "comment": "Malware payload (MassLogger)", "value": "68612979429b8bac31c2e1a2497cabd6ebc81dbf122dfb013669acf448af38f6ff32ab1177ab6d961e5a8fcae18429bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306061, "uuid": "dd6912bb-23d0-440f-9fd5-b3c21ab90743", "value": "T1C445BE0273C1C066FFAB91734B5AF6115BBC79260123A62F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306061, "uuid": "1f280287-f253-49e6-a6b5-cfc8cd037539", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306061, "uuid": "87a56282-a1fd-4374-8564-de6d0f012f5d", "value": "24576:z5EmXFtKaL4/oFe5T9yyXYfP1MAXDzkVJtS40gmCeV5aE+:zPVt/LZeJbInGizkVG4J2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306061, "uuid": "d28058df-1c07-4f47-ac21-dd3dd992a9be", "value": 1193472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306061, "uuid": "930df598-b502-4b1d-b541-a3bb70e8a1b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306061, "uuid": "fc20f6e2-be1c-48c0-80b8-8b7930e41d38", "value": "24f311baff086935d9e08a98a08b8d2d64d41ff1ef950a914f7205238bc5552a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a976ac2-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770306638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306638, "uuid": "e6f3bf1c-2b9a-469a-a9fb-d9bcafb9d39e", "comment": "Malware payload (SnakeKeylogger)", "value": "388dd4160e74f259e9136baada086beb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306638, "uuid": "f839e6d6-8483-4beb-985c-b5f4a2447999", "comment": "Malware payload (SnakeKeylogger)", "value": "2b0680d4092777daac7ce3e62f3e9230d44f602cf92b3b88d72c395701bf25bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306638, "uuid": "b70a43bd-73fe-47dd-b078-1a35ee2ddd8f", "comment": "Malware payload (SnakeKeylogger)", "value": "591867e1cce2fd0d2c4fdd41fd2a50db35385f9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306638, "uuid": "e7cf46c2-d69e-4ed9-b086-4a7b3f52c7bc", "comment": "Malware payload (SnakeKeylogger)", "value": "a36e71fbf243f80a6bb0c39e894f5f46d502b7354696285d7510ddb6f4fbd96fcf7ebb1539fe542cb1556a570dd49425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306638, "uuid": "207a754f-932e-4ed0-af0b-55379b032fb8", "value": "T15785AD05E3D911A8E567DB34CA619332DAB1781A4731E98F0A98D75A2F33ED09B3F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306638, "uuid": "cb0032a8-6ca6-4365-9806-56e389244cb8", "value": "b31fa30c377b7584dd6c4a686890d3e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306638, "uuid": "fc04ef5d-5ab6-4257-bcfe-094867c30404", "value": "24576:X4dmwbNq4En0CLQMbeaaCLyBtbpd9eqc0cLDrmCYS5cQy8PTgPPPSQUEzxxj5:X4dmwb8Cat30crma5caLMPPSmzxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306638, "uuid": "c0bc4702-5354-4385-bd6d-4fba433f03e7", "value": 1789440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306638, "uuid": "c11d0ec9-9089-47b0-9d14-d8acd708d15b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306638, "uuid": "2a7fd0f2-fa33-44b4-8ec3-e6528011684e", "value": "2b0680d4092777daac7ce3e62f3e9230d44f602cf92b3b88d72c395701bf25bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb6f8a5-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303559, "uuid": "bb6f1a8b-5385-4e79-8b63-e7b43ec9c512", "comment": "Malware payload (AgentTesla)", "value": "df22587a48f0bc024ce53b14520f100f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303559, "uuid": "2054a6f4-e3dd-4c86-a72f-f0dcd84de97e", "comment": "Malware payload (AgentTesla)", "value": "2b127e8a0a56d7b663d537120f468303622f6f7e42a4b0a655df3138354bb197", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303559, "uuid": "d6e4d471-dd91-4c1a-b794-2c03e5874311", "comment": "Malware payload (AgentTesla)", "value": "6d3216ed6c46a77b8d7c09321680cb6b62e58710", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303559, "uuid": "03977de7-8223-4107-aa27-ad37cf53a11d", "comment": "Malware payload (AgentTesla)", "value": "b72a1dd9d2442e5ab09daca3fd89d05f7da6adb9180b90c02e10fb0aa6d389ad45612a5abb553f75f43080b22c21262a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303559, "uuid": "3295b139-bb9a-4cd8-a04a-051218d437fa", "value": "T10C85E00273C1D062FFAB92734B9AF6115ABD79260123A51F13981DB9FE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303559, "uuid": "4fb7c89d-5571-4e96-bee3-98dc05a48e0c", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303559, "uuid": "e7bda3e2-2909-4669-899c-4c5604ad5b28", "value": "49152:7PVthLZeJbInQRasPEgdvHDmg27RnWGj:7dYbInQ+4fD527BWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303559, "uuid": "17f9884e-9527-4d7b-b367-356e4ea8fd9c", "value": 1810432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303559, "uuid": "479e894e-9813-4b84-9396-460fa208c6b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303559, "uuid": "973b0129-32aa-4091-9cfd-0f6a61f1536a", "value": "2b127e8a0a56d7b663d537120f468303622f6f7e42a4b0a655df3138354bb197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd195aa-023f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770260657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770260657, "uuid": "e630b257-8054-4077-94be-7adb7be5894a", "comment": "Malware payload (Mirai)", "value": "821091d66f594387d047906b8d0ca1be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770260657, "uuid": "7c996685-c9c6-4ddb-ba7d-6d9bfb0b9d94", "comment": "Malware payload (Mirai)", "value": "2b2d13399de197811964125323c6450ad9637e0de1e0bfa5a68757ea416483cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770260657, "uuid": "2fbe8185-7fff-4b59-9163-371f3b7b0b68", "comment": "Malware payload (Mirai)", "value": "c3fc869b7c12cae87559dc2fb7f45ef52507c31e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770260657, "uuid": "08a4bde8-f865-41cb-95c8-2b9a48407002", "comment": "Malware payload (Mirai)", "value": "5ab4826b355557fbb19fd9a067a90c345a4012936eab869744d64a1e3ed8cff2f69c7c98db69b7d2e94eafd530664812", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770260657, "uuid": "0b123f26-c54c-4f38-aafb-ba7455af67f0", "value": "T1A884096CF8809B79CBD0617AFAA502CD33375F68EBD9730589256B3437EBA25943B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770260657, "uuid": "d450d32c-c551-4a4b-bc59-2ea48707dc43", "value": "6144:IQOiWnwsHaiXrygUvKsNFH9tztoZ7FX8ZzG0hDWHYIzc/nXLnISu/9jdN5PzvWe7:MiUXb9FX8ZI2nI3FJejXiviwg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770260657, "uuid": "d561c383-768b-4787-95fe-9ebb966c3bf1", "value": 374652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770260657, "uuid": "9eb9c569-a934-48b0-85b0-114588cab01f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770260657, "uuid": "0b6ac629-843a-43e5-9044-336abce8378b", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5523e3f0-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770304884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304884, "uuid": "a95f50db-356d-4dbb-a761-28048640445f", "comment": "Malware payload (Formbook)", "value": "f839064af04bc8434313d49aa0f65dee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304884, "uuid": "bab81733-cc30-4c1a-898d-fa2ca98db2db", "comment": "Malware payload (Formbook)", "value": "2b42f648d1f3c2eea55de8351293b7e66b5c2d0ecbedd7d0ed86602aa55b9dd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304884, "uuid": "25c3c68e-0ece-4dec-b07e-598744c00cd5", "comment": "Malware payload (Formbook)", "value": "539ece77c2a86bbefad8c1cfb43255616a11c9ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304884, "uuid": "f99edea2-4843-4815-8dab-36d47ec9682c", "comment": "Malware payload (Formbook)", "value": "2b83d6d22156dc616597769531f7b80fc1f40a8e4dbfc6fb840aa38e4d559641348492c132819eb946485b98beeda2c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304884, "uuid": "b37621a9-8fda-4e11-90c3-09e54e1511a3", "value": "T1AF1501582798DB13E5B74BB40935E37517B9BE8AE915D24A8EEEACCB3430F01D900763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304884, "uuid": "5f09da61-0fa0-413b-ad9f-1b497ffb1b8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304884, "uuid": "9afd6316-27b2-47b9-8ea0-5b78598bda7d", "value": "12288:yFt/ng7BXT2U9UoQGFvxAmvmJYuKOrzSQFGuO1YWXCy6UlbBG7uC2H9y7hq:yTng7JAma33FGuJWjxbBpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304884, "uuid": "8bf505af-e250-4db9-bed2-98bc2e35c7ee", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304884, "uuid": "01a26a6b-9ac2-4f42-8e55-4a66f6042979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304884, "uuid": "45d13ed6-1fc1-498c-a362-e346ea4a9e1c", "value": "2b42f648d1f3c2eea55de8351293b7e66b5c2d0ecbedd7d0ed86602aa55b9dd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ef01b6-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304566, "uuid": "a69cd733-76d2-4f02-b7b4-e475491f28de", "comment": "Malware payload", "value": "6f296244b37a8f7aac6a77898a0ae98f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304566, "uuid": "9292e683-f21a-4928-b6af-f26213b65935", "comment": "Malware payload", "value": "2b56617d3c5ef04689fa8a022840966566f67b12916137055219fd0f9996babd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304566, "uuid": "b0f8c45e-08cd-48c5-96d9-960d23dcf0ce", "comment": "Malware payload", "value": "f0a229233091398247bf3d59b8e92cc75eca3358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304566, "uuid": "59c59019-aac0-4eb5-bf11-cba1d3768226", "comment": "Malware payload", "value": "51b3eb89f05d9c8c5fcf9612f619f1b59df03d95a414f977d3b491fdfa5d6556bd146aca99dfc674cb318df76c000cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304566, "uuid": "2e135655-bf59-4310-be1d-61c27c6de92f", "value": "T16A94E522E660B4A9F8A745B03D795256382D3D362680DD4BB789CF463771983B0F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304566, "uuid": "5b76de34-5548-4d26-81d0-0a19a8c97b1c", "value": "294a9ecc65ee72e0c08f8bc6e3aaa170", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304566, "uuid": "3ba50fa1-3b57-4434-adb9-d1791d09263d", "value": "6144:pUjZg+UK3hVHc/yEMzpDXKRobqCwt4BmUZYeC9hZ19QBYz4gwdGSKUgGGA3NuDPR:pyZg+xVm9RobqCwt4BmUmex5GAz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304566, "uuid": "e3a1b902-2bfd-4ff7-8fac-90fa2abaf1d5", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304566, "uuid": "df153275-8d50-49a3-b8ca-9b9e4de8bd0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304566, "uuid": "88ff3572-6682-4eb2-9ece-def45178e273", "value": "2b56617d3c5ef04689fa8a022840966566f67b12916137055219fd0f9996babd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9734b0-0257-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770271233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770271233, "uuid": "0cf1e4dc-33c6-4e11-be6d-11e727286bef", "comment": "Malware payload (Mirai)", "value": "0339d717bab2c69959a84085077fc125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770271233, "uuid": "33956dad-8112-4c2f-9e4b-4423927f1b49", "comment": "Malware payload (Mirai)", "value": "2be3a7fb90dacda414a03e2c3382d8cf2df1652cce1c5690456cee89993b2703", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770271233, "uuid": "27ce3d28-a079-4a8e-b412-269f031a416f", "comment": "Malware payload (Mirai)", "value": "05eac469ee9e63e578f8a78e3d19f5250d41b4d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770271233, "uuid": "20367d47-4b6d-4e41-9d81-5d8e9bb8ee53", "comment": "Malware payload (Mirai)", "value": "5bbbeaf04c06562c3ca4d207d64e5eb624428a99f759699447a6340e0b3635b5e2437fce3a3bd2d0ab34890aa51b4c21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770271233, "uuid": "e160e6d1-5bf6-4e37-8fc2-a691982b0217", "value": "T195B461BB7750BBAED368C13405F317E5D362139226A28245D07DCA2C1DB134C59EFEAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770271233, "uuid": "d367df28-6588-4037-9c54-f72caa70bc07", "value": "12288:2qE5TuJO70GuhB8I4TdfljQImul3aK4FMa3ygFj:2qE5TuIl0Ma3ygFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770271233, "uuid": "73e02430-aceb-4c84-8417-a562637eda51", "value": 530824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770271233, "uuid": "8be2ff8b-dccc-4e00-bc90-42cd9060a887", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770271233, "uuid": "858a6028-6c25-4db6-a4c7-777b71a839a8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5ae4cc-02c1-11f1-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1770316569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770316569, "uuid": "3b82bb65-a7ae-4e0f-9339-50f953754681", "comment": "Malware payload (GoProxy)", "value": "f85b8d5ef9ce26ee1b7b196a92c4894c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770316569, "uuid": "bc5b1f8e-77d8-4de4-ae41-90b4826be95b", "comment": "Malware payload (GoProxy)", "value": "2be3ee39ba0e434d92ee98b1241e823e8708fccc320666e1a711d55166e18d4a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770316569, "uuid": "c53bcf31-58a1-4f16-af1c-15ae3b9c34b8", "comment": "Malware payload (GoProxy)", "value": "bbab7b7aa1ffaf6fcb9a15d854cbaf0b979c7097", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770316569, "uuid": "6f5ff601-4992-4891-b9cf-92f773f49ae6", "comment": "Malware payload (GoProxy)", "value": "0879e16e42d1f45f77a0ad7ddafe5dbff66ef926d44224e5e5154f5a538e6bd4c2c22e7c56ca2b876bb3b2ea76fff9b7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770316569, "uuid": "8df4d8e9-21d0-4f93-a417-b4f1455274e9", "value": "T1FB665B43ECA155E5C0AAD2318A779262BB717C485F3123D32BA0F7242F76BD0AE79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770316569, "uuid": "f6305054-6316-470c-812b-a8b4ee1dcd2d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770316569, "uuid": "e2d61591-0664-4a1a-9fc4-81a594d8265b", "value": "49152:L28BZ0tvdztfSp8MMfSz80rftMvvFm3RetkaHEI3jGR7zyaWjQg9w5WBfKiK9KvT:LjsgWIbQvkhetk07S1ki0b+arGKEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770316569, "uuid": "de89c107-5f62-4f26-a860-aa445e99fa96", "value": 6725240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770316569, "uuid": "028d43bf-5f84-402d-8168-1cf3dcd4e9da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770316569, "uuid": "c938ddd8-81f8-4616-8c40-bab82f3c3df8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b4b192-0268-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770278424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278424, "uuid": "c4cd90be-e8fc-40ef-8140-4255c1343eec", "comment": "Malware payload (AgentTesla)", "value": "099195e17cd752c9ead446cc9048ef01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278424, "uuid": "e3979227-5298-4ad8-bd87-d49a72fa2476", "comment": "Malware payload (AgentTesla)", "value": "2c0bebb1d6320c8fed2da5fa23eef93a81804f294dee102df545a927abed167c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278424, "uuid": "c8e532b4-7363-491d-a7af-145a41263027", "comment": "Malware payload (AgentTesla)", "value": "276d868736101a70b9bbd4c7f815d276e5ea1854", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278424, "uuid": "16ab4db4-224f-4ed5-8095-34e99d141c00", "comment": "Malware payload (AgentTesla)", "value": "aa9d7d86c96f8e06257591f4bea7ebc10337127ce8c1470c2647fe8e75cfa24df4c9fdfd103dab756b8a042fe2ddcf00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770278424, "uuid": "6ffc4bad-db2f-43c5-b58e-6ca869cc8eb6", "value": "T1ED353314091CD1C078B852F6212A797C9C62CF5C178B262C4AF5CB7E5EDDAC13BE6AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770278424, "uuid": "05a8423b-68da-4c27-b54b-5f58dc14cf4e", "value": "12288:a2bqGE7NaOHoVo0bvVnKG2HewaNh5jQm1v8tWFUvp1k+dbpwuI9dLHH71Nt8xrae:pC4/2HewajdTlIO0p1k/bt8xraYjZJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770278424, "uuid": "1685603c-2d8b-408c-8720-a026e973b9a1", "value": 1095202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770278424, "uuid": "50c37986-e9aa-47f6-bea9-71dd9fe690b3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770278424, "uuid": "48189347-662b-433e-88b8-4a2afde755ce", "value": "nOFFER_14861-VGW0386814844_pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02aa639-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770308150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308150, "uuid": "55d7b116-984f-49ff-bc01-6c3f0a44c6b9", "comment": "Malware payload", "value": "38ee95bf38eed0c1df522da74db2967e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308150, "uuid": "0700c301-ab55-4fc5-924e-ad989a39a663", "comment": "Malware payload", "value": "2c0cbee6dfba9678e5ad61761bdab52f8c0c5e71eb2f865e5fd2d1733cc7ab5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308150, "uuid": "f7eb3879-fdea-4dd0-9802-237e16b6b5da", "comment": "Malware payload", "value": "d5c32159cd525f5f8880d3931f305fdb2eac4c4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308150, "uuid": "af0ee031-54ed-414d-8ae5-50961a1116b0", "comment": "Malware payload", "value": "88391069b6f79855f95bd5d88a5d2a17663c485b92c4af7052f6a61466739114856065cd6945c3ec222c5505d116d51c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308150, "uuid": "329673f1-2936-4549-84bf-139103dbdcda", "value": "T17594F512E75070A5F89349B12D78A256792D3C3A2681EC0BB78D9F5A3771A83B1F470F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308150, "uuid": "092bda05-897c-4f76-b182-1fc1e9d14f7d", "value": "0ca5e1bca7fb2e1018813759e8f980c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308150, "uuid": "71aedf05-779d-4b40-8a6f-8382432f8450", "value": "6144:7DRSM+1WV2D0vZkvT2B4MyACIjTohulX4zgyP/YyKm7N8orP3qpPIJCA:7J+1W3qT2B4MyACATohOofP/UQP3in", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308150, "uuid": "7747bf38-d446-4254-8d21-6ec7f20aa128", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308150, "uuid": "bfd7db71-d642-49e3-a42e-b7a279546025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308150, "uuid": "0b7b071c-6896-47dd-9e00-b6bcf9b9973b", "value": "2c0cbee6dfba9678e5ad61761bdab52f8c0c5e71eb2f865e5fd2d1733cc7ab5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5e01f8-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770305565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305565, "uuid": "bb916e9c-6120-457d-adc9-37ab1948dbd3", "comment": "Malware payload (PhantomStealer)", "value": "2e639f90564767c9c893ea292f92902b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305565, "uuid": "15ab6678-3d5f-4f5a-a7b1-fe6ccd55f67c", "comment": "Malware payload (PhantomStealer)", "value": "2c0d24afc7f2fcb8d989853439f68a763190e0f8e22460eee959378faab6757c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305565, "uuid": "e2c3297b-9ffe-45a2-95b1-e12a88864480", "comment": "Malware payload (PhantomStealer)", "value": "c17236534fa3fbfa7d76691ab0b335971157f5c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305565, "uuid": "a0c333a6-2e7a-4a55-88f3-7110059b3c96", "comment": "Malware payload (PhantomStealer)", "value": "f95d9f22f2e3792e72942e350f38dd0fa5cde5f1290eb9dec18805dd1f5a13adafd27bf7ef76a8d1892c0e8521e8bed3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305565, "uuid": "8afb2238-3998-42be-b2ed-9dbc67a1a417", "value": "T1C375F034EB3EEB02C161BA74C426D6F21724FEC99918C75ABFD4AE9F78315521726302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305565, "uuid": "2e58b2b4-1e8d-4f2a-9c52-dbc7019cebba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305565, "uuid": "00471a9e-f45e-4106-8fa0-e2cd77974efd", "value": "24576:0s40Ry/s8ZjXZ7tGxftrPuu0eYwq/AAAVIoqo2CY9Kt2KjCx3C7OrP1sW:f40RyR3GtjuuOwq/AzVIoSlk/jmrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305565, "uuid": "dfbd8618-dc43-494a-b18e-a99de029bd7b", "value": 1565184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305565, "uuid": "bdbdae34-9daa-4d30-8731-e97f0796fd6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305565, "uuid": "1885d038-a14d-42b7-9ff2-3cba8bfc62f0", "value": "2c0d24afc7f2fcb8d989853439f68a763190e0f8e22460eee959378faab6757c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17c4a7c-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305549, "uuid": "7c96ee3a-fc4c-4995-acdd-e0a82beb520c", "comment": "Malware payload (AgentTesla)", "value": "f5debc4ba74fbcba2033e804da1b5e94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305549, "uuid": "665c2c88-8338-400a-ace7-eedddaa850a0", "comment": "Malware payload (AgentTesla)", "value": "2c3e8cb0b8a5d5f24a825d0211132c1878433f8782b5dd59a27d34e5e6c26aa5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305549, "uuid": "e686c254-f04b-4edf-ac31-f0b4c54ca915", "comment": "Malware payload (AgentTesla)", "value": "ea8b910c97e2a7052a2713d73ad11e1fd63c1b6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305549, "uuid": "e5aa23d3-1e7a-472a-a8c7-de1e22e04431", "comment": "Malware payload (AgentTesla)", "value": "a7b8d2ab3c1cb5eb44f9fea031f88ea1043041244fa0948b5c9ed5b6e21f7e8a84fe13154cf2222bca958552dd814f9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305549, "uuid": "0b7ec565-2dc3-4227-81e0-22abbaf43664", "value": "T1C035AE0273D1D062FFAB92334B5AF6115BBC79260123A62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305549, "uuid": "73a85010-3847-4b4d-bd11-e4ad9a407d63", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305549, "uuid": "c46662ba-948c-4634-81cb-d4ed76361d04", "value": "24576:m5EmXFtKaL4/oFe5T9yyXYfP1MAXDzc1sx5ybXO:mPVt/LZeJbInGizcU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305549, "uuid": "40b128a7-678d-4f57-b6a3-3f694c1fc680", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305549, "uuid": "c6097529-234a-4435-bbdb-6b3bcc40e5c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305549, "uuid": "276df75c-9b9a-4977-b386-0297a92443b2", "value": "07fa3b53b7aaa614ed5e5858502e9aaa58662b16e62b60d77202a7de9ef761f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9152446-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770305024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305024, "uuid": "469a0bdd-c4ce-4ca7-8b13-364e583e79f3", "comment": "Malware payload (RemcosRAT)", "value": "345b9d865c94d37f9ad4a49f0d6d00ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305024, "uuid": "56b2b309-6d52-449a-9593-c5608c1ed1ad", "comment": "Malware payload (RemcosRAT)", "value": "2cb898129b7c5b150e304f06c25310018e4f7f48a0afe42d08530e37ad64534c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305024, "uuid": "91df198e-3c17-4c3a-a555-ff579d27025e", "comment": "Malware payload (RemcosRAT)", "value": "8038fdb585211189771a678c53663c195cc007ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305024, "uuid": "4d67216a-6a31-429d-a715-aa7d9980802c", "comment": "Malware payload (RemcosRAT)", "value": "b392dd6a34c5ed1707e21a751f86a66ebfc23258cd451318c392ffce9d9e8fba0fa4218a86bcda2cab2c204fb92edb4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305024, "uuid": "2c22912c-de21-4b16-9871-2d62c7f72a90", "value": "T1E4F401581BC9C742E9F61BB50AB5D3350BB4BE89E810D20A8FE96CEB3874F409D58753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305024, "uuid": "92270547-7873-4152-b3dc-652aa7763198", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305024, "uuid": "b0612dc6-74c9-4065-88c1-b8bc521fa0b0", "value": "12288:RuJ/1Hy5vwx0GdnOX2SzPcRArxii+ll31jOCYJuMX3IwG79y7hqblkR:cJ/1v4lzPgArxMjRLoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305024, "uuid": "96488bf0-d23c-40df-84a0-c99d06430d91", "value": 792584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305024, "uuid": "b9dccb58-aa72-44ba-b64b-ff69ae2f6e09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305024, "uuid": "a1a55a89-602d-47fe-a6fc-c862b67f7067", "value": "2cb898129b7c5b150e304f06c25310018e4f7f48a0afe42d08530e37ad64534c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79e59e7-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305156, "uuid": "ded985b0-f671-4ecd-9dd1-610c480e7c37", "comment": "Malware payload", "value": "a9b0e080f2b1439390ac85274719a6c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305156, "uuid": "3d0c05af-08dd-41ce-9be8-2451c1ba4244", "comment": "Malware payload", "value": "2ccdf17b4fe5ecf0f9adae900133f668b288a774d41b90fae888b9691207514a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305156, "uuid": "5e227b7e-24f0-4275-992c-51aedb337541", "comment": "Malware payload", "value": "77dba0bf09d5bfb05dcafae2d1362865a3651865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305156, "uuid": "9d5e9d30-e083-44e2-be29-f22df30bd53e", "comment": "Malware payload", "value": "4d5ce543ac1b8455ff114cea16c63cbf396f353625590aeb65e742fda50e21b95bd00ba08e13b891ab2b44fa1f653576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305156, "uuid": "99d5cf8e-91f9-41b7-b881-c56954fd91e9", "value": "T1C394D512E650B526F89349B02D79A266782D3C3A2A41DC0BF38D9F5A3671B8770F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305156, "uuid": "8c702072-269a-4dc4-82ce-3dc3dd62bbfc", "value": "7ca5ed196b1d6a05f7892d10de8016d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305156, "uuid": "39ba6010-e704-4f17-ba46-13ce959bee4c", "value": "12288:WZKQ47KAtNm7wm8RgeVRX+FcLUOV5z5USl1df:AFIgeVRuFlO4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305156, "uuid": "b05fb839-eaa4-4b7c-a014-dd0019843f74", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305156, "uuid": "dde7051d-0130-4ab8-ba32-f9f8eac58b12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305156, "uuid": "21aeeb16-815f-436a-a5f2-f0fc40f5d4d9", "value": "2ccdf17b4fe5ecf0f9adae900133f668b288a774d41b90fae888b9691207514a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa424a7-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770303640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303640, "uuid": "603f6bdc-315a-4277-a6c5-336ac4ee2aa8", "comment": "Malware payload (a310Logger)", "value": "858e37d600cf184447900576fff1ffe2", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303640, "uuid": "4d3a5810-a4af-418a-b214-aea64621d6d0", "comment": "Malware payload (a310Logger)", "value": "2ce9018f548ed77f1276d1acbf015acdabea81691188c3e308c325cce6275ed1", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303640, "uuid": "561b8301-7208-4700-a93b-9d056846638f", "comment": "Malware payload (a310Logger)", "value": "f76f5f94315461b058b9a4f58f28a6d749a1997a", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303640, "uuid": "a4afb95e-5d72-40b8-bc0c-bef2797c809d", "comment": "Malware payload (a310Logger)", "value": "3e5fcb2cc63f7d150360fcfee29d41ea4cac5b5d3ee47c8430788bce961bd690c88ed22e82d5e6ea6f54701f9c01302e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303640, "uuid": "29cf3a40-7efc-4431-9d22-d806c39106dd", "value": "T1EC845B13EA50A11EF1A3C9F1A9B4925668693D351AE8ECABB7415F5834301E3ECF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303640, "uuid": "dc5cc55a-6e79-4d07-a60f-da54f0d80052", "value": "4e88637d5094cca5de1556f3666ec73c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303640, "uuid": "933ad28a-ceba-4ae2-9cc8-4e6619e18a39", "value": "6144:j8d1/w5KA81IJ8GpF6nuTmOOUWTAiKD5W7mISVADsBE30hyfXuHqD4XthdN7Fh9G:IjYKkJj6GmZUWsiKRIo5hyGHQiJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303640, "uuid": "5395354a-7837-4818-9b44-ef976d6dcc69", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303640, "uuid": "1c2b9e49-5482-442b-a3d1-ddb812caa11b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303640, "uuid": "71f2d6f4-8d22-4196-b345-6a4a3fd3aecb", "value": "2ce9018f548ed77f1276d1acbf015acdabea81691188c3e308c325cce6275ed1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e059d509-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770306835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306835, "uuid": "a2866bc1-c04c-4f55-836c-bf3e6f14d1ec", "comment": "Malware payload (GCleaner)", "value": "f116c7bc33ac48b60e8b681ea3fef735", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306835, "uuid": "9ce70f33-242e-43f0-9780-41f8053a9946", "comment": "Malware payload (GCleaner)", "value": "2db4edf25192de2cce44c29404ba9e5162f1547c8ce2e0b4e23170158aaa3312", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306835, "uuid": "858ec119-dbbf-4cb5-bf0b-f312d1becfe4", "comment": "Malware payload (GCleaner)", "value": "a3a555b7d428957ca56f16c47830509236f063ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306835, "uuid": "912ef7b6-f9ee-48e8-ae2d-00978c720a9d", "comment": "Malware payload (GCleaner)", "value": "5230b8a578f97dd25870fb634f6ebdc6574424911e3438409ae00847dcc9efa9324b087390fa90aa0f0d654f4baffea3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306835, "uuid": "77303133-1c74-4bcc-a819-906548af558e", "value": "T1DD06D0E8B061F1E1CA7F3DB2ECB991968A39AF143B3DE4081664F5C54C322517C5AA4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306835, "uuid": "240c1ec5-8992-4e91-8f49-1d5b5fb8204b", "value": "dc88b81cedd2f2e7adc0511882c6745a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306835, "uuid": "ba873c52-d57d-4d98-b3f6-78b1bc5e9463", "value": "98304:RgTvNAziRFi6dXOIrmrHjuS5VeUtIuJH6TzeU4:RsV5bDlOIUyS5Vr18fep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306835, "uuid": "248e11af-ab03-4c50-aa9d-efc13f101ce0", "value": 3994112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306835, "uuid": "5e7e483a-b998-4eda-99fe-4dc53beb7573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306835, "uuid": "e5835520-974a-47c3-b762-30b8fb82cbf9", "value": "2db4edf25192de2cce44c29404ba9e5162f1547c8ce2e0b4e23170158aaa3312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc09bac-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770303368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303368, "uuid": "160d4d72-ef3f-434d-a828-77a8b3a4676e", "comment": "Malware payload", "value": "2ebd2389ea6ae3114b121378fa281eca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303368, "uuid": "762a03ff-e863-4f75-9a68-092093fdbc37", "comment": "Malware payload", "value": "2dd253e781e494e124b22c3b4422b181bdf3eddfdc76e68cd464fc38f59775e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303368, "uuid": "8ef107d8-6c75-49fc-866e-793d5e44abd3", "comment": "Malware payload", "value": "09036790dd956540ac61c572e48a58c194a18e66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303368, "uuid": "7e77bb9f-d275-4e98-ba5c-6b94c760fb67", "comment": "Malware payload", "value": "b55dc6753a21719ccd0e140a54293917c219272212bf2a44c64ff951891f117cff6ec244704d1f2be36b8a5debbeab77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303368, "uuid": "4264a9a4-896e-4c6d-a28f-c8b76267f635", "value": "T1C7F423D299C2ACE6C1316330C436CD4186763972AC73312E972DE97E6878383D997B5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303368, "uuid": "4e888dac-e0dc-42b8-b0c7-9f9bed56da26", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303368, "uuid": "5d2769ea-9b55-4d1e-8979-83bbda54c58c", "value": "12288:gz7hU5I5yuNHIgzSFKxWltRohBfSTso93U9CBsRzrPIFkoJyAmpD/SlOiMsO:gf+iN57Gtene3WDPG/molOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303368, "uuid": "3d7589fc-5af6-4672-8759-1577fc21eff1", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303368, "uuid": "dceacc0b-431d-47e3-9337-59e0a3b38def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303368, "uuid": "2454d1c9-af3a-475c-898c-a84531a6d0f1", "value": "2dd253e781e494e124b22c3b4422b181bdf3eddfdc76e68cd464fc38f59775e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9abd3043-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770307148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307148, "uuid": "7fd9ba46-ea19-4833-8246-17510724defa", "comment": "Malware payload (GuLoader)", "value": "4557a26dd51c27e8b74d89808daba658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307148, "uuid": "d7fcdb54-8d45-49d4-a371-36b5c400bbe8", "comment": "Malware payload (GuLoader)", "value": "2dd2f82bc17ed44113d07f5a64fe5a6b2a7caeb856a5619e6123962a9746f1fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307148, "uuid": "789f382a-27b2-49ed-96d6-9d62cbffe8b6", "comment": "Malware payload (GuLoader)", "value": "0857dc1c42e3ddaee6516731b062d26da6df051f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307148, "uuid": "09eae39b-f10c-4b54-88e3-a44f502dc900", "comment": "Malware payload (GuLoader)", "value": "23d8dc9cc3b94aa59fdbc718af2696fe8320cca63ec388c61173b8bb1b451d083955cebdb48e469f06aef88cb1bc212f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307148, "uuid": "f130ef37-f1a6-40c6-9757-b33218ffb558", "value": "T1D405F10F71A8C4AECAF92EB1F8265CF44A4D5C159D98404EB7C973CEA6F22F5531A10B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307148, "uuid": "616b84d4-e953-45dc-9279-2314f04974fe", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307148, "uuid": "a972be60-a20e-4358-8b82-c4cfeb58bf2a", "value": "12288:fqNbHfa6KFGpBQgYgoraBbKaO58TN9lhz2eHXK6d8/LE42MF6mmKya:ebHC6KgpK4owKaO5i9b2kqLE4OKya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307148, "uuid": "17d1f707-af1c-4d3d-a250-fa5064fb9eb8", "value": 809432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307148, "uuid": "962ef6cc-e8b1-4269-a434-fb214d3f7d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307148, "uuid": "a0d726c9-3980-4889-b75e-724c621400d7", "value": "2dd2f82bc17ed44113d07f5a64fe5a6b2a7caeb856a5619e6123962a9746f1fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b599c43-02e8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770333214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333214, "uuid": "8d913b2f-bce7-4d47-8c84-0b6341ed9122", "comment": "Malware payload (Mirai)", "value": "23e8186e6dfc657b8f739be5c071777e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333214, "uuid": "a4b12b11-57e1-475d-969e-3ed84462f196", "comment": "Malware payload (Mirai)", "value": "2dfacc5f24f7b5c5217ad1ccd74cc8b10c562ffe5346742bf3f228f32e4cba6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333214, "uuid": "38d7f5f8-470a-467c-b075-9f0762ebd9fc", "comment": "Malware payload (Mirai)", "value": "097a217ee674bcc5befb123803448a576dab45e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333214, "uuid": "df3cf8b7-cd41-477e-80d1-005a7a9da635", "comment": "Malware payload (Mirai)", "value": "b33204c024fa8d3eb818d70b5b5b40dc0b22a8bb0680139ed8771f08a06cc5ac64780640bf119684fb6b9ae178a77051", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333214, "uuid": "d1ef447a-69d9-4585-9852-fe4d99a2c43e", "value": "T1BCC2E1A5522CD472B0B45536FDBF01035B36CEF8C6AF323622144735E087D269AB5B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333214, "uuid": "6b1b31a4-c34f-41f5-a435-0c3d70b31869", "value": "384:KBH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plN40rhymdGr:byNUQUfhQllxlaH0MFjlOnGs3s3UozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770333214, "uuid": "44885891-3c18-4693-b7d5-0c9cd709d2da", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770333214, "uuid": "88d0d6cb-f385-4619-979c-35cba83b2677", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333214, "uuid": "a5c42728-1a81-4f4e-9118-6eed82f6cb96", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aecff83-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305350, "uuid": "10e92344-d92b-470f-a4bd-276b3b3ce566", "comment": "Malware payload (AgentTesla)", "value": "c5731872a3348df04b376acf7051ca4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305350, "uuid": "3cf8bec8-39b0-4e7d-bab1-d73e256f7aae", "comment": "Malware payload (AgentTesla)", "value": "2dfc42b3ca9fe8e2d335542170f6dd069ba1bd9021b32ea095229930a1e3e985", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305350, "uuid": "96b0778e-9218-4689-91c3-0d2b01135c11", "comment": "Malware payload (AgentTesla)", "value": "dc10ce57a5efe78fb8045aecddf525e295b2e430", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305350, "uuid": "bf4e3350-4102-4c21-9096-5cec8a14a0b7", "comment": "Malware payload (AgentTesla)", "value": "aa1dffebc7b88b7eab7da396082293b2f562966ab992f8a9a623fedc63d5cdb425857989e9afd752bd841ff60776ad33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305350, "uuid": "820274b3-584a-48b2-b4f0-ff4aec1d5e31", "value": "T195E412827374E897C57703708CAB962816B7EF5DA6ACA20F3251BA54BD736DB460F304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305350, "uuid": "823b80ab-4f43-4a42-8ab8-486060a2a0c0", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305350, "uuid": "42c26d35-9ab4-4a0d-b508-920f5e436d54", "value": "12288:FbXotf+a06JhAxEwC/6pvm011cagKvZsIt2BLCr9:FbX6264zUD3KvTtWL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305350, "uuid": "c367661d-c1fe-4d78-b0bd-0af2e1b6e412", "value": 712152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305350, "uuid": "7c105228-31e7-4389-9c27-4daa303293d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305350, "uuid": "587ac14d-c72a-4e50-8246-a3fa0785b0fd", "value": "2dfc42b3ca9fe8e2d335542170f6dd069ba1bd9021b32ea095229930a1e3e985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5c844e-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770303688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303688, "uuid": "aa2dfd1c-69d8-41dc-ac00-5d5aa9135b12", "comment": "Malware payload (Formbook)", "value": "c18455888da5f04914c2588dcdd316a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303688, "uuid": "cf7438ec-279b-4697-ae94-d9012ee2559d", "comment": "Malware payload (Formbook)", "value": "2e868a68ae398cf6c87be418e340777117054bc31c0bc1c819e5005f9e905274", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303688, "uuid": "4b586c14-fbf1-41a6-bae1-8b2016b9c5a4", "comment": "Malware payload (Formbook)", "value": "a551136d3a55ed8d06003d29b377bc7b331c3925", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303688, "uuid": "78215468-31a6-4e5f-961a-0e4deb98af52", "comment": "Malware payload (Formbook)", "value": "ef4034e0ad4eccc24881a9c478ca88a259c45279b0e37085fdf60b7831049f367869fa2c42b0b61825e42f9093de5d67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303688, "uuid": "1eb13ec3-92e1-4fec-aec1-5f8191abb0be", "value": "T1C6F4F11862ADDA02D0A29FF41972E2740B35BEDEEC20C2078FE67DDBB9767409954353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303688, "uuid": "ef8d9a0e-89b9-4e0e-94c8-97dc1f004d06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303688, "uuid": "f8e27ce7-8cf3-4f1d-939b-e45885db2fe9", "value": "12288:eh5mITnnZamApZgk2jOsToIJXdRr799voBqeYuDO4wdoM4cxtoDl5qxhwu:EjYmA0k0TrX3rbedCCMrx2DlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303688, "uuid": "305472d5-2f2e-4ff2-96e8-adc492a40b3f", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303688, "uuid": "91f7d5ef-84bd-4cbe-9898-d2e8c120f773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303688, "uuid": "0bce18a9-54e1-4c48-8b1b-722fe5d48941", "value": "2e868a68ae398cf6c87be418e340777117054bc31c0bc1c819e5005f9e905274", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f748de-028f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770295092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295092, "uuid": "bd040383-067d-4bd0-b598-8b9193c3d4da", "comment": "Malware payload (Mirai)", "value": "aa11154a63b97cd3cde4132abd642beb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295092, "uuid": "9b788e72-9fe1-4639-942f-e5d4873a26aa", "comment": "Malware payload (Mirai)", "value": "2fe1419ef3068e4e8dea2f276e9aa84450981f630277983e7922d03b9d60bb29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295092, "uuid": "931dcfa7-2bb2-41a5-ab0a-fe190f4ae36a", "comment": "Malware payload (Mirai)", "value": "d09a852486faf39eab6c22fbab2f77ef3a78350f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295092, "uuid": "d293624e-07e8-44a5-a345-3200e5bcd095", "comment": "Malware payload (Mirai)", "value": "91f29132f40ae139a4caf31e63a459356f28015bcbb53f152137491dbe0843728377bdb2243b4d8b328e7081ef95a1be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770295092, "uuid": "5b3e2801-6ce7-40a3-ac0e-abaca6304469", "value": "T1356312AA6639BC6FDFCCAB789A5012BAA088D3D1F3B3551060DFC54D571522FD10CB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770295092, "uuid": "2145c4ac-2d1d-4d82-9fcd-ae80efa6e71a", "value": "1536:YVUQ0TcrWCT3gcHB+cyepg1k/zJhw7nWAvnQGUgJViXZjbh5j+Ny:ip0T2WCbgc8bm/gCAv3JwpjbCNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770295092, "uuid": "6bd3bf6c-63ef-46d3-b657-91992e83a22a", "value": 70436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770295092, "uuid": "fd763aff-0e0c-42bb-b3ab-8fbd32a6975d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770295092, "uuid": "1a741687-847e-4e6a-8cce-7fd2bde7696d", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f32d3cb-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770306726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306726, "uuid": "935baf51-b010-455c-bc8b-64f9361b2929", "comment": "Malware payload (QuasarRAT)", "value": "77b4f914fa6e17e5de72c481bcf1a8bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306726, "uuid": "7f0dbc60-93be-4738-8e55-439c3550465a", "comment": "Malware payload (QuasarRAT)", "value": "30179b149a9733c86d55910cb00e4a5af54281083d693fe44b5b0e0d01513897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306726, "uuid": "ff2ff2e6-53b7-4aa4-8d5c-ea8c5cfd73d4", "comment": "Malware payload (QuasarRAT)", "value": "7649b89807431e06dab3bc6a451393313f917055", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306726, "uuid": "cb27d442-8610-4ab7-9f84-42f71a9cd31c", "comment": "Malware payload (QuasarRAT)", "value": "9306be0b19111178770602690d5e7715ee14dc1a4810d79afdb9a4de5573c6249899dffa1b39b5561e321fb9b77d1100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306726, "uuid": "11a3114e-1670-4f81-bdaf-df209d4413d0", "value": "T19F747B1377A8EA3BD1BE173AE43206145BF1D446BB16E38B5A6854BD6C123868D807F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306726, "uuid": "35e15bf1-41ce-463b-9671-dce099492959", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306726, "uuid": "2140e5f8-1f38-4f71-a14f-4b2003845aa6", "value": "6144:m7NHXf500M9IrtC1Btbie5WwzmFmg0D4zWYoe:Id50IrtYoe8wyFmh4Noe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306726, "uuid": "9563de51-9759-400f-931e-b28e14907bf6", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306726, "uuid": "9ede00ec-5a48-4f18-9f65-d4e64222087a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306726, "uuid": "24ddb1cb-3e2c-4953-8886-ee36ebb0d244", "value": "30179b149a9733c86d55910cb00e4a5af54281083d693fe44b5b0e0d01513897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1079b053-0263-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770275992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275992, "uuid": "2a53149f-44c6-451a-b1f2-f99cb03eff8f", "comment": "Malware payload (Vidar)", "value": "7610a777e23fac9a8679372ea0a61d6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275992, "uuid": "122229bd-7f1b-4527-97bf-b00325e936da", "comment": "Malware payload (Vidar)", "value": "306b7f1d3476b7bdd77dc3977cbbf246bb8e68c3480bcc6099717531041df580", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275992, "uuid": "d06408e5-473e-4106-874f-d3a0dd8ed227", "comment": "Malware payload (Vidar)", "value": "04d27b4ae9f2774e26dc2f67e526c82c817f7380", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275992, "uuid": "480532c8-562e-4f14-ba51-9bca19e02537", "comment": "Malware payload (Vidar)", "value": "cfbaeccebd123fd463be61c8e9b89839dd795b2f14bdf9e8828c658d7eb8a77fcb2b95530be25ad485aa65ecf7a803c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275992, "uuid": "b8926cbb-608d-495d-9580-0d0ff7ac2076", "value": "T16C14120852F52786DA5E07F4E0D0D8403683B97B7F9EF0043F984969BEA5BC6714E93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275992, "uuid": "8794a0f0-d2f1-4173-8b3c-7ca6716f7b7c", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275992, "uuid": "75fe3d6d-3a3d-4962-9526-57dd8ee461d7", "value": "6144:lAIcld2RUS9t2cFBtBOtOcRjpCpnFfH3IzateemAU:lncaztTlO/RjpUFfHYuk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770275992, "uuid": "ac3818e8-3185-428a-add4-b3bb7ce4a389", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770275992, "uuid": "613b4e2c-76ea-4262-b5ef-d598caf4aa56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275992, "uuid": "17845c9d-4aa0-4e51-bb49-a5ef1a51680e", "value": "7610a777e23fac9a8679372ea0a61d6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a74789-02c6-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770318486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770318486, "uuid": "461c25b6-10c3-4327-8272-a0bd909122d2", "comment": "Malware payload (Mirai)", "value": "a8e2952a1577c7ffc7b098fd787c23ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770318486, "uuid": "7d3f05a4-3cac-41a8-9158-1e73f8845ecd", "comment": "Malware payload (Mirai)", "value": "307808f7823b1b7dfa4770ad3d24d3778d9d6c73f5b6f1b73ac27bcfb2fdbfab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770318486, "uuid": "1347478b-d751-46d3-9056-1b64be4f6387", "comment": "Malware payload (Mirai)", "value": "43d0d7cfd5304d82a34d4217ec8b5ca3231f3905", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770318486, "uuid": "5aa80801-eaee-4da2-89fe-4aef7987f0b9", "comment": "Malware payload (Mirai)", "value": "1b69b7c107f73190f154331aec16bf10d26af88b5b597eb477a86ea95e832c7c31b9e45aa3e9055681cbd6142e7207aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770318486, "uuid": "84a17488-cdb9-4119-87aa-8abd49119add", "value": "T17E446B92B90E7D3FF2630E3FC1421A497A3DAF129903D826B05E655A1CFB1C24F6624D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770318486, "uuid": "c82976fd-cacd-4bb2-8863-b2c1b7e1890e", "value": "6144:sOU7L5vUWCWxrdSHxRUEv+IC/r4Myw8elPg:spZvNCWzcjY78elPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770318486, "uuid": "f5ec67a4-5b8e-4656-a0e5-5a844e0baea0", "value": 267972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770318486, "uuid": "af035352-949a-4fa1-b849-27b88e0ff64d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770318486, "uuid": "3e2045b4-0258-425c-acc0-d3062145b0c2", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da585e6-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304549, "uuid": "113c7be7-dd00-4bb0-8112-432181a47248", "comment": "Malware payload (AgentTesla)", "value": "e4e76730d5f40527977de4a8619b5824", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304549, "uuid": "de462b9c-7341-4c71-a124-9c4cab706076", "comment": "Malware payload (AgentTesla)", "value": "30c71c371124d8e9e8fa3a12758766caffe76b1e87a0d89121c34ea55c42d54b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304549, "uuid": "c3b76c85-841a-4e31-8c67-97028cc4f5e6", "comment": "Malware payload (AgentTesla)", "value": "1164baf1846cceffebec1756754db4cc07962ab4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304549, "uuid": "6eb5f51b-d8d6-49aa-af13-ee9e6cc5a2d2", "comment": "Malware payload (AgentTesla)", "value": "5325ab24afdd85f497e961aede6f1cf91ed0a128c2b053465b9d5ca2748ac6e4ab142fa7eab0edeae73cedb00aacaf59", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304549, "uuid": "12328343-45e7-4f9d-8892-dd0d86bede38", "value": "T16525F1482759D207C9549BB41BB1F2B41B6C7EEAB901E3065FE9BEEB78B6F024C44143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304549, "uuid": "2226c18a-00df-4b28-aee1-f12bfd04cd9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304549, "uuid": "353b1820-b656-4776-bf61-68f68cda345d", "value": "12288:ZpJ1dz9hfeDxy6HOszD0YP4+Dz9lkDezA86xjQI0eGrX+U6JAnTPVs7nHtIJBjql:nzNgUYP4+laZNxwvOU6JA6teF59CDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304549, "uuid": "8cae14b4-c2f7-4130-af76-d264befbb999", "value": 1037824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304549, "uuid": "3e433dcb-46be-4922-89e6-dd79698f2ae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304549, "uuid": "6cb8c333-a086-4f77-95ad-fccc9092d734", "value": "30c71c371124d8e9e8fa3a12758766caffe76b1e87a0d89121c34ea55c42d54b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4463f88-025f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770274576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274576, "uuid": "6d3d672b-53c4-4699-8f80-bb1447108b1b", "comment": "Malware payload", "value": "9242951247fee51112c9f18059baa385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274576, "uuid": "0c09b8b0-97e6-4bd9-9b79-1417f6e4442b", "comment": "Malware payload", "value": "3121147a7f6bfa6882cac34325fe2fe50c62e6548f1ea8b4ad859eecdf13d46e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274576, "uuid": "4d540a32-c14d-4b8c-aa6f-0e186c00c64d", "comment": "Malware payload", "value": "994b936f00b169157b331ad9a509ef30b5d62113", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274576, "uuid": "a14f393c-8cee-4f5a-adb2-46ae37482f0f", "comment": "Malware payload", "value": "9b8b6afc59c3d4fd5833f6308ded06b754e66a8745b7d03be98f07327ef5c55236f9b13630c4181b7ae299fe430edcfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770274576, "uuid": "3d11350a-df3c-4375-89a4-d7dd3d413f70", "value": "T12304135B8C3CE690E17450FA5227A74454D3CC60DEB9A30A0BC875C2EDE5D388A9EB7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770274576, "uuid": "33850651-c200-4547-9805-5ea392dfed97", "value": "3072:47OZ0eqYjjXonaUbH36NHFWp/BogPe0bsjPILXgrzr6gfJp:4JeqYjjXoagH36NlwWg24GPegf+GJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770274576, "uuid": "1a3539eb-d652-471b-8ba5-0f3599896ccf", "value": 185077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770274576, "uuid": "6028eb7c-1e4b-49b1-b826-f5f4fb409ce9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770274576, "uuid": "18f89c3e-54ea-4a00-a1d2-c75ca334dd63", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a5a24e-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770308032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308032, "uuid": "c2653ed9-9d73-4bea-9f63-6c2286316d37", "comment": "Malware payload (SnakeKeylogger)", "value": "c20043252d8d1dd7dd2242673597b526", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308032, "uuid": "3dc3ffe9-5440-4066-8a5e-2d5add4ff72a", "comment": "Malware payload (SnakeKeylogger)", "value": "3165a41037ce320d324496e1711be9a0af4fca6f86cbc5932bda3f7969ecb3cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308032, "uuid": "3954bc90-0796-4bfc-a03a-ea7bd373640e", "comment": "Malware payload (SnakeKeylogger)", "value": "05e6f96ae1b35858fbd2ed8fc972d82f29c12f8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308032, "uuid": "267fa0e6-dec4-4689-a371-637e3eb09cfe", "comment": "Malware payload (SnakeKeylogger)", "value": "bf4d77a21f80e29052e2668cae391a9fd256faf190a8d1f440513b5246aef3cadf6e702382fc46e3546d089cb7b7e93a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308032, "uuid": "9dc50594-720e-47d6-8b14-4bd0da7c7be8", "value": "T1F325125F3E86EA5ACE4E1B37E513114843F3D465E166F3E769CA0CE19FA9B00C90A913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308032, "uuid": "9c6043cd-90a1-439e-9b74-a1b611d23f06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308032, "uuid": "7df8a2c6-c7d4-4887-8673-b6a44c6b2390", "value": "12288:69qQFJZXUjrxGaJjMwWM1oGrF3VElpbgkoQX3D17+wdSWPdo1C4wqpS3Ev62NagM:GvZWrMaWIFFMb/ocxdoxwqOV2NG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308032, "uuid": "f4100f12-7c4c-49a6-94cb-029e8d13fca0", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308032, "uuid": "5182a290-9671-4479-bdd2-1eea07b8832d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308032, "uuid": "027ccc2d-fd02-46bf-9e90-bdc23a09ae78", "value": "3165a41037ce320d324496e1711be9a0af4fca6f86cbc5932bda3f7969ecb3cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d1d3da-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327198, "uuid": "296e6072-0390-467f-a85c-2ce57923af22", "comment": "Malware payload (Mirai)", "value": "f70c90f62ab46cbb1be049bab893f894", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327198, "uuid": "467a3f15-413e-427a-b3a8-6b8c18144989", "comment": "Malware payload (Mirai)", "value": "31d5f5491ec3d4f87532fc7e0e7deb2acd65905344c3d308b3842330a187223f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327198, "uuid": "0e3ed5e9-709e-491b-b6e4-61c924218b78", "comment": "Malware payload (Mirai)", "value": "fb16f07209479b12e0736a11e1ffab5ef2ffedaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327198, "uuid": "4cfbcfc4-8125-412e-8bbe-722ccc2a972f", "comment": "Malware payload (Mirai)", "value": "e4ac5f45ce90d72e2713f34770d9e671227209d56a8fdc525099dacee1aa3abb84e806f3a82b06e9d4be238a9b309da7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327198, "uuid": "45a4f5f5-6444-424f-a18c-a0ab61107f81", "value": "T12783199BF800DDBDF80FD6B74463490EB931E3910A931A377767BD53AC721A14826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327198, "uuid": "0ccd1fca-194f-4dc0-b8a9-0f3ba7b3fb26", "value": "1536:fQijxmw2V2xAsV8eZoPSdAYA9lJPc89s8br0hpsBq1HHbqFiQpsrH7IFn:fQi4gZsd9lJP4npeqp+psrbIFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327198, "uuid": "004ac957-bcab-4c67-bf1c-b13445af493b", "value": 84960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327198, "uuid": "e20fc1d3-38a2-427a-a9ea-c8a3b71e1ad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327198, "uuid": "1198b564-1379-4a21-a340-fdda9d3f6650", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af407c06-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770306753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306753, "uuid": "be14c2d8-0a77-4f84-ae40-e3504d588bd1", "comment": "Malware payload (AgentTesla)", "value": "0da0cead4dab8ba2258e7f53f8388130", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306753, "uuid": "82c6feaf-ade3-4995-9cd3-4fe91e3247a4", "comment": "Malware payload (AgentTesla)", "value": "31dca92bc5ec2f879df0ffaae3e1bdb9e047eb5ec3f6e902ef427bf67d579a20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306753, "uuid": "318e7951-6049-4595-8d32-1321226be84b", "comment": "Malware payload (AgentTesla)", "value": "46d90257b27957a491f3d3974c52cfa8cfd85342", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306753, "uuid": "46290c0e-b071-4607-9688-5f2c08e73586", "comment": "Malware payload (AgentTesla)", "value": "1ad88596f99a6d9d05bd21c64c020bf6693fb0f34d7fe85a07bca48857e2f433969304b91ae026afff6ae2fbf5a6fa62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306753, "uuid": "3b1738ba-b27c-4ace-a9d5-85eff0f0b9af", "value": "T18735E00813E88648F8BD9738913736114BF0B41AD97BEF9FA3C464BD18367A49697723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306753, "uuid": "b9ec9d7b-bf24-4ba5-9cb0-da3dac07f70b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306753, "uuid": "bea067a5-97b2-4999-b396-f86db7967725", "value": "24576:MlfMs1hsAdBen2pqp6k6Kr0QwmVxEUHiT7uj:MlfTfe23fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306753, "uuid": "1496e398-c984-4a4a-953e-fc291691629f", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306753, "uuid": "3f6ab1f3-74ac-47a5-820b-ed18201a48a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306753, "uuid": "9d3bf790-a0b6-468a-80e4-1e8e3fdce316", "value": "31dca92bc5ec2f879df0ffaae3e1bdb9e047eb5ec3f6e902ef427bf67d579a20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a498b872-026a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770279247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279247, "uuid": "62ab823a-6549-4dcb-be00-e37fb1ed478b", "comment": "Malware payload (Mirai)", "value": "5ecb44791c2cacfda3f17355c575285a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279247, "uuid": "d24a1ed1-f9d8-42e6-9db7-70c32ec4d4b2", "comment": "Malware payload (Mirai)", "value": "31fc714879a158c172fea60ba2c6a999a73442c88db697328a2fd5d1d00463fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279247, "uuid": "ea711870-02d3-4d77-95c7-7ef1cf66924b", "comment": "Malware payload (Mirai)", "value": "cfdce6a0ea23e09cd005d440c58411f7a9ba5fa8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279247, "uuid": "76f6200d-f032-4e09-ae04-138c437f3563", "comment": "Malware payload (Mirai)", "value": "09043f9e30ac3d8c66024be3b5e29071647f213f9275b50ceb351ac7f57e0434add69bba892e67b28a23eca4c336a421", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279247, "uuid": "9a5d9671-fddc-4695-a697-1f46d51eb4f2", "value": "T1E5B3E085B210AE55C02272FCB1870A90D3B16E7B4B9A150B44B3F5B46DBCCD47E1BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279247, "uuid": "dd39a1be-285a-43f1-9b86-c99c3063ef7a", "value": "3072:X5Apzl9NOvXoVLAE375lhYy5SkOXNwuc:aevXCLr59hmNwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770279247, "uuid": "3d7df9ab-3055-4630-968c-40dc1b8eb671", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770279247, "uuid": "e98e2355-a8b6-46c5-85d2-b7a3dde4c9cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279247, "uuid": "5669e2b0-f405-40a2-971e-b6918658576f", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1f87e7-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327204, "uuid": "8755359e-7e79-4fb2-84a7-88200a8a6398", "comment": "Malware payload (Mirai)", "value": "b1d88a21ce9cb7b7585db90369c4ae28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327204, "uuid": "1b888ef2-0baf-4fdb-9e11-0f3147799627", "comment": "Malware payload (Mirai)", "value": "323d18b220ed3d0cb620c23d6d073b397c4fd94ee4c542fd459ac907ae2e1d0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327204, "uuid": "f1eb23b4-ce16-4fcb-b28a-a52f9b4cee25", "comment": "Malware payload (Mirai)", "value": "783ac5f64bcead7b9b339a135f05edc3a0d820ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327204, "uuid": "2cbeb83b-f2ca-4a95-ad74-45f779b4b8cc", "comment": "Malware payload (Mirai)", "value": "ad13861b0040c90605330b1baad42bb04e56632bfaff3e82a724f6ad3dadb3c67406fd98b789ba8e075bb1df9004edd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327204, "uuid": "bd794519-d204-40ba-a57d-bf0afa73e102", "value": "T17EB3BE9BF7472091C8A287F407C74BDE3E6322119F67E9E76C1E2A7B15390DB1916382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327204, "uuid": "4119c1aa-5597-4e66-8154-a71f55e16ecc", "value": "1536:gAbwbABFn4Bg3FGrv4Ca4WqgjL0p1NaQ7CMiiTxZJC2AgP/LWV:TbwbMuSgv4CRtwYPGMitlgPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327204, "uuid": "a72460d9-2716-4c5e-a0c1-21c8983ac604", "value": 116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327204, "uuid": "99b36f9f-855e-42b9-99e5-526d0c8184a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327204, "uuid": "de096f69-2def-4cb5-94c5-41c5abb543d3", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1178ec6-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304608, "uuid": "dd79d17b-018f-4737-8291-494e5879b7e6", "comment": "Malware payload", "value": "005d9b386de6673fd944fac432b41aa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304608, "uuid": "9331bc8b-5f69-48c7-a39c-8fad286712ad", "comment": "Malware payload", "value": "32e8ca49cea8c16f8bcf3fe643a77d5c67f2ea02406c79755b0282405939f795", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304608, "uuid": "4692b82e-8d51-47a5-95c4-0306bf8526d5", "comment": "Malware payload", "value": "18c4cd53f79ed20b70fe62db8cd9facbc0e3ca9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304608, "uuid": "b114ce31-bc24-4e55-abb4-c115eb3760d3", "comment": "Malware payload", "value": "8e1f9ba47350f06caa6a6c177e3d9c99f58bfbb46613992553e3a5fd28bdf6aa742662029335ad74502b159f41422e83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304608, "uuid": "fee23916-64a4-4a55-bf72-6a5e1d59c3c7", "value": "T13994F716EA60B025F89345703E78A29674293D3A2A81DC0BB78DDF563771A93B1F131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304608, "uuid": "74de76a6-7459-444e-b6cd-6d5ae64fe12b", "value": "f424a386dd53a3b65f5d55778a16e992", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304608, "uuid": "fb2e3314-d17a-4b2a-b11f-4597ae2ddd38", "value": "6144:HHXrSk8N87NTpTBgRQxTOFIGYVL64s0qpvxTM1TEUaP0wHflgscQpTrCH37/:H3jY8AQxTOFIGYVptqRxTWOflvcQpTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304608, "uuid": "5aecd23e-7fe6-4dc6-a435-e4e8ce593c1d", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304608, "uuid": "1a35d6b1-4379-4479-97b7-eb8e1e30e22b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304608, "uuid": "cae34452-75c3-4fb2-99f8-713306df7479", "value": "32e8ca49cea8c16f8bcf3fe643a77d5c67f2ea02406c79755b0282405939f795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2fc64c-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770308090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308090, "uuid": "f0488628-89ec-44f4-8168-e248cc9090e4", "comment": "Malware payload (DarkTortilla)", "value": "5145d1359d8c1293c043467f05959b84", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308090, "uuid": "12b42704-47ed-4170-96a0-ca104a22e5d3", "comment": "Malware payload (DarkTortilla)", "value": "338891872f9cfe7a363ee207f5aee7eeb72c5bbf8c88d6732ae28dff34ddc953", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308090, "uuid": "bedd464d-a55e-4983-8f94-6a1835951c44", "comment": "Malware payload (DarkTortilla)", "value": "52dc272ed466e1b2453b2445360edf20d2764ab6", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308090, "uuid": "2b65754c-b334-4dcc-b640-4c6564d2d239", "comment": "Malware payload (DarkTortilla)", "value": "83e64b4b815fbf0e6d2c81fba79919840d1d6b9d5761142736e8cefd359ca85e954728cadae834ba4942efd15a78424e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308090, "uuid": "9a5f6cdb-db21-4beb-9747-b9a07464206d", "value": "T1E0E4D01613E84669F4BE97789074102187F4F497C636EB9FAD8E94F42E32B90DA46333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308090, "uuid": "819f1c53-243a-4099-8889-ca88c7f3f2ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308090, "uuid": "04e57002-0c00-4cda-8581-8a2fcc66a63e", "value": "12288:qvF2BXNjJjQazMA84SVJDypS1WcHgOhH6/pXHMNR3j6YdAyPGhF7NcO7:AFQiRHGAWq6/p3ojZPY7NJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308090, "uuid": "ab410e48-b52a-4482-9072-d81dce1ff5de", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308090, "uuid": "66276146-e776-416d-bb72-38f3b6d82bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308090, "uuid": "5cbf7851-b4e9-4556-82fa-a2ce4ef09560", "value": "338891872f9cfe7a363ee207f5aee7eeb72c5bbf8c88d6732ae28dff34ddc953", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e37f0e-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305739, "uuid": "00f9a20b-7115-485f-b020-150737f7b625", "comment": "Malware payload", "value": "b9c9bf84056a3588382c6cb67f7019a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305739, "uuid": "c3570aa0-416d-4d58-a33e-b76fd36cc401", "comment": "Malware payload", "value": "340653db6e9300e15516b33fa0bf13c4065b57b60b93f0ac795f8743efdf4b29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305739, "uuid": "1c369f09-2cde-4abe-9bce-c27a7dd74c98", "comment": "Malware payload", "value": "5dc5e90847e01231b78cf0db13286994b95c90b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305739, "uuid": "75c584f2-11da-460c-a0eb-63e010d690d0", "comment": "Malware payload", "value": "3deaaaa341c5acf7bd4ba2ab11b1b07af8d6771d178e339c6458fd7bde430d2ffdd46084bbfb69a2ee8be4e3cb3c6a53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305739, "uuid": "d79b3418-d9d0-4f8c-9ad4-e1b1d5adbe51", "value": "T1C8940726EA60B4A5F89345B03D78A256792C3D3A2641EC0BB78D9F4A377198370F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305739, "uuid": "36503194-d142-4df9-a3e6-2231fd5b5f5e", "value": "e5055d770bf6dee205f9eda4d267ff2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305739, "uuid": "34091a0c-7b5c-4f15-a5fa-65d2005f2c86", "value": "12288:m/IsOCWcKU4ht7XRuFFCRi0xh95vZ/8OgWIhP:/cWcKXRi0xf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305739, "uuid": "6f5e980d-661f-4cda-8a53-25288ec1227e", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305739, "uuid": "0e0d2ceb-4dfa-469e-8927-50c7e79b045e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305739, "uuid": "487cb25d-0003-45c5-80a4-1af3fe3b64a0", "value": "340653db6e9300e15516b33fa0bf13c4065b57b60b93f0ac795f8743efdf4b29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f277e1e-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304417, "uuid": "79dfa233-d481-4882-9d10-dd9de6ad22ba", "comment": "Malware payload", "value": "73a50d4195d8b7b3d83591e0ce35afed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304417, "uuid": "f44a8fc4-d30f-499e-a287-25f1d98ea5d5", "comment": "Malware payload", "value": "3443d3070ffe41368ab0ee080260f9007e584ecab5d3155b0b6309db14dffb96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304417, "uuid": "c25b7e3b-2866-477c-8488-62dc64e2adc2", "comment": "Malware payload", "value": "60e9f8f846c0d0f7c16de469bf4b024558d95824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304417, "uuid": "fe09cb6b-b2d6-4e42-a8fb-253c65cfd46d", "comment": "Malware payload", "value": "27ed0775b55936ed7ddbc6df94e2e9a388f0142be0f1fa0125b711e6d86bc730d6c9a2ade452346272add8d50dc7075e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304417, "uuid": "a6e11147-cd57-43aa-9a4d-019a37a34d9f", "value": "T1A5E423516792C81BFB9309B1CEEB06F96371AD12E560834F9B453F5AF8782806D28773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304417, "uuid": "6aae1ad4-5e15-4c97-b6c2-280e6d677865", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304417, "uuid": "2251031e-8290-4348-a000-9d65eb0ac88b", "value": "12288:ekhhvJGrpYYZWU/ynhcATYVKa/W32GbvPsaXhEsnnllVc9:eghUrpYYZWU/ynhcOY3RGb3vhEmnDV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304417, "uuid": "32b7facc-fe00-4467-895b-323d781d40c3", "value": 691336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304417, "uuid": "5ddb156e-9df7-4fc4-9bf9-ccdd7313e1bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304417, "uuid": "373b35a0-21b5-48db-8796-05b44b084098", "value": "3443d3070ffe41368ab0ee080260f9007e584ecab5d3155b0b6309db14dffb96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5bd8ba-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1770307932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307932, "uuid": "6b92aeeb-ae8c-4b41-b39b-67a266fa4432", "comment": "Malware payload (Adware.Neoreklami)", "value": "5cf49e791ee6554f644aebf756c4042b", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307932, "uuid": "1f403eb3-c1fa-40d6-aac7-92dc1f8b41c6", "comment": "Malware payload (Adware.Neoreklami)", "value": "347550efc0914676e59f4ce627f07d885d2f94de9493f34633299579a31c1774", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307932, "uuid": "61a532c5-37ba-4312-8302-fd8526fd72ea", "comment": "Malware payload (Adware.Neoreklami)", "value": "6cffd45d896d008b30ac61540622457284a128b5", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307932, "uuid": "638cd649-92c0-4d40-b701-4bd68b260cc2", "comment": "Malware payload (Adware.Neoreklami)", "value": "c3c33445912edc6488e91b0203a1733f4d23a7f62dd284d42faa41983ed41c0f6f9b492a6f47a32427901e29d21b2607", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307932, "uuid": "8d374a68-8fff-41c0-ad39-b550060cfc18", "value": "T12976331939E7C1B6FAC62433C5012F68F1F9B0510BB5C11363FC9A1E1EBEA10D65AA66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307932, "uuid": "571822ca-c892-4060-8e08-6e39ed5745d0", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307932, "uuid": "b1f30e49-a9e3-4968-84a2-5ed816b57db6", "value": "196608:P1OG5Kg5I26xqAtHLbm+oe+jO7XeuuOHY2fo:tOG0+I2kqAtHLq+f+i7XeuRH/fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307932, "uuid": "87488ac9-c758-4e9d-9a40-215bb54de60a", "value": 7496367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307932, "uuid": "c5eed4cb-c3ab-445b-807c-60a8913d1727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307932, "uuid": "1b867575-12ea-4fe1-9d0a-0ef9b6d1d58a", "value": "347550efc0914676e59f4ce627f07d885d2f94de9493f34633299579a31c1774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476bf519-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770303572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303572, "uuid": "2ca05b41-778b-43d2-a083-be21bbff1a97", "comment": "Malware payload", "value": "4c6e5997e961444d6a1ac318ad499959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303572, "uuid": "b91ae73a-9f2f-4d77-94ce-94b49fe84cc3", "comment": "Malware payload", "value": "3496f93b4ab5abb4db3d8150e58033fe7c3e8eab73e85ef88f4c131f13c1bb1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303572, "uuid": "9c7758b1-9773-4143-aeaf-5089566b3470", "comment": "Malware payload", "value": "a82850fbd74488102b29383b8002f0e2d416d9fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303572, "uuid": "103b7fc0-f29d-453c-be6d-4bf9e802addf", "comment": "Malware payload", "value": "49bbff2a6158e4fb48540120b7f80f0afc54d242392fbea16976f23515a906df2f9e887de9754e6ea91b57bbd7c60f30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303572, "uuid": "6e8ec719-8e73-46d6-8aeb-f684d9d09299", "value": "T139C4C010BDC08432CA723C310774D6B14D6DA9302D649E9F53981A75AF74B92EA3AB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303572, "uuid": "e35184b8-c399-45fb-8a8a-4e65b176f3e0", "value": "5cd457c58b1572e4fc9b2b3c7e5b3770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303572, "uuid": "584e5c2a-87fa-449a-bded-5f8e073fbc53", "value": "12288:3UbTE1rkt826L4xd1EiEt6empQ+uK+ERgrQKIKUpHf7gprGj1enw:3U818EiYTmprRgZxUpHziq5ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303572, "uuid": "141d3c9e-1d52-49b3-81d0-3b9b74055473", "value": 567054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303572, "uuid": "b6b7ab62-635a-40b7-9fb8-0f0c9570e298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303572, "uuid": "871eb0d6-f59e-41df-93cb-4167a189d02d", "value": "3496f93b4ab5abb4db3d8150e58033fe7c3e8eab73e85ef88f4c131f13c1bb1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1e55a4-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304015, "uuid": "8654dc31-d7e2-484a-a808-76ea5daa943b", "comment": "Malware payload (AgentTesla)", "value": "5ecddde25916d0f9cf4fc0ab3e6fbc42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304015, "uuid": "3c85b441-b8e7-4535-b7ea-4591da4f0d61", "comment": "Malware payload (AgentTesla)", "value": "349b61d701a6e950a1a43bbef90b398f2a078a64a008f9dfcd431b1ead6127b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304015, "uuid": "0000cdd2-4735-4289-aed6-2dc7081e419f", "comment": "Malware payload (AgentTesla)", "value": "2cf8b6b51213837b35b8f3e07d4d915f5e1eecf8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304015, "uuid": "0d756a95-6ba2-450e-bb93-f6aaebe01cb8", "comment": "Malware payload (AgentTesla)", "value": "11483a0ca36ce1dc20f6d09b069f829d8712b5c935b30a49b1c4f79f1dfcb52ad170cdeab94c9b3235dfe372089e50d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304015, "uuid": "4836300f-d1a5-4ab3-9125-8132f39e9a48", "value": "T11B450108235ACE03C5A51BFA1931E270577E6DDDB861E3938FEEBCEB74A67405844386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304015, "uuid": "9cf2831b-948d-48e2-860d-a4f5c9da864f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304015, "uuid": "17c38ef4-5070-48e1-b56b-99c3344f6948", "value": "24576:SUdyHuTQc6hqc1AVL/XnKxpMMPYxJr6yyTs:SUoHy6hN1ARXnK0MPOr6yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304015, "uuid": "c9a6b529-5d82-452c-86d6-7eb9da60cd82", "value": 1201152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304015, "uuid": "c74a4a53-3610-4cf0-95bd-2c3f6eaca4ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304015, "uuid": "e3c13446-4868-4bd1-9195-5d83ce01d889", "value": "349b61d701a6e950a1a43bbef90b398f2a078a64a008f9dfcd431b1ead6127b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627aa367-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770306624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306624, "uuid": "34c6d619-b8a3-4e34-bf29-690e2659b4f9", "comment": "Malware payload (GCleaner)", "value": "982758f39d35f08f463c7c61d913c643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306624, "uuid": "738d49a3-cb41-48c8-9f2d-78eb0b349045", "comment": "Malware payload (GCleaner)", "value": "34bbb9ff059b51bad47892578c04dfaa175594a05eb62661299e8aadeba2ecf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306624, "uuid": "7f44b5ff-0095-48d7-83a3-01eb7ca576c4", "comment": "Malware payload (GCleaner)", "value": "265294f8049812f39bed50cc620c314500c158db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306624, "uuid": "6e877539-9233-419f-9fc7-2ded01703a3b", "comment": "Malware payload (GCleaner)", "value": "49c8ec1918f3ad0d5735d87af4a7b4d3198f0ed1b0f659c8dc778f0c6598b408f8cdc755602ffaac58a78ab9a253e66a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306624, "uuid": "a45e1434-bdc5-4704-b98a-caefca0e572f", "value": "T1AD46F117B568447CECAAA8F508C74B68C58F77483820CF8D76F0D8F49F60E9A7079699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306624, "uuid": "67641832-f228-405a-a559-5628964a36d5", "value": "fbd9744ea458801c15794b746fb79ba9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306624, "uuid": "b7ebec07-0538-492b-b7d6-c0a7cd2d4276", "value": "98304:7VQrND/vvRJEJe6WrAX0skFAiR9vUhQtO+w2tJfCa:76r9/vdxrAEBFAikSQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306624, "uuid": "d0550b05-1a59-49d2-ae42-b0d4266c5de7", "value": 5698560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306624, "uuid": "71dcd517-0bf8-46d8-bcff-aabe4990e4a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306624, "uuid": "b2525267-db55-44cf-8c1b-fe2ecee128b1", "value": "34bbb9ff059b51bad47892578c04dfaa175594a05eb62661299e8aadeba2ecf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41d48e4-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770303432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303432, "uuid": "ed7c673a-57dd-409d-93c1-59cf3434c91b", "comment": "Malware payload", "value": "1ed3d26d26830fdc1ffd45f2cfa32ec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303432, "uuid": "12c7f71a-981f-4be9-904c-39519f6ad04c", "comment": "Malware payload", "value": "35332fdb6acd60d4fe92ff70a88d4996ef003f34337a72bd4f3b8397f485e373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303432, "uuid": "7dc1f348-c857-4276-a938-ea335718e824", "comment": "Malware payload", "value": "23eeeaef48871837062f91f130534a224a435f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303432, "uuid": "c07b9d44-e383-4768-82f8-ca08f3bf0354", "comment": "Malware payload", "value": "997755b2ed16e62dfa2d5787afee56d6ebdd35bcb92c821a5de980ae5a7caf403b7538e301b9b9ab3cd4c559c95edbf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303432, "uuid": "0e886ac4-fe3f-4a2b-9923-c9a725f4abea", "value": "T19435D04123FC6B64F8FE8B38C935091A93F9F806C626DB1DAE5C90E91D25F419A91733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303432, "uuid": "da7ac1f1-212d-4187-a88e-69f31623cb83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303432, "uuid": "80ef13a7-632c-432c-be5b-22a2fc2b1e26", "value": "24576:gbVuI39NG3RdAemHiXYHsjF3leIqNHJzxE4Z7:gb0I39NG3RZ6icCcISpq4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303432, "uuid": "2ad32d34-f969-4dd1-bbd6-cb2433a0d5cb", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303432, "uuid": "41893f58-1acc-42b6-acaf-b678fc50c2aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303432, "uuid": "fa4aace3-cafb-4a2f-8e8e-7f787ea65496", "value": "35332fdb6acd60d4fe92ff70a88d4996ef003f34337a72bd4f3b8397f485e373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b079b0-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (IRCbot)", "timestamp": 1770307597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307597, "uuid": "c6ef6d4a-faeb-46a9-adb7-c852fadefc40", "comment": "Malware payload (IRCbot)", "value": "06646c954d87920722fa0aac863e9f49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307597, "uuid": "e1e59064-7192-4fdc-9953-d05d7d37cc98", "comment": "Malware payload (IRCbot)", "value": "356da71dd933d54cb7b3135886324a6738d3149b455dcbb6f0e10f8faa0b5598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307597, "uuid": "77cf9b86-6344-45b8-9d1b-c878ae320f52", "comment": "Malware payload (IRCbot)", "value": "ff2811e6590de12de084f559c3f1ea046af36bde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307597, "uuid": "e0e4f162-7e8d-4d34-aba4-ac2b50c21950", "comment": "Malware payload (IRCbot)", "value": "21c3be8207ff1261526b6c5645d1a2f3929603afa0208df531d25cc363e6f42d9345c7b7dd2bbc3a64263279baad7e01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307597, "uuid": "178f5cdd-7ba1-4e2a-8890-cf5e633384b5", "value": "T1C6E46D53B692DC36EC92037441A24373566AF9A09E53D74BB2C0A62B1DF3DC1B92C71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307597, "uuid": "aa0ace77-3882-48a7-9dcc-422a0b5001e0", "value": "a326283e2c773761aba7f4ba722820d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307597, "uuid": "d46d9514-7f3a-4f14-9b5f-907189e9522c", "value": "12288:yPast+KqH7zak7K0IXMBR6yrD7VORbCV/hWn:QasXi7zakIsR6yroRCV/hWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307597, "uuid": "3c3472e9-a912-4b20-b031-7b7709db9f3d", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307597, "uuid": "8f2b69e7-5d8d-4e9e-8cd9-2e6f1d7bd26b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307597, "uuid": "d0dc3b6a-30a6-4993-aef0-c87001844fc2", "value": "356da71dd933d54cb7b3135886324a6738d3149b455dcbb6f0e10f8faa0b5598", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8121b663-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770303239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303239, "uuid": "bc5a7100-1c50-4d9f-aa83-4d9057c91ece", "comment": "Malware payload (GCleaner)", "value": "ff881ea8ca1692074e6777cca8ae85b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303239, "uuid": "7992819d-2486-4906-8e45-aed4c12a5fe0", "comment": "Malware payload (GCleaner)", "value": "3626ce45816c1bd3a12c22eee92f0861adb8f05ff1d10ec046cc1f32b24f4b0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303239, "uuid": "b78b426d-25c4-4935-a90a-2540f4ea5da2", "comment": "Malware payload (GCleaner)", "value": "73f679595ad39ce1762a8f212cb0bc5399d64b3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303239, "uuid": "2e19834b-ecda-4359-9f4c-fc5b43e65617", "comment": "Malware payload (GCleaner)", "value": "d3f4d2440d8ae883984c04d89b800940ae7015911fc40b915298d483f89492a45ee54a5c53a38458fba50e4cccd8a8f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303239, "uuid": "8d0e22c6-8a65-43c7-8aed-76130513e730", "value": "T19C16D059F704896BC85D31F7DAC3658C41A0648A7E3FA99A2FCD7DCC3C16328E467A84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303239, "uuid": "18b40402-faad-40b3-8ac0-71a648cc40a9", "value": "47a71adfa27f235be83d38d946a32453", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303239, "uuid": "8c747074-586d-44ee-af6b-8ab7dc99e218", "value": "49152:u65IAzCwyKabFg63Th1qjLWaekiw/DU92NvJYvJ2uMSJ4+xZ:u6hCw7ilMjL3OnvJ2uMx+xZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303239, "uuid": "2c383221-9865-4839-8b5e-0310506c15e2", "value": 4175632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303239, "uuid": "5ae800f5-a8a9-4bcb-a2cf-95f2d7c8eb12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303239, "uuid": "2a227a47-5df7-4e96-94cf-9b2017874854", "value": "3626ce45816c1bd3a12c22eee92f0861adb8f05ff1d10ec046cc1f32b24f4b0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4be4d58-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770306333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306333, "uuid": "99e4dfdb-e855-4315-9863-b48cc6c130b8", "comment": "Malware payload (Formbook)", "value": "ef1fc766358e4d3fc916bff74d5881b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306333, "uuid": "7ac33e4c-edad-4f24-a89c-eb2ab5ed3829", "comment": "Malware payload (Formbook)", "value": "3670524ce92f486f2f2f90a5f78f871c0bf1484e8c59cb8eb473b9ed516aa535", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306333, "uuid": "3bd96cfa-bf5d-4270-a5c5-aa3266fa83f9", "comment": "Malware payload (Formbook)", "value": "129b443d075aa6f775fb2d4fa7482ecd8d7f0c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306333, "uuid": "45cbc8ae-ef27-4aa4-9a36-cfa9751c4c5b", "comment": "Malware payload (Formbook)", "value": "79b92c0ea8f2adba3c1a334bd5c5894215896321887391133e283504b5004a045eff4ece2c69bbbc90643fd881115c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306333, "uuid": "9101c19e-575f-4085-8509-250dc03a477a", "value": "T1B745CF0273C1C062FFAB92734F5AF65157BC6A260123A61F13A81DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306333, "uuid": "22890176-95da-4eef-b9a6-27f442ad9e96", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306333, "uuid": "abe0a0df-3364-466d-8ae7-c9293f19723d", "value": "24576:aqDEvCTbMWu7rQYlBQcBiT6rprG8athqmrghPH3jkI8S5mQi2:aTvC/MTQYxsWR7atheoBQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306333, "uuid": "28d381d3-b6a8-4424-a00f-041ec43db537", "value": 1214464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306333, "uuid": "b6040db3-591a-4da5-819e-3ecd34ce6b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306333, "uuid": "c793d7c8-ecad-472d-b515-ebcfa96c000e", "value": "3670524ce92f486f2f2f90a5f78f871c0bf1484e8c59cb8eb473b9ed516aa535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29dc0ebb-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770306529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306529, "uuid": "943a8869-d1ff-441a-a7e2-fa6bfcbbdf2b", "comment": "Malware payload (GCleaner)", "value": "10ac2c31740195a1e7758da538df58d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306529, "uuid": "3c0ad265-dbb8-4ce7-be97-0c887207622e", "comment": "Malware payload (GCleaner)", "value": "36787083ee02a3d08d561a227367ad9617ba22c80928030101afefd100d5358d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306529, "uuid": "36cb5ee5-e05a-4296-ab50-e1704dc40aa2", "comment": "Malware payload (GCleaner)", "value": "884ad29281b6b227d3c84efd128bc3d2e058b8d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306529, "uuid": "fcfbff38-43f8-4d24-ab4a-5df4f07c6c3e", "comment": "Malware payload (GCleaner)", "value": "74406ac7fa234563f03e30b3bfe4c2ea8d4add89474a08ba56c0e2023670c2d8df3b80da4593e16cd62da4d70ce71060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306529, "uuid": "205d6006-0bf6-41a2-a832-0bb608c49e25", "value": "T1FB26E101949444A2FB5120783BE7CF6814FCA5D2D8BABC063ABD39CC06BFE5931B595E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306529, "uuid": "db26a44c-2f53-45e5-8e8b-2ec0f67be424", "value": "90d3d45c4128e324bab07310ba2c236a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306529, "uuid": "4b4ce319-383f-43c4-a91a-7707e5e53525", "value": "98304:gdW01Bj4vAWFZcgxg7A/uVuQ5GzUrRNyEsmxe:gdiFZc9AmuOpXdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306529, "uuid": "304cff67-05c3-4f96-b680-6395aea8a825", "value": 4435968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306529, "uuid": "1fc6753c-0a51-4c53-972d-190b128cd537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306529, "uuid": "b5eefc79-d3c6-4466-9f5b-9aac6be2c32d", "value": "36787083ee02a3d08d561a227367ad9617ba22c80928030101afefd100d5358d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b30a43-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770303646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303646, "uuid": "1015efac-a385-4920-993b-46b5bbf61967", "comment": "Malware payload (a310Logger)", "value": "ce49218c6b70c939b5abb14a874675e2", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303646, "uuid": "f9b94e63-bc8e-4a78-8151-3142ef21376f", "comment": "Malware payload (a310Logger)", "value": "36848bbb5309f29d548bdb7e4999e0c55c701f7c516ed886ef2164a911f4056b", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303646, "uuid": "3ded0724-14b9-46f8-8b0c-7bc06d5867f9", "comment": "Malware payload (a310Logger)", "value": "0cd9f0b12c507575e96bcfc82da66a3e63596087", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303646, "uuid": "a230b6ff-efd5-4bc9-bc4a-f97638845662", "comment": "Malware payload (a310Logger)", "value": "3e0568a8217c0dd5a1492f3e6bb95f28d58e27fb39733b06a63035304c93cf5580f4362a34642c894dd9de015128a751", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303646, "uuid": "0b89cf36-87dd-495c-b153-045b9dd54c0c", "value": "T1A0845B13EA50A11EF1A3C9F1A9B4925668693D351AE8ECABB7415F5834301E3ECF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303646, "uuid": "c0915429-63d2-4e5e-9829-1aa1acef5eba", "value": "4e88637d5094cca5de1556f3666ec73c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303646, "uuid": "b2cfb45c-07c7-46ef-84a0-a9332ecf14d1", "value": "6144:X8d1/w5KA81IJ8GpF6nuTmOOUWTWD6D5W7mISVADsBE30hyfXuHqD4XthdN7Fh9G:sjYKkJj6GmZUWCD6RIo5hyGHQiJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303646, "uuid": "ca8ede66-88d0-4fb6-bfe0-b334a6454887", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303646, "uuid": "9bd042ea-e7bf-4d75-9811-66387d2995ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303646, "uuid": "fa88ed92-5154-4946-b160-1204aad9021f", "value": "36848bbb5309f29d548bdb7e4999e0c55c701f7c516ed886ef2164a911f4056b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295374c4-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303522, "uuid": "8b2f56c0-545d-441b-99ed-799149774dad", "comment": "Malware payload (AgentTesla)", "value": "bf6a83c1d0500ae0f58c3fcb1cea8463", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303522, "uuid": "73f5cf2d-fdfc-4b39-beae-03ab908581c6", "comment": "Malware payload (AgentTesla)", "value": "3725b84aa81f643a91d085c07db5c804995689c4d603e2e83ae83910c0f32ded", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303522, "uuid": "a5b2a975-bc03-492a-9c55-d700c654b515", "comment": "Malware payload (AgentTesla)", "value": "903400f69ad5cc1f797d940aea452e4930098700", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303522, "uuid": "e801e019-5f24-408f-a850-a1d9a25a30de", "comment": "Malware payload (AgentTesla)", "value": "159ffb07af067091a511c96aea22190a74649e5011c004d8c2224afbd2be02aed9971d80eeca7135f4d5425b9ef0c0a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303522, "uuid": "b3339d2b-e6d5-42cc-b801-cedd96611c47", "value": "T1E1F4239465C16994C0946370D827CCA94E383CF09E25A73A472DEBAF3C713D3AB5AB1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303522, "uuid": "ec0842d9-a146-4b5a-85d9-4df87bfdeb06", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303522, "uuid": "80387889-ee81-49c2-9554-b371f102c2cd", "value": "12288:/z7hU5I5yuNHIgzSFKxWltRohBfSTso93UVTcApp9Mz6LgkhILYx3UvuTP2acF6:/f+iN57Gtene3OALggkQvvcP2acQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303522, "uuid": "5dba1c76-5b19-42c9-af98-5d8e535a5ed7", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303522, "uuid": "6c02cc07-eee9-4851-a715-7bff8c3e50ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303522, "uuid": "71e8dea7-43ba-44c2-aaac-3e2721accffe", "value": "3725b84aa81f643a91d085c07db5c804995689c4d603e2e83ae83910c0f32ded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610ebe8f-02dd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770328526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328526, "uuid": "83ddfbd9-b58d-4447-a9d5-a369630adcfe", "comment": "Malware payload", "value": "0d253167fd81f225f799bc7f848ced36", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328526, "uuid": "0a652b1c-d97b-4f38-99d6-4e6fe9990a5a", "comment": "Malware payload", "value": "37f197e3a9944e40dfca9df316a6152b7a64fe969175820cf46e58e44b015de4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328526, "uuid": "61b6f382-c8c8-40c9-b77f-6f7695c84f4c", "comment": "Malware payload", "value": "8b4554927df2ad599ad8373e6958c34a4e7bf0d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328526, "uuid": "d5e94d7e-7135-479f-ab8e-e085e4a5b677", "comment": "Malware payload", "value": "800eca710292b686b49e278f9836b78f907411b63c3ca57e52953eed46ca6387bea588a52289546e63a8c069fc4cc770", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328526, "uuid": "42d6c69f-7d0e-4d67-a008-1ce91f340830", "value": "T1CD824E283DD38C47B70A9E37B715718CF59B6C8AED8405479528AF0056A7A319EF1B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328526, "uuid": "1b0568ef-3538-455c-bcac-ee29620a9595", "value": "384:khIxaT4mXurY+H7JaaS2jkY9juZSkSrLjqlAopOIqxu2fRNx7eFprvl2Swx3o516:wIxaNupbJaZAnLRS92Zo516", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770328526, "uuid": "e56d3132-3afa-478e-94a9-64433a05e0ba", "value": 18918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770328526, "uuid": "ab8c459b-a127-4f34-ad93-3d034746fe89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328526, "uuid": "7510d93e-0984-4b0e-be94-c1c88d86bdab", "value": "Invoice-receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d705ceab-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770307249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307249, "uuid": "2984fe74-5756-4a1d-8786-187cf4ade039", "comment": "Malware payload (RemcosRAT)", "value": "65a187825a679824f3dcdd7de3ba2d73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307249, "uuid": "31172a2e-fe06-4b4c-a3c5-8f202be3dd49", "comment": "Malware payload (RemcosRAT)", "value": "37f4a581602155760c7b9cc219a683fa9d69284ff5f03e7363be963db8f251b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307249, "uuid": "622dd77b-1ecf-45e1-9980-90f3b1a63c72", "comment": "Malware payload (RemcosRAT)", "value": "7ae61681e9df66934d94a6c29fcbec232c89c257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307249, "uuid": "16b939a5-0580-43de-9922-89c8a10b6d96", "comment": "Malware payload (RemcosRAT)", "value": "0840b6d606dc4228b8289a8956b893aeabba50713396dd769ca7256ff652024b86724a5d20b02b763dfa71f9929ec642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307249, "uuid": "820ed2bb-268f-4622-8ea4-1e29db82be9f", "value": "T17155231E325ED853C5920AB52960C27177B0FC8EA100E1C7DEDA7E9FF5FAB241962253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307249, "uuid": "98ee61bb-cabb-445a-aaba-e96a73f43a36", "value": "24576:KlVHFEI4lVpcH0vqOREtMH657qXjgdpujheDx16jRfg:cVmFs0SO2MnX0b4hkr6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307249, "uuid": "3f19ad60-d38a-4df5-977e-05e10d95d536", "value": 1308160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307249, "uuid": "9193c2a1-ccc5-4e3a-8ecb-bb1f00c95821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307249, "uuid": "921f2837-2630-45ba-b4bb-4db8c114bce6", "value": "37f4a581602155760c7b9cc219a683fa9d69284ff5f03e7363be963db8f251b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87204877-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770304968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304968, "uuid": "3abb6484-7f2f-47b0-9fa6-a03f811823af", "comment": "Malware payload (MassLogger)", "value": "b4778b78d8ff5df19ca2cf19a7a67ab7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304968, "uuid": "a2ee8c0e-4f2c-46ab-9539-dba1673628b6", "comment": "Malware payload (MassLogger)", "value": "3888e0ad1c15f4e0d66f31781e063762b17f641458be57e614fabdee62274711", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304968, "uuid": "b4df1718-ba98-46e8-9df7-435887fc87a7", "comment": "Malware payload (MassLogger)", "value": "11f38ea6d4aac1473e219b48fead3f963acf6d51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304968, "uuid": "07356221-9f3e-4a24-b9b5-7670abc885a8", "comment": "Malware payload (MassLogger)", "value": "e133fe037f7c91cbcc175e1a063b57c3535bf4dce7cc5bfb8d85d15ec8ea6dd93602fe22767a7274b4f24da5d9ee6649", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304968, "uuid": "6f7b05c0-4f0c-4376-9aba-bbc5530b1a74", "value": "T193259E027381C062FFAB92734B5AF6115BBC79260123A62F13981DB9FD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304968, "uuid": "c5ec7a5c-8acd-41be-b0fa-a23300c57ba0", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304968, "uuid": "837b224a-4e40-4f3a-8ded-e5d2a72c0ef5", "value": "24576:15EmXFtKaL4/oFe5T9yyXYfP1ijXdaoLLp6:1PVt/LZeJbInQRaoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304968, "uuid": "26c994bb-9e73-4d2e-95ac-938575e39890", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304968, "uuid": "3cb9772c-6127-4666-a841-da5008f783f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304968, "uuid": "2a6656e0-99a3-4f05-b322-16a45464486a", "value": "3888e0ad1c15f4e0d66f31781e063762b17f641458be57e614fabdee62274711", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0871be-0228-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770250696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770250696, "uuid": "fbab38c2-8422-4670-8416-bf9b35cf39a4", "comment": "Malware payload", "value": "2655c9057edf0df6e2a867a054666a0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770250696, "uuid": "c889045b-3e0a-44c6-83cd-112a6a5eb8da", "comment": "Malware payload", "value": "398a3fdf4b6d9548c8cff6578343d89109b4c126c6eca3b5cc16d0cfba2f4a08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770250696, "uuid": "7d5fca5d-2a0a-4896-8682-0610c73c8cc0", "comment": "Malware payload", "value": "158e281f2c50c65dab506e0351c9f775789f7a36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770250696, "uuid": "90104e1a-5e6d-4104-9036-d0814ac0d726", "comment": "Malware payload", "value": "73424c6cad6d19aaee9ee00b377c588ac44e3b9751228bc4e280725915078d4bca282b0f8aba2c00b9ffb045b1bbba11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770250696, "uuid": "2c9a70a5-3289-4dd6-906e-2f07f276e2ef", "value": "T1CEF4237BAF038E63CE0B13F5E54C646C35B0BBE5D25DF87E1B500EE66A091062E6E944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770250696, "uuid": "9b086837-4063-4e93-b44c-35ac0efb5624", "value": "12288:cFh82akv38Q8lRZ8Cf7Chg/HGvLcxKu3ArleIBnOwKWEIRwz/f6znWJVIg:Ah5aS/EZ8Cfs8HELLualLI8EI2bsCOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770250696, "uuid": "ad34c27d-5dcb-4765-b662-429cd25d4080", "value": 762997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770250696, "uuid": "fe9cc18c-a029-4bb0-b6f8-7187972bd0d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770250696, "uuid": "cad903ef-eadb-46a2-bd72-9849a49c089c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288d63fc-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305668, "uuid": "2b7c9f73-a76e-41cd-b666-c9db8f6ed95d", "comment": "Malware payload (AgentTesla)", "value": "7a40e207882f9396bb5b1a986810d18a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305668, "uuid": "dddb8089-5245-4c72-aad3-4ca23cff476f", "comment": "Malware payload (AgentTesla)", "value": "39bc05d33ed0083431a636ad244599306c83e2ce018bf338c141473f75e8e16e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305668, "uuid": "50116044-4584-4d73-b977-b3713c86592e", "comment": "Malware payload (AgentTesla)", "value": "3080e94efdfa2c335d8d161dfadc552a51a641c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305668, "uuid": "db7fd8f2-d07d-4015-9e3b-46b3085cba06", "comment": "Malware payload (AgentTesla)", "value": "616c63ee7ea7e61f0ed9f71cd344df46a97aa17c81c95ac98660c2d8aaa85ee45fc8d8e1c9890cdf0254cacdbd6b3e11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305668, "uuid": "967c732b-f761-4403-a49b-687375af091f", "value": "T1CB35AE0273C1D062FFAB91734F5AF6115ABC79260123A62F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305668, "uuid": "1b6ef435-7f3c-42e8-931b-12c404827f7e", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305668, "uuid": "a3653c98-2576-4a70-ab77-8330a2f5d88a", "value": "24576:r5EmXFtKaL4/oFe5T9yyXYfP1MAXDzQSbvj+u:rPVt/LZeJbInGizQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305668, "uuid": "d7d14e4d-b8bb-4e8a-8d7b-ed30c203d766", "value": 1109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305668, "uuid": "d0566756-6f63-4544-a55e-e1de30c982cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305668, "uuid": "0b82437a-5166-4f98-b37c-b00e41f07c80", "value": "a46d2c7d7389353f070eea4c1f5e45030d64d32e555db18f78ef9fd9426b1fcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8236fec-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770308056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308056, "uuid": "c8b04e1b-63cb-4021-a892-1d824fef931c", "comment": "Malware payload (Mirai)", "value": "2df866ed4d5f16a8774dc601f7a5ace3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308056, "uuid": "ab517a13-93e5-47bc-9225-c56e98a30887", "comment": "Malware payload (Mirai)", "value": "39ffb272f573a4fc2ecf66cdfd210fa3c25018ab5bd01e7cd516bbaa3204462f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308056, "uuid": "6d6136e0-84e8-430c-bdeb-695dbf9d13e9", "comment": "Malware payload (Mirai)", "value": "19a3fe7a4c843cdde7ebc4c63a6ac70e61bd2a0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308056, "uuid": "6819bfff-74b6-40f5-8b10-a6a64093fde0", "comment": "Malware payload (Mirai)", "value": "a20751fdc2ed7e8cd497c1b8a00767b0d10701553c0f966a208729d61504a8c2ec6bb62bab9800bf958d5358f6cbfa1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308056, "uuid": "82d4df3a-e1bb-47bf-b070-5e1b295a078a", "value": "T143B312661311CD87D4CADE7048B969D8791AD2B77BFA3E084C08E4583DC64E8127FED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308056, "uuid": "8b8161f7-086e-4c6c-a425-71e7cda4f8a4", "value": "3072:g3/OisEboPLnJje8hKwHSht3QP4mYxubkyqShMzJ:g3/Dn2Jje8U/3QP4b6ZrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308056, "uuid": "f48622e8-7f69-4254-b220-cbc845d146d3", "value": 111592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308056, "uuid": "3d4fe8c2-c69b-4d91-a332-c616f430ac61", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308056, "uuid": "a54199f3-48ec-42a5-9943-fddab8738758", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4cee61b-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303783, "uuid": "ba966b23-4a12-43f0-9dda-c299971674ec", "comment": "Malware payload (AgentTesla)", "value": "60b719bf72f88966f54a54b72be94a04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303783, "uuid": "665e5b5b-885e-4685-95d0-c423f9f6b976", "comment": "Malware payload (AgentTesla)", "value": "3a516a97b667b1288c49d68d4a37d06392d58d2e284f255d327f55a62f05e0e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303783, "uuid": "d6818391-fd8c-4cf5-8546-6e88bdbd3878", "comment": "Malware payload (AgentTesla)", "value": "cd09ac2e5bc2e74f7df372a6645942532ff33007", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303783, "uuid": "79a37073-94d8-4b3e-97a3-4f2367be1fd4", "comment": "Malware payload (AgentTesla)", "value": "db771ac1fa27f992800e7e64e7513624eb86e1c0bd8e444f179aea8a100dc96215dfd318bfb942741810d922a4695d48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303783, "uuid": "6fe4de7d-891e-432c-ae43-828c61357260", "value": "T1B035AE0273C1D062FFAB92734F5AF6115ABC79260123A62F13981D79FA701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303783, "uuid": "095f1f56-c5b2-4933-8949-212d1b0091b5", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303783, "uuid": "b6228076-7e1f-4f57-a4ee-f24ad75ebd6d", "value": "24576:u5EmXFtKaL4/oFe5T9yyXYfP1MAXDzqiQc0q2nT+:uPVt/LZeJbInGizqi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303783, "uuid": "62427549-1d62-45c4-9b71-c19478c18289", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303783, "uuid": "78670ecb-caca-4fa7-8ed6-0752ee5923dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303783, "uuid": "7522aac6-391a-4061-89ac-2231bf8c91b5", "value": "f7f4ea9c6e3d1b7bf941588fcaa14a8d18832901dc069f373455715103773cbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62d1679-0288-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770292215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292215, "uuid": "9ca2c342-3355-4292-9480-21c50c8e5d77", "comment": "Malware payload (Vidar)", "value": "3fcbe758436b83b903da95ce3dedc660", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292215, "uuid": "b2b00ae4-ae9b-4271-b241-5887b249f04b", "comment": "Malware payload (Vidar)", "value": "3ae0ce45d207510d44abb1d03eefa64e4d27c6659b5f3e1f159f2906a3c7f54e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292215, "uuid": "2abee6f8-0144-4fd0-9592-f8b3e898176d", "comment": "Malware payload (Vidar)", "value": "dd351703eded208391bc130db75fb284414cc60e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292215, "uuid": "364fd794-aae6-405c-bcac-da291d864c5d", "comment": "Malware payload (Vidar)", "value": "c1e3212c0d5d7946d3083eb074920b5f72faca61b0b676f1eb147132bb709e76d470c7191bbda8f6251174606debcb95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770292215, "uuid": "2b7d90e5-d58e-4115-bef1-37fefdb682c0", "value": "T13BA65D16E780051E8E939BFDA584C133C99CE9B193345242CC9EE31D3EA74BE623B765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770292215, "uuid": "ad24e0c5-f7b8-4c80-80a9-fb36e6338fe5", "value": "24c5e14e140f48018afc54c31d0818a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770292215, "uuid": "18c9c171-9d51-4f60-8cbd-df8d49898ed1", "value": "49152:+i5dhSkDtZnRKOGQTcDSYpwYtljwqBw+L/WoG84t2R02keW4gZpgDRZfi/AmgaBH:bTFG8aO+Tkgu6mMOQcWRPQTUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770292215, "uuid": "92be041e-6425-48a1-b472-a19eb77284e6", "value": 9979392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770292215, "uuid": "076727d1-affe-4ebb-a4b4-2a14b4c4c13d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770292215, "uuid": "59a45f65-4a04-4506-8dfc-8c33f9b058c7", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617c0afd-029b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770300180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300180, "uuid": "5b725831-4a78-41b0-aaa3-41c107b41eaf", "comment": "Malware payload", "value": "688e081d897de90ce008887b32eaf818", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300180, "uuid": "32ca51e5-4882-4b8f-b1dc-07aeecdc8eb5", "comment": "Malware payload", "value": "3b1b82025c2ee1548752ef331426d1cd6e0085e99f2ac9141a5b16e95bd51f6f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300180, "uuid": "b8c0da54-9c69-49cc-aaf7-c72b6a9e72dc", "comment": "Malware payload", "value": "97302ba24f40bd16fb472d5abdcce9f335713ee4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300180, "uuid": "e8a79259-7637-43f9-b3d3-3779b96ec830", "comment": "Malware payload", "value": "b2e4bd94212af07bc4565670e0cc057c55022022fc08032710329548da390b07ca3147832cdee6718e09f3827b5d6da3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300180, "uuid": "4e8daf35-5641-4379-8206-85c321afcf93", "value": "T15EC6128BFB88A85BC4F39332C53652A245474C268B83DAC36D44757C18BB9D06F5AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300180, "uuid": "38abbf65-e646-4f82-bbd2-ecb23e6b66ba", "value": "196608:DDYJ9EiVlDfD+tDDXdhEzg+dRU/Y42uizdfv6HKpUi1roVYhnY:PABr+Bz4zdU/Y421aqHr6YhnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770300180, "uuid": "9c3feaaa-c9bc-41a6-aad3-2bb12029d692", "value": 12367682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770300180, "uuid": "8753a7a7-dafc-40cb-ae13-e74c14d50af6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300180, "uuid": "1f225551-8048-4213-9dbc-3b4525997974", "value": "FedEx.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b1fd31-0268-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770278413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278413, "uuid": "11579aa8-92a0-4c8c-8e06-98a62ade1128", "comment": "Malware payload (AgentTesla)", "value": "f1a584562bde9a0b6814c9bfd5b092b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278413, "uuid": "f36949f9-67fb-48fa-9189-330c00873fd7", "comment": "Malware payload (AgentTesla)", "value": "3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278413, "uuid": "0e2a9365-bba4-434f-a2b1-cb5dfed1b4d8", "comment": "Malware payload (AgentTesla)", "value": "1594806a529f15b39b687e75f4382a6220a52105", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278413, "uuid": "5ed9750b-f757-4345-a30b-3005332b69b3", "comment": "Malware payload (AgentTesla)", "value": "0d0187c30791633ff70600f6a8de2d1871450d4cf088bdd2f3b82a40150d0c5aa5c1e4788c72f3cfa0d0852f1fbf2471", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770278413, "uuid": "56c81c1e-a9f2-4686-bcce-0fe73f5965ab", "value": "T173352352339DCE4BD0520BF92271D33053B58D2AE842D267CFEDACDFB916AA12569307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770278413, "uuid": "e592f282-68be-45fb-b7de-1a84611be2e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770278413, "uuid": "30e8cc0f-5856-4544-afa6-7fccacb76fc6", "value": "24576:qguQ5Y9WeirIjHsQW/qiQRZWqv0JFBI4huyDQqsM6e3C7kNOZgxc:juwnryWyiQ7hvIBXuy0qsM6e3C79Sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770278413, "uuid": "1da917ae-f24b-46fa-83b1-0502a3868a20", "value": 1151488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770278413, "uuid": "2c6c75c8-867f-4dec-a627-7f5f4d4cd71b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770278413, "uuid": "7e2bd02d-ee77-44fd-8a00-242eee9281a8", "value": "rOFFER14861-VGW0386814844_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9bda0a-026c-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770280173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280173, "uuid": "064f9522-681c-48f9-ae96-5287c787df61", "comment": "Malware payload (AgentTesla)", "value": "b7d1bb8c5e9e1e46595c778ea536344d", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-hhautoinvestment-co-tz", "colour": "#EAB50F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280173, "uuid": "c51d5822-c1e6-41c7-9da3-2aed9f677c49", "comment": "Malware payload (AgentTesla)", "value": "3b39a26469f03e1a41a2cb3ab0f8a43bc05f3ea03ed43ac54139eba9fa19fc16", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-hhautoinvestment-co-tz", "colour": "#EAB50F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280173, "uuid": "a663932a-c344-4afa-8048-5ea400488110", "comment": "Malware payload (AgentTesla)", "value": "8a1189e9e3ff40343e2f535d6861fbdba3c509ed", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-hhautoinvestment-co-tz", "colour": "#EAB50F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280173, "uuid": "c220c71e-5a4f-4621-be4b-eaa109200139", "comment": "Malware payload (AgentTesla)", "value": "5087e4b711dd4ebd8b92d17187b6d4075c40a782dfb6286481d178c0ebc8fde68531aee5ff6ae253a139b427d7242df1", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-hhautoinvestment-co-tz", "colour": "#EAB50F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280173, "uuid": "8900877d-9d11-4099-bcfb-6fd267359a7c", "value": "T11D451210D924DEA51A2C012620655C9762A05EBB6C58B3753FAE5F8E0F0F84FE0B97FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280173, "uuid": "b98dbf2b-9e73-45de-9700-bc26165c8c13", "value": "24576:KxK7LqV9lqGKQ1Zs8wUf9GHq+r46nap9412rLyoY/3UUl:KsHUZKUf9lsnaO2r+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280173, "uuid": "b73e4b02-95df-4ec4-bba2-4fd5e6fdad03", "value": 1218809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280173, "uuid": "0a6c7c56-52e3-4ffb-b733-184cea61a8a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280173, "uuid": "856828e4-5e4a-4d21-b999-acfa9afab7aa", "value": "STEINSECOND.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ed0cad-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770307517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307517, "uuid": "556f36ed-b543-4220-a3f2-c847738b407c", "comment": "Malware payload (PhantomStealer)", "value": "dab60541a76d9979368e622305f23fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307517, "uuid": "72ba24e7-80ea-48d1-b790-82aad5e73340", "comment": "Malware payload (PhantomStealer)", "value": "3b3bd10957380d706261e158127e44ee9abbdd3141cd3f84592dfea5c55f68d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307517, "uuid": "89623027-6648-4e5c-98d7-8f370130da3a", "comment": "Malware payload (PhantomStealer)", "value": "2b7e05b4e9c6d2d01b7023ebf9915aa20efde477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307517, "uuid": "05d86599-0cb0-495d-9544-8085ae04d6d7", "comment": "Malware payload (PhantomStealer)", "value": "3a16aabfcf8ccba4cb5a92a6639359cf6fb558129831904d4281df3a2f08578742a88c2a63382211f08119807c4e92f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307517, "uuid": "fdb08972-b84b-4785-979c-b7d8162d0f7f", "value": "T12775E00273D18062FFAB92734B5AF6515BBC79260123A62F13981D79FE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307517, "uuid": "a3ce1216-384f-495f-9142-b6abf17c84e9", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307517, "uuid": "86c67655-faf2-4fdd-af10-a0685adf8e79", "value": "49152:BPVt/LZeJbInQRavZRNLA9qvS9Tl31sSAAVj:RTYbInQ0LcY+llFVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307517, "uuid": "d318e81d-f868-4efd-a469-fa048eeb8bcb", "value": 1691648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307517, "uuid": "80420360-22b8-4b4b-b4b1-72c45e202c2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307517, "uuid": "c26a2e62-49a4-4465-8425-ca8997597a03", "value": "3b3bd10957380d706261e158127e44ee9abbdd3141cd3f84592dfea5c55f68d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64de11d2-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770306199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306199, "uuid": "1b9135b4-8d2a-49ab-a305-ca1362d1f874", "comment": "Malware payload (RemcosRAT)", "value": "5ece6d7bc9adef22189c522ce382c264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306199, "uuid": "5cb5b735-141e-496c-bbf8-c26433d8dece", "comment": "Malware payload (RemcosRAT)", "value": "3b416b770ff0a3b807935b5a6ec00a87684d2b12bb2095dd2cd3d80dcce9064d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306199, "uuid": "986f9cb5-1fd7-448c-8f0d-dc6f6f3348fc", "comment": "Malware payload (RemcosRAT)", "value": "3c8aed68282e37912f4fa0d6a4bf5d7805c82b24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306199, "uuid": "5b5c901c-c87a-4456-8653-d085a8381419", "comment": "Malware payload (RemcosRAT)", "value": "a59cbd664cd64f600a376220f1d17dbc6e5dbd33803a6af8657e1cbf772296a5c58be58b985172a9668c59f373828d5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306199, "uuid": "5e0cbc45-2fd9-41df-9e73-a5b9917f6397", "value": "T1FB65DF027381D062FFAB92334F5AF6115BBC79660123A62F13981D7ABD705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306199, "uuid": "a22262d0-989d-48c9-b16b-5c51a69af517", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306199, "uuid": "a2f46640-cd09-4db1-bd9c-90ff839d9359", "value": "24576:U5EmXFtKaL4/oFe5T9yyXYfP1ijXdan9LjhGLqYwvxsQn4NJp3pBrsVn37:UPVt/LZeJbInQRanJjhl5shz3pBgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306199, "uuid": "14fbcda5-190e-45b7-8df1-8e54cab0bbc1", "value": 1475072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306199, "uuid": "8ec8e820-5bb0-4862-846a-549ccc8a02a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306199, "uuid": "270e6c96-3cf8-48d5-b121-17f297dd4d9f", "value": "3b416b770ff0a3b807935b5a6ec00a87684d2b12bb2095dd2cd3d80dcce9064d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb88580-0272-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770282615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282615, "uuid": "e6ac864a-50b4-4898-b04d-292c55009e67", "comment": "Malware payload (AgentTesla)", "value": "3a54cfc13233145df264f62a1e2fa073", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282615, "uuid": "73f2c53d-a538-4a35-a063-556e40e2e66c", "comment": "Malware payload (AgentTesla)", "value": "3bec5eb78bd055eaea3afc18beb62424da4dde857e6f6bf8ad05fffad50e0464", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282615, "uuid": "756afce8-5500-4c4b-ac83-7360b2e8bc50", "comment": "Malware payload (AgentTesla)", "value": "879b9e4d17b6238f41618b4ea7d7b51b86bc1695", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282615, "uuid": "c5165e20-1f6b-4ea8-afa2-ab10672d79ce", "comment": "Malware payload (AgentTesla)", "value": "648707bf9b5f28241629469a4aeb16e4b397d5b5401efb2828a2c4c3c2974f97c6f614205efa9fa9cb7c39d1fd10e635", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282615, "uuid": "75303496-724d-43d8-8d00-628b91a883b3", "value": "T14135AE027381D062FFAB92734F56F6115BBC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282615, "uuid": "989b01b5-3ba5-4b36-bf26-a8571030d8bf", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282615, "uuid": "c5373f19-4ffd-41cd-8773-d71a2c446fd9", "value": "24576:V5EmXFtKaL4/oFe5T9yyXYfP1ijXdaXQGfTpRl96:VPVt/LZeJbInQRaX5TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770282615, "uuid": "587effba-a5f4-4703-a323-aaddb6f36e46", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770282615, "uuid": "00b5f7b4-2947-4d40-b4b2-123d4b6a7d4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282615, "uuid": "a6c01ca1-4b9f-4d1e-9d84-568155929115", "value": "3bec5eb78bd055eaea3afc18beb62424da4dde857e6f6bf8ad05fffad50e0464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6778dd82-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770305773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305773, "uuid": "b83fddac-255d-4f5c-9387-ea1066f8eee6", "comment": "Malware payload (SnakeKeylogger)", "value": "b51bf7ff0f5a2a34246248111c46a37e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305773, "uuid": "39ab6ecd-13a5-4b5d-b933-d46ff1abd200", "comment": "Malware payload (SnakeKeylogger)", "value": "3c3f129301ca6697856f4bb67f905f96b187bf25f15632e95097fe9bcd22f66e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305773, "uuid": "f5f8690a-63d6-47d9-9de9-70ec1b6069b1", "comment": "Malware payload (SnakeKeylogger)", "value": "b248f7bd5586af9427efc22101251739ad71b65e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305773, "uuid": "08fad01c-8629-40ec-afa1-33a1c94bccad", "comment": "Malware payload (SnakeKeylogger)", "value": "479a9897e5370bd2b18d45ba4a9d324d93b69e2c97d1c1d45d03489e22d27796157ae47611c8562e8938c1b718d68f5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305773, "uuid": "e9aed3cd-0f8e-4a3c-bc47-4f58d155580e", "value": "T18ED5124D2BEC5810E5BFC57B52729624C2BBB153476A8E2D16C2F8553B3EEA08E54F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305773, "uuid": "61c2ba63-b1f8-4624-b54a-b1bfe3d3a50e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305773, "uuid": "809d1e71-4933-4664-87cd-a0a9253622df", "value": "49152:kHYUyeQ1Ac7rPHfSbkNxfE8p/WrTShVDAuJ8ZAgC2FzI86c:kHYKQScj2Venn8ZAz2Fj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305773, "uuid": "f0674bc9-5a20-4279-87dd-919a5f11e5b8", "value": 2784256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305773, "uuid": "21b374ca-ed61-4812-9f44-172417b141ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305773, "uuid": "e233d279-59d2-465c-ad48-2c64643760e9", "value": "3c3f129301ca6697856f4bb67f905f96b187bf25f15632e95097fe9bcd22f66e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05140cc4-02de-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770328801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328801, "uuid": "e13e34e4-37d2-40ca-8ead-da293bf813c1", "comment": "Malware payload (ConnectWise)", "value": "ef946c4ff1a172ac16e4ecdfb792f7c3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328801, "uuid": "d0eaf6dd-5536-4b91-bc34-19575f70b751", "comment": "Malware payload (ConnectWise)", "value": "3c62ed648e746d90dad4dd0691191f5030d3df24b8a20601f76a132c2e706ef1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328801, "uuid": "1c3b57e6-ff18-41aa-82ae-e74f217b479f", "comment": "Malware payload (ConnectWise)", "value": "d2a38d845d22dc26dcad2878c65a4fbf8174247b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328801, "uuid": "bece4e1d-6c88-4810-b0fc-fd1118ea5138", "comment": "Malware payload (ConnectWise)", "value": "51b31ee23f3ce869dbe61d7c63e8cc679cdcae59db3164bce86bfbeab70a6a61e05de3d0faa546877eef86e9a20787f6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328801, "uuid": "8f5e415f-080a-4afc-b316-e23d91d01a79", "value": "T10EE61111EBA85537F0A25975B93660A394226C373911CD2D12EB752F2B37FB08D72E32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328801, "uuid": "e1457092-7ca5-4fe4-817b-a0a1b42e663f", "value": "196608:cHxcp9ym3nltDUJVZHxcp9ym37Hxcp9ym3OHxcp9ym34Hxcp9ym3diDHxcp9ym31:6GplpSGpFGpcGpGGpdOGpdZGpdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770328801, "uuid": "08a37ef9-6664-4b6c-98ed-5da177be78ac", "value": 14032896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770328801, "uuid": "f37dae3c-93b3-474e-bafd-7afe7b32e10b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328801, "uuid": "d3d0e36f-18b6-4548-b495-38911b702897", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a62b278-0228-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770250883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770250883, "uuid": "5dcb2c39-bf0c-4f10-a4ba-7ba7dfd50130", "comment": "Malware payload (Gafgyt)", "value": "bcc911db7d38ff2ee91d38b79e88d1ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770250883, "uuid": "c8238a30-803f-405f-89ce-e7defc734be1", "comment": "Malware payload (Gafgyt)", "value": "3ca420c0dc7979fcb57ec056b05e292f1a8fc959cbdd9758c743f2067ff5cfa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770250883, "uuid": "29a55fbc-dda2-4c5a-b7dd-d80a72d872fc", "comment": "Malware payload (Gafgyt)", "value": "60cdef7ab2c9dc0ce6dccd45b94d5a08b6c6b565", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770250883, "uuid": "74ef6e1f-5ac6-4d65-9536-1b702d529f01", "comment": "Malware payload (Gafgyt)", "value": "ed17ab0de337d85df5fbca7306bc541acd292b10c7462919fd29fd2b5a23474435ad3eddcacd3172fdaa6c6ed013da01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770250883, "uuid": "f6548991-0046-40bb-a9cd-1d1f4b70206d", "value": "T1F0032A54D281F4F5E62310B2206FDB5E1233FB3EA023D9B7D7851A76D8629018B51BEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770250883, "uuid": "8cbb96bc-1ab3-4f09-9f57-c4976b431423", "value": "768:jRcZ4rEUqAe3tlLvIUzEnPU8qTs1XPHFoFQ5XXDI/yBYlj0wYiWtfN86:m4rEUHe3QUzEPuTs5loupkqBYlww9k9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770250883, "uuid": "7c7e16d5-4fdf-41e4-a291-4d010c311ff2", "value": 40139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770250883, "uuid": "19896286-96b5-484a-8127-98bcdc99aca0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770250883, "uuid": "377ee34d-87a0-451c-bbee-d3906b59e9e7", "value": "yakuza.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7160551-027a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770286150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286150, "uuid": "0b4e55cc-b687-4c88-863d-301e7b478e0a", "comment": "Malware payload", "value": "630550e7ae6636c5f1dab5241597c91d", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286150, "uuid": "261ae8ac-5dea-4f0a-b52b-33a0538f2f01", "comment": "Malware payload", "value": "3cb09154a839a5de6e8ef4a04a933b7362afb56cdc4e91368b237e9bcb1cd7b9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286150, "uuid": "ab680cbd-c2ff-455c-9d15-43fcacbfc947", "comment": "Malware payload", "value": "03c9f7794bcc691c9c0ba996003199da279f48fe", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286150, "uuid": "6f8d7696-f4bf-4268-82a1-b3fbc29ee00a", "comment": "Malware payload", "value": "270bc5a24ac3ca1a430a718b92a935bb157c353e43559537308ef4bd5312e52ec360bb4bd93c63b6c5e75084df81b647", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286150, "uuid": "0bf04189-1ee5-4c8a-9bb6-92e566d21cd5", "value": "T1F0631FF80045529AE353A290AF19F4847D3BF52578F484B436AFC3BEE0FF5A8C522566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286150, "uuid": "cc49d853-0ead-4e7a-b49e-9b43f43394f7", "value": "384:8X3x64qb7FdozVgS8165XcHOUPNW6Cni6rGsexJqjn8nhCqYhAjDxqnYERJ0RDMh:8X3opn65xUdCzjn8lBERJ0RDWs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770286150, "uuid": "e2107d46-e5bd-4192-995f-84f466093fdd", "value": 68027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770286150, "uuid": "fe4a1b82-5052-46c1-b180-4d157c31a3ba", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286150, "uuid": "d528f08b-3488-458a-86c1-79aa8289cd0b", "value": "96.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7caac52-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770306875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306875, "uuid": "d83bcbe9-9510-40c2-a054-b55174252dea", "comment": "Malware payload (a310Logger)", "value": "3d9c844a19c99f0d627622ab03e72c45", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306875, "uuid": "7c93f93a-58d7-4069-a9e4-dfb341ce51a5", "comment": "Malware payload (a310Logger)", "value": "3d4dfa2a1552213a8aca210af4b99303dfd3513aa9629ecaec69e8a5db7fbb8b", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306875, "uuid": "c4148e96-0b24-4db1-bc35-77f9ff51c853", "comment": "Malware payload (a310Logger)", "value": "129b3f87db0e43c5464a17ce96cac0ac3e3c0d70", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306875, "uuid": "c2e675b7-2e1d-4756-9d19-27223b0f4378", "comment": "Malware payload (a310Logger)", "value": "df0c766395b555736b00866998158536e33bffa46eeda6fd5477d4111e3a2736c4edd442f0359e13098f543efa98b2cc", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306875, "uuid": "73b5b422-9400-47da-804c-a4042818342a", "value": "T1A4A42827AA20612EF153C9F1E9E56157AC217C361288AC57B3C19F5931324E7E8F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306875, "uuid": "43ad891e-67ee-41af-85bf-50a0e91ce510", "value": "bae4066a3a0162931dd70303b5bed587", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306875, "uuid": "14d63be6-2a63-44d9-b8d9-caaa737ab3ed", "value": "12288:2ljYKkJj6GmZUWgyP+Uioe4cxsz7yj46UH91AuFpP:8Yb6nZVJPRioe4cxsz7IDyTAuFpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306875, "uuid": "ef0848fa-aafb-4a12-9451-d9cbbbbfa0d8", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306875, "uuid": "c97caf12-ec7e-48a6-9a45-de7d7394a673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306875, "uuid": "da18d6f2-e32e-4d16-aa37-1ee30d23bfa7", "value": "3d4dfa2a1552213a8aca210af4b99303dfd3513aa9629ecaec69e8a5db7fbb8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6032da-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770306020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306020, "uuid": "9aae5ae0-12db-4e4b-b9bb-eaff7c3de0cb", "comment": "Malware payload (SnakeKeylogger)", "value": "4ba14c896691fa677638de8213b8a601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306020, "uuid": "529e9759-753d-4bc5-b2b9-6e17bbe019e9", "comment": "Malware payload (SnakeKeylogger)", "value": "3da022a6c3f74113d864e81e8cde5e8a869bf480cf107a5ad320b8284a732486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306020, "uuid": "5205b140-8223-4701-b1c9-77c9a0d3d6c5", "comment": "Malware payload (SnakeKeylogger)", "value": "8d364812085820287b225ee2ccfda12519329d8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306020, "uuid": "4b77db45-fc1e-416d-a895-072f6b0f76e0", "comment": "Malware payload (SnakeKeylogger)", "value": "8ee64d34c35e0a2419b1fae6ecb6a1df1f08872a389106bfb666f3166eaceb4d27927e7e4986afbb8c80b58ed3c0df96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306020, "uuid": "ff0ef0f8-65a4-4693-91ef-ad5edc46a069", "value": "T11185AD19E3D902A8E567DA38CA619332DAB178064771E58F0B99D7162F33ED09B3F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306020, "uuid": "abb7bb5c-6ba5-41f6-891f-00840d1e6adb", "value": "b31fa30c377b7584dd6c4a686890d3e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306020, "uuid": "4925d779-373a-459d-8fe2-d20f470706ef", "value": "24576:kGrFIPwWczAWCLQMb0n3CLyBtbn4n8qc8cLDrmCYS5mrDKfN/QagRgQsq9UEzxgN:kGrFIPcdnb38crma5mrOF/QrsqBzxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306020, "uuid": "c8d86fc6-c341-4d0a-a525-8f5f441b805b", "value": 1789440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306020, "uuid": "06ad896e-5b1c-4c3b-9aea-17141de69d09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306020, "uuid": "892297dc-f25a-405c-aca5-005b71697e2a", "value": "3da022a6c3f74113d864e81e8cde5e8a869bf480cf107a5ad320b8284a732486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210216bb-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (Expiro)", "timestamp": 1770305655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305655, "uuid": "1a7bcc2b-ecb2-404f-93b3-a9877b396ed5", "comment": "Malware payload (Expiro)", "value": "31d0cad8771eeb1dbc889afe5d092925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305655, "uuid": "5515070b-0455-4fcc-9a3d-015b9b851365", "comment": "Malware payload (Expiro)", "value": "3daca0091a9cb47f819f17b01f8651d7faa2535b8ca1407376356cfcf85497db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305655, "uuid": "933ab6ed-721a-4f9d-81cc-e6f87950a6db", "comment": "Malware payload (Expiro)", "value": "f79ec2575a48cc3f0ea39a1ab724ff495aac10c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305655, "uuid": "354c5dbe-2708-4fe8-bfe8-0a4776e1ba2f", "comment": "Malware payload (Expiro)", "value": "6e925e40c1a48b7144274c56d627fe412d9ffe08b9f0c85c60bbb8178928041f47978fb484daad54a715d60760b372d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305655, "uuid": "c79d08a4-65a7-4aee-bec0-3eeacf05a3e4", "value": "T15995BE16EA10B0A6F85345702D79A256B92D3D3A3680EC0BB78D8F5A3770993B0F571F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305655, "uuid": "1a6a6ed5-5bec-4cbc-91dc-2ebfd2268d65", "value": "48813bb14551712e601e5616425eb223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305655, "uuid": "e50a4bd2-deeb-4b06-9870-0d232db604e0", "value": "24576:Bdhn166+WW9Vg9N9JMlDlfjRiVuVsWt5MJMs:zhn166+WsgFIDRRAubt5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305655, "uuid": "e68819b4-6252-4ad2-b356-d57622b19137", "value": 1912832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305655, "uuid": "9b05f575-051d-4ce9-961c-b6dc19286a62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305655, "uuid": "2e786878-2662-4d90-95e9-4ac9c9a7ac4c", "value": "3daca0091a9cb47f819f17b01f8651d7faa2535b8ca1407376356cfcf85497db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74da4fc7-0295-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770297635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770297635, "uuid": "f69efbdd-496a-4a15-a037-0558b8388353", "comment": "Malware payload", "value": "5c7786e8688794e67e11140a501d2694", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "IBKR", "colour": "#61EBB2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770297635, "uuid": "a1e29691-1666-48b7-af30-329611b6164c", "comment": "Malware payload", "value": "3dec12d27b8a187e4e67977fb64c38e0c830f1c6a6b630d702e2af7e769db6ec", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "IBKR", "colour": "#61EBB2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770297635, "uuid": "1aceaea0-3347-4288-9557-7f7824afd5d6", "comment": "Malware payload", "value": "85106c70ef93b88447d72b2fae5ea6abbb8c5d14", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "IBKR", "colour": "#61EBB2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770297635, "uuid": "d52d008f-ece6-49e3-a14e-301f6ec50a71", "comment": "Malware payload", "value": "b22453a852793cd30cfb749c91c87b9c172aa65a6382f96c80d3397d16ad2baa6761abccd4b11795a1266ae3dd031a32", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "IBKR", "colour": "#61EBB2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770297635, "uuid": "58251317-34ad-4135-a5fb-45cea35a4699", "value": "T15336E08BFB48A89BC4F753B24539532241474C268B83D7C36D58723C19BB6D06F9EAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770297635, "uuid": "bfc10437-db96-4134-bc2d-f82274e6f303", "value": "98304:qkEAtz6OIcxQZMdXfvghDn2U2GerFjpO7xJkaev+0EMgLCrFXLdB3:qkEAtdpQhD+GerpE7xJkaenDhB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770297635, "uuid": "3e7879c2-2840-4308-89a6-af657b48405b", "value": 5317133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770297635, "uuid": "f510d137-c695-49f6-a95f-cbfd6c347738", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770297635, "uuid": "eee9643c-fa38-4269-bd4a-054429f62298", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b46dd7-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770305938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305938, "uuid": "66e72c01-3cdd-4cd7-832f-1e3bfd265d43", "comment": "Malware payload (ConnectWise)", "value": "46ad5763db27838895df6aab7fc88d55", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305938, "uuid": "b26ece41-f70a-40c1-ae6d-7764839162f9", "comment": "Malware payload (ConnectWise)", "value": "3e95893df2b0a6ae170d29478f40e39c2ec2affb0e9b46e5731ee6670d084a87", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305938, "uuid": "3fa1ddc0-5efe-4372-a882-0455e7d3fd86", "comment": "Malware payload (ConnectWise)", "value": "bce8b9aae608ec2dec6be1b30ccfe89c1d33696e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305938, "uuid": "65068cf1-afb8-4521-a892-de29ab37d247", "comment": "Malware payload (ConnectWise)", "value": "ec558dd43cda94dd537e028db6626b90e4c431433da2de828b85e4c7f97a762f57ad26766647a18a6478ae8255f3ba41", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305938, "uuid": "32cfb19d-2cb0-4579-98d3-572ae7345502", "value": "T1DEA6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305938, "uuid": "ce2f268f-42be-4340-ab0b-2c82b22a2e16", "value": "196608:BKaLNkbgDi4QiKaLNkbgRKaLNkbgvKaLNkbg:lWgDiH0Wg1WgHWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305938, "uuid": "2876a6f9-98ff-4b4a-adfb-ec8a2ab45ff9", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305938, "uuid": "a2ee4973-1a1c-4e82-b3bb-9c3e84578f20", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305938, "uuid": "adb1b2f4-de3a-48cb-90fb-86b32901e279", "value": "ZoomWorkspaceinstallersetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6932c7-025e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770273972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770273972, "uuid": "a86bf3c1-5d6e-482f-9ea0-94aae1777454", "comment": "Malware payload (Mirai)", "value": "05f92f6ff904314031c6bd7fe9f80d4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770273972, "uuid": "9911752a-02f7-48d2-8da4-28548f440795", "comment": "Malware payload (Mirai)", "value": "3ef8cc9990a2c6fe8930f1661292d4946cfb728870a915a059d1f6870c490087", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770273972, "uuid": "add3a817-de45-4424-8a02-8c5e77b1bfbf", "comment": "Malware payload (Mirai)", "value": "fd69b83cb4e11514fb58c124f5c60364cb573ce1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770273972, "uuid": "9f629c95-2339-498d-88ca-1312409ca65b", "comment": "Malware payload (Mirai)", "value": "411002c569b83916f9a1ac880eb14fd3fe321ef45b1f58002a2eca82965241c79f15c40b25e1618b53fe102701b9c994", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770273972, "uuid": "17ca3326-af2a-44cc-93cc-26309318903c", "value": "T1EC0412D5EE2593D3CAB03DA29E0F270911C6497C222228BF3C193EA4A5A655194F7BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770273972, "uuid": "f1c080f5-23ef-4471-ad46-24ceeea9271b", "value": "3072:lBcXIPBEjJXnd4tskE59sYW4MiYbcWFlm8CjQneWw/3gTLsnRHir1Z4/6T7/Z8V:vLBK4JE5JiFgjQeWwosnRqZ4yTN8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770273972, "uuid": "1363aa94-cc7f-4576-9942-86edd5d652db", "value": 173180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770273972, "uuid": "70aabc9b-9d82-44e8-b2ab-57161dd12eae", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770273972, "uuid": "c4f89bf0-7444-49ce-bc76-b567387a1e4d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c653cbc-0271-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770282106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282106, "uuid": "c9b10ec2-801c-4fed-bb1e-2d30eab2e06f", "comment": "Malware payload (Mirai)", "value": "733200cef5f66f170a9854253ada7cb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282106, "uuid": "9cabeeca-6a26-4ed2-a41d-916cde4733d4", "comment": "Malware payload (Mirai)", "value": "3efcb7ae91d2b5a4cfdf7c6fce6a87bc5c77afd31568ed83e6717cad3483b62c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282106, "uuid": "faf1fa92-20dc-446a-8dae-9410844e63dc", "comment": "Malware payload (Mirai)", "value": "51b099a6dc8a00177306c7415543ea8985f62693", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282106, "uuid": "c22eae21-1291-4f6c-b022-7034259a8159", "comment": "Malware payload (Mirai)", "value": "df77544a859502c7df0c448f82cee94f2241a6f2c0dbb24dbc8f5fad1fabed8adb1d83bb8aed121eb82ead220ace72a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282106, "uuid": "53b79454-2c36-44b9-a76a-b1754eb29d22", "value": "T11353123712A5902DE075CA374B5CCDB5837A82989B20465BE97EF5BF2E41E05F090E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282106, "uuid": "f83fedb0-766e-48d4-bc92-188eb5c7133f", "value": "1536:zoZ/Yzn9l6maZh7RybbM6EwryUxNW78z77SsheZjgeAQl:cSn9jaBybw6E4yUu707bheZjSQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770282106, "uuid": "67ed2b02-3229-4f74-a408-24d510a23e6e", "value": 63912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770282106, "uuid": "2d8ded7c-f14a-4b4d-b631-b9db3fa7cce9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282106, "uuid": "a70d13d7-7ea1-4af6-b882-945ccbafcc30", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b8732f-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770308082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308082, "uuid": "b185b7c8-d0df-4241-9906-672ec1f44b9f", "comment": "Malware payload (GCleaner)", "value": "0c5cdf5d9567e04afe83811c646ed42d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308082, "uuid": "7a6f110b-c0e6-467f-9b65-4704564e11e7", "comment": "Malware payload (GCleaner)", "value": "3f36eb6916b8482a6d13ac4f50eca1b3bd5c70d0f935e7cd8f63c756cf396416", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308082, "uuid": "59d23559-4fd4-4b55-bd5d-693a6a5f58b0", "comment": "Malware payload (GCleaner)", "value": "f1388f4ffcbda41e8d5cc40dad064cb4947f2577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308082, "uuid": "966d46ab-3629-48ce-a03b-53a5dadbb988", "comment": "Malware payload (GCleaner)", "value": "a2621fd16a09a607eab8eb6e48fb88f99dd519112f64b754071562854de9134d46553043d6746f66535eabe6995e72de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308082, "uuid": "38f498a3-c2de-481b-a2a7-44c6ddabbaa0", "value": "T1A4F48E21F6A18432F0331A3DDCDB95645836BE902924685A3AE8FDCD6F75BC2345A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308082, "uuid": "58f21da5-917d-4b1d-b75a-eaaa87b8c159", "value": "07f608b4818de60660a6d587f85c6c18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308082, "uuid": "88694857-622d-4d57-a4a0-2a4661319357", "value": "12288:nTYcy8yZ08zaVh6E3DXDuTLVyIf3IqHqLrzFz8G:nspV/YdmTLnvRHMnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308082, "uuid": "d7b60e3b-ab82-4dff-a293-4e61270cd33c", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308082, "uuid": "d4cb7e74-7557-43dd-b4ee-84d46d453ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308082, "uuid": "03c351b3-b456-421f-a331-203c43c50e9c", "value": "3f36eb6916b8482a6d13ac4f50eca1b3bd5c70d0f935e7cd8f63c756cf396416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497b92e4-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303576, "uuid": "c1750568-e74d-4ebb-9f08-1cf230f5b4e5", "comment": "Malware payload (AgentTesla)", "value": "50a1efae72e4f623ce5077bfe8647af4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303576, "uuid": "bdca06c7-7cb1-4194-8b82-1373734e4577", "comment": "Malware payload (AgentTesla)", "value": "3f60c3f739617108102716e98f17f21f62da0e470c6eafe319735687376437c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303576, "uuid": "0810afd4-9714-4fa5-b511-25afc50f979b", "comment": "Malware payload (AgentTesla)", "value": "b399d62da03167382d0aa455c0dd20736a5d15db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303576, "uuid": "60e3d79d-ef62-4819-9e11-715a0f04bca5", "comment": "Malware payload (AgentTesla)", "value": "c1bd659522da8460b5816fe9cbbffda8745b41305f204b3f6fd79d9d56c6e36907680a6f12e58912d40c550b30ee8a49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303576, "uuid": "40021857-e1d3-492e-bff0-e5bf863504a9", "value": "T18845BF0273D1D062FFAB91334F5AF6115ABC79260123A62F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303576, "uuid": "6bc390ac-d4b9-437a-aa5e-013e2443d72d", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303576, "uuid": "643c4e17-d93b-4e51-a9f8-e38f6ef973a3", "value": "24576:f5EmXFtKaL4/oFe5T9yyXYfP1MAXDzFN5PdVz6tbrMnRqO:fPVt/LZeJbInGizFNldVAbrMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303576, "uuid": "a25da867-f847-4750-9f75-d2812de768bd", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303576, "uuid": "77032901-2ede-4b64-9dbc-4a6cc166cc0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303576, "uuid": "4371eaca-9acf-4fda-b4ee-f88c58af55d3", "value": "fe10d9040d9e7798c014a11dce746dcac3fb6ca3fd72de0604f9812331e03a55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71fe781-0285-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770290901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770290901, "uuid": "bbb1a68c-d67b-4e05-bfb2-2bc868fdead6", "comment": "Malware payload", "value": "44e17e2ef1329ae5ca1ddbfbb8df1f1c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770290901, "uuid": "2f52b653-46e6-461f-9840-fc2a59197e12", "comment": "Malware payload", "value": "4055212f6c3ddf1bbf99775b0f70a52801a9e8eeb7c4c0f89a1569531f662bb8", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770290901, "uuid": "35c842e4-3b45-47f8-a87c-92e78fb879ae", "comment": "Malware payload", "value": "9ce6cc6f52d8c6ad4d3dc973bc63bcc31e157afe", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770290901, "uuid": "2ca9e3d8-602b-40df-8e9b-ce30a3e9fa73", "comment": "Malware payload", "value": "4f051d1a9ef82463b83616b9955337a1c7c9ebec71f24b5820dd4814a2eb8f12231c612dc51f70e34f2d4aba37f9134b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770290901, "uuid": "5b531de3-3b16-4a55-9388-924b6624921e", "value": "T128E16B1022F54604F0B7CF38AA3777A0D972B90AEE29ABCD4214B00D5D30B20D565F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770290901, "uuid": "3c2f4378-d97c-43a8-8b70-fda72f17c091", "value": "24:8d/WiU53zfpUhkiYIvqluNBP4DnPCfHzOD:8lWiozfpk6IGuNBPEPkzOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770290901, "uuid": "e63f9288-58a3-4169-b32e-f4ac5ca2824e", "value": 7033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770290901, "uuid": "e07c18b4-d4bb-4e00-b2d9-10d648b91dca", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770290901, "uuid": "cf5809f6-9d5b-4102-8e70-044673de478a", "value": "Kiitoskirje.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d00716-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770308158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308158, "uuid": "938f43ee-2e00-4a92-b649-98946cca65e1", "comment": "Malware payload (GCleaner)", "value": "7cd251d729b646906c3e3b3a3370747c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308158, "uuid": "28fa6ca2-b6c7-4326-aaff-d13b286b1453", "comment": "Malware payload (GCleaner)", "value": "405d28ff287a9b006435564dc94b3266cfec7c78c472a90f410aa3f26133deab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308158, "uuid": "0ecc4e0c-62e2-4242-a281-9a8c831a7748", "comment": "Malware payload (GCleaner)", "value": "094eefe8862f219cdf360419d69a4f0f63cf9a82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308158, "uuid": "f86d27a2-5b30-4ad3-a3c2-e943dbf24e4b", "comment": "Malware payload (GCleaner)", "value": "990ee889675d75eeecddf6034f2d6e05e2ac9d93e488168223b0734b5079a1e3d3337864a176ac125cbb7444abb52dd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308158, "uuid": "a1ce8aad-a202-41e4-ab97-cd188cadfca5", "value": "T19EF48E21F6918432E0321A39DC5F97B45C2ABF902D3869DB3AE93DCD4F76781246A353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308158, "uuid": "35860c27-5636-49ba-92f1-d366f9b94740", "value": "07f608b4818de60660a6d587f85c6c18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308158, "uuid": "29c8cbbf-c5ea-4c07-9b69-391ad896681c", "value": "12288:4TYcy8yZ08zaVh6E3DXDuuDmDpVbSmu6ghG:4spV/YdmuDmlQmu6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308158, "uuid": "2d2978cf-3429-4026-9878-56251e746733", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308158, "uuid": "7eb574e9-c01f-4ca1-bcd9-13d0a6e70469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308158, "uuid": "9a102b37-8f4f-4e25-a55b-b0d40c3f2976", "value": "405d28ff287a9b006435564dc94b3266cfec7c78c472a90f410aa3f26133deab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edcd18a-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303585, "uuid": "f20873c9-5c36-4042-a5dd-c2b1eb65881d", "comment": "Malware payload (AgentTesla)", "value": "0746c3f4bf8541f323095dbce6e39310", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303585, "uuid": "15e20938-1bcd-44b6-b8eb-732db52476d9", "comment": "Malware payload (AgentTesla)", "value": "40b0ea80b2bb6bfe6f9fe8412d408627882eb69c4f9e860ab8a42f0f8ec5755c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303585, "uuid": "c34585d8-1960-40f2-89b3-58c6044e1aba", "comment": "Malware payload (AgentTesla)", "value": "715fa1f5e1329f6620fa147b127da149379545f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303585, "uuid": "928c04da-30d2-41b8-a766-6bb2ba0a3086", "comment": "Malware payload (AgentTesla)", "value": "61e45fa376846a966bc765e8eb7224ff409f2a4b035171af6b7fc68a574604d7a5e7c5c13baa673929f78e4bd1d0d136", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303585, "uuid": "94c63cc7-5146-4199-9482-b839258530c2", "value": "T13CD423869AC0D990D5586330C432CCA545A93970AD47B73F9B2CE96B6C70383EE7778E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303585, "uuid": "b1b4944b-35e2-4203-8d3f-594bfb4aca35", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303585, "uuid": "1d267ee3-6a1a-4b74-9be9-8bf0ac99f311", "value": "12288:cz7hU5I5yuNHIgzSFKxWltRohBfSTso93UwDwz0r7hLzB/BSj2UZi:cf+iN57Gtene3F9p/Bmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303585, "uuid": "f3e08ffb-3483-491e-8a10-00cead107fa2", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303585, "uuid": "e47b1e31-87b3-44ba-aa6e-4ad4c3f1ec0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303585, "uuid": "8f62eb07-a6e8-473c-8a45-88bf20da0998", "value": "40b0ea80b2bb6bfe6f9fe8412d408627882eb69c4f9e860ab8a42f0f8ec5755c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f75747-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770307054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307054, "uuid": "b29da139-72d1-404e-94c7-58ee5f575bda", "comment": "Malware payload (DarkTortilla)", "value": "fe10006b4d28c79e2d733e66bda06dfe", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307054, "uuid": "1a3bd6da-0cfd-4103-a253-b687b5f2b676", "comment": "Malware payload (DarkTortilla)", "value": "4173909d6790cfde1cb60988ad573f014cf71b6bd7fe5ebc26a5284a429748c9", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307054, "uuid": "e0f1034c-c251-40f0-8706-22930f56daa3", "comment": "Malware payload (DarkTortilla)", "value": "070a2aabd120ce54dd448f856626790ed1941270", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307054, "uuid": "8c6488f1-88b9-4919-b240-5659b5228832", "comment": "Malware payload (DarkTortilla)", "value": "a4729f0f7f71205a4205c5a8a5460bf2fc3d475fbae8e521fa173cb368cbb3db0e6cc47877162841a6d0f3f9c93783b7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307054, "uuid": "8615177b-c9a2-4d81-b905-4b50fdff15d8", "value": "T1AF46230933C6894CD62D9774443AAE4267F0B55BAE21DF5EB3C923AC1E1139AB713723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307054, "uuid": "46e463e4-856d-4838-ae14-39a69aa65b4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307054, "uuid": "076b95ee-3c54-4c60-b422-3730a36e85b7", "value": "49152:dCfTfeUkFAn/2Gnw6nxwXqiMOrENcitrFkPvhGR7thSoWYfy8jg78uoX5mQq32/u:YiQ/2a9Or4cW+PvkNDHmfQq32yeDGWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307054, "uuid": "d6a2a6bb-8e3d-4523-9316-01963b4b1eaa", "value": 5711872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307054, "uuid": "2259ecd8-3768-46b7-b64f-3173690d2483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307054, "uuid": "b8e56ca3-890a-407b-beed-65445d2d6800", "value": "4173909d6790cfde1cb60988ad573f014cf71b6bd7fe5ebc26a5284a429748c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e7c50e-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304774, "uuid": "36c2edd6-8ef6-488b-8378-569d42d55810", "comment": "Malware payload", "value": "65df39f45c8b078f23e34ab2bce2332f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304774, "uuid": "c670c7e1-838c-46a6-9fd3-3ee44c6025e7", "comment": "Malware payload", "value": "41f9059375488b49b72a25ce58e80d9ef64f199934bff7862de5a114b5895757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304774, "uuid": "54e80e22-2e3c-4cd2-8150-414227f25322", "comment": "Malware payload", "value": "6e4f486b6cce872e5f4416426d496daf64b8d16e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304774, "uuid": "941d131c-53e7-4eb4-a585-aa8594991ee4", "comment": "Malware payload", "value": "bb2d15a5f56e9147c411001f200142bbd04693f8a4eea38a4e1ca54a1518378d5f06006f6cfdd8a9e8e82ea51940e61c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304774, "uuid": "4ed62fd8-75c0-41c6-8fa0-21628c8dbe16", "value": "T1FB2522C9BA82E343C8B18072C66398F7264B9D36D665353317D2BF2F38B75629719113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304774, "uuid": "5f002d31-f214-4deb-a2eb-e7b4643b92a1", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304774, "uuid": "574d0aca-5c09-4a65-9291-80ac750eb126", "value": "24576:cGE8Og4k8sz3SAaFafmF/Oyasbn9o1NDQCGT:HdJ4k8sTSbFa+F/Oy1Y5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304774, "uuid": "a7e913f1-cb87-4a26-8748-91827612a9f5", "value": 976112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304774, "uuid": "6f34b249-c1b5-4229-888c-fbae7b807df9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304774, "uuid": "ffd251e3-016b-4ae1-b8ff-1b90348112b0", "value": "41f9059375488b49b72a25ce58e80d9ef64f199934bff7862de5a114b5895757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76591e32-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304080, "uuid": "2d986459-cd82-4e5a-ba8b-f6c2298ffd83", "comment": "Malware payload (AgentTesla)", "value": "11cdfb338b4a7a15703b831c7a6b550e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304080, "uuid": "5991d6dc-b0c6-4ea9-9c9b-35ab6509fa67", "comment": "Malware payload (AgentTesla)", "value": "41fd49ca52f66d1ed07fe95fc4ffd2555b085c3d5490f9baee74887af9438d99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304080, "uuid": "2f2f5770-efae-4ae7-9433-d133df6e040c", "comment": "Malware payload (AgentTesla)", "value": "5814b883dbf388bc8d8404c315d2ca2f727b99be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304080, "uuid": "95b0231b-9169-484e-991a-23b68694c29d", "comment": "Malware payload (AgentTesla)", "value": "7c1289834352be12ae0c7e09f04626a8e4f5b1dae97cb8cd3cc8d6bb5d1269d1fd787e8b0b4797b9752ee8982dce0dd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304080, "uuid": "c4c9c18e-c605-4d50-a57c-08b5892c06d3", "value": "T18425127EFA96BAA1C99D5B3ED4030A4D82F0C813E571F19A05C438F10C5BBD59A4FA93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304080, "uuid": "7bcc37cd-3251-4202-91be-7ab17ba5d208", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304080, "uuid": "3b944848-3abe-4c25-a0b8-29f271d19fdf", "value": "24576:8zqRopCx7eou4o+5j9vpuBFGW1JhPEIl/R9:Ch87eoudy7jEJh8Il/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304080, "uuid": "0fe681c2-076e-4689-a73c-a77b5d65aa79", "value": 1040896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304080, "uuid": "980670bd-1acc-4d89-a51c-14c1f0076d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304080, "uuid": "70d3b3c4-192a-4f5a-9a14-bf98da7e4fc1", "value": "41fd49ca52f66d1ed07fe95fc4ffd2555b085c3d5490f9baee74887af9438d99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f5ae1d-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305533, "uuid": "8d721db2-3c41-4de1-8afe-05d664b615fe", "comment": "Malware payload", "value": "ec4e2638d13e10ab97a30edbe0ed555b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305533, "uuid": "a817a0fd-05a7-4c05-93a1-54306747ba4c", "comment": "Malware payload", "value": "41fed3340b8f00d73f48055eef8c6da6f4fc24be0b48e3c58af85974fbae0212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305533, "uuid": "06372460-32cb-4419-8da6-29e66527130f", "comment": "Malware payload", "value": "575bf5421578a9f10c6f12698c9f5f3264918834", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305533, "uuid": "2dd14e93-fc66-4a2e-a927-0c1e1eb7b65d", "comment": "Malware payload", "value": "e200f53e96860944b9be8082e0e4a5a4f8d9deb0562996ab1bd75cb818fe688ea2811e3c68c75a46dda6d807952a145a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305533, "uuid": "d75cd638-b96f-4fca-a097-7e260e5f8347", "value": "T17794D616E660B4A5F89349702E78A256692D3D393581EC0BB78DDF4A3771A83B0F530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305533, "uuid": "fa0d65b9-6344-4859-a78b-1da21f8f80e9", "value": "2d1434374a4d0356ad308b5a3f701b2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305533, "uuid": "170d8c61-9788-43bd-a1b6-c87438a31ab3", "value": "6144:MkJltBrvdpI5krJr7tknftufRararYvv9ZryixcJ+QVsVZNf+oDLn69eG:FtBH9tknftufRaraMLzWsVZoo369", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305533, "uuid": "82e26fc7-37f1-4964-b0da-949f61d737c8", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305533, "uuid": "35e6f054-a204-437d-8a5d-927a5a111f11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305533, "uuid": "c213ac04-9537-45c3-a30f-cfb8ce7d5480", "value": "41fed3340b8f00d73f48055eef8c6da6f4fc24be0b48e3c58af85974fbae0212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8e91b6-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303846, "uuid": "d322c5bf-de7f-4edd-8e56-0fc99bead9b5", "comment": "Malware payload (AgentTesla)", "value": "523ff002c63583d271af5f28bfc9ef38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303846, "uuid": "102e8671-721a-41ad-97d8-e8efde2f8748", "comment": "Malware payload (AgentTesla)", "value": "4274c2605d538e6d24ce9d8d623aeccbd3eddd075bde892468fdd349c03d9bc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303846, "uuid": "3d9c59bc-ecdc-4d16-9406-25ce6f75ed90", "comment": "Malware payload (AgentTesla)", "value": "b51ac90103bc982c3e7d4a06a61a88c12f469029", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303846, "uuid": "848888a9-9a7e-4824-975d-4916968823dd", "comment": "Malware payload (AgentTesla)", "value": "9faa4bb62eb8464a890bc3103f4fbffd0103a83a2ae3869d4c7d16c6d9458b98df0440d72e64d9920f6f0947b3e45a6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303846, "uuid": "2216b898-84ac-462f-bcc8-d4c968295fb0", "value": "T1D305020533AECA02D8655BF80932E2B44B757EEEE821D24B8FD6BDDBB9757404880347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303846, "uuid": "7d8d3831-b728-4f5f-b3f7-9d9a21a772ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303846, "uuid": "83c26df4-4f3f-4742-b75c-4ce067bd5bee", "value": "12288:DhE9ITnlGf1AQ1SwqgWp3rhssQkY2HezWHMX6yzNJ6U7Ddoe58AN:lzletorhs6+yH3yzNJtO8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303846, "uuid": "ec02e7c9-7ffd-48be-b495-b674e079b621", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303846, "uuid": "3c59c644-8e6c-4958-92e0-a324ab9383df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303846, "uuid": "c28e7318-f0cb-4804-b30c-67c60aef6da9", "value": "4274c2605d538e6d24ce9d8d623aeccbd3eddd075bde892468fdd349c03d9bc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f655622-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770304767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304767, "uuid": "f8fa4fd9-9f10-41bb-96f8-da0d49eb3737", "comment": "Malware payload (Formbook)", "value": "056de58a89ff6d659b9e5dc6fa9a9383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304767, "uuid": "d83ae8ba-372f-475b-b45a-377baddcd807", "comment": "Malware payload (Formbook)", "value": "428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304767, "uuid": "57995af8-65af-45e9-8c05-a70170675a82", "comment": "Malware payload (Formbook)", "value": "e0bafacf3b695965833ec65a28bd41da7a8fb684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304767, "uuid": "c5b7f0f1-52f1-4050-8f8a-53a9555f7d5d", "comment": "Malware payload (Formbook)", "value": "3bd231100d589a8fce18316ac14cc97d09b3c53e83f757e57cc015c9cc0996408d750f4abd83212f06bf422b85a2aa74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304767, "uuid": "5abc1cc3-c7b3-4d7f-bf78-172a4f1c3e00", "value": "T136150224336ADB02C56917B409A0F2741379AE9BFA40E3478EE97EDF7972F144A40793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304767, "uuid": "428f107e-98cf-4517-aff2-c0ac0f47e975", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304767, "uuid": "871eaf8c-b620-4550-a8d3-87628124775c", "value": "24576:Y8fjU2192Ac9V6xgSbsEzpORHvq/xWHTWoNdQHxy4B:rg2192vPogxQ+C4zsxy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304767, "uuid": "1602691f-319c-480f-9c03-a8d155aa8b35", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304767, "uuid": "f25817d1-2f14-42e3-9f94-3d8988dbbdbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304767, "uuid": "2fadf4e7-d668-427d-b918-46ed7097e746", "value": "428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947b286b-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303701, "uuid": "0263251b-910a-40d3-b22a-859e9b749505", "comment": "Malware payload (AgentTesla)", "value": "63eb63265ad3150ed6d9b491682fbbfd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303701, "uuid": "18801b73-11c3-4613-9dce-417ef7973465", "comment": "Malware payload (AgentTesla)", "value": "429b83afeba46b5bd59d111035fb113975c88a80ccc3a3ae4ad7ef7e7ac06440", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303701, "uuid": "3d59ce6e-e81c-4750-a2ed-71b672610e16", "comment": "Malware payload (AgentTesla)", "value": "16f0d5be6b4c1f7fca44c28e1036124f16a655fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303701, "uuid": "5e195ba7-da90-4f0c-8730-0ad58069a31f", "comment": "Malware payload (AgentTesla)", "value": "bbecd02d8a1386027b9a8ba0379c868263a5990b7ae612e775719740a4c2dc08b310cf69c1f031a03b34899220f67c29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303701, "uuid": "d431b68b-6034-4d44-a658-13f07fe23f97", "value": "T19D35AE0273C1D062FFAB96334B56F6115BBC79260123E62F13981D7ABA701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303701, "uuid": "58ccb6dc-7286-4e4a-919a-d57e3b641e64", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303701, "uuid": "0dc82bf4-fe92-4753-b78e-8c7e50316b92", "value": "24576:x5EmXFtKaL4/oFe5T9yyXYfP1MAXDztR9p/Bmdu:xPVt/LZeJbInGiztR9p/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303701, "uuid": "ded97b63-7546-4a8d-8a93-c80fa306534a", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303701, "uuid": "d8321297-6e55-47ef-8526-157612121039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303701, "uuid": "ab9f7e7a-8114-494a-aed3-b5a2790b410e", "value": "40b0ea80b2bb6bfe6f9fe8412d408627882eb69c4f9e860ab8a42f0f8ec5755c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d9aef1-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327214, "uuid": "6dbd005b-7ced-4631-8d06-9e2ffcb500c7", "comment": "Malware payload (Mirai)", "value": "8e39d1faefc50e269b31af624ebfa3a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327214, "uuid": "44da526b-b01a-4546-9997-2c43de8baf35", "comment": "Malware payload (Mirai)", "value": "4332bf0173e0325c8946b9861ed6f76be8c55d10eedf92cd4e58ac201cf1c9f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327214, "uuid": "d8a828e0-80ae-49e1-86ae-52ff07f98485", "comment": "Malware payload (Mirai)", "value": "d43574be05d1c9f8280d5a4054211c15eff4ca4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327214, "uuid": "9d74f849-e1be-446b-9d46-33d6b231fa1e", "comment": "Malware payload (Mirai)", "value": "af92a9490718eb01131d4c89c9deed4853b89b61097913080f4cd090db8e351e752b4e260933a6151c1a5feeab4bc118", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327214, "uuid": "2ccc7f2f-3928-4b73-a2f8-d50136ba84f7", "value": "T18703F1A6D073D66EE05BA4F0877F85C3AC72B8214F62570B59DE258F5CFA8813C805E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327214, "uuid": "3d8dc61a-10b7-4118-ae1a-e4237641845c", "value": "768:9AbI/zypsR/nV8VkDRTcO/0Qf/6KbRZmZveZNYu+ufwZIK6N/Zyx0Ya:SbIOpWt8eDRJ/0KbfmsZNYGZbgxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327214, "uuid": "f5b882bb-46e3-4ee9-bdc9-de0ae7287037", "value": 40092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327214, "uuid": "0e0d32ab-f960-4f4d-808c-8361445200d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327214, "uuid": "757aa260-7701-4a21-8872-afdae494fffc", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58885f3d-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327223, "uuid": "9e320970-401a-4416-9d63-a00cb99156bb", "comment": "Malware payload (Mirai)", "value": "1fc1c2ce3088bfd5d92483885a4f9eea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327223, "uuid": "96a3ec05-2ff5-48a7-a8cd-85c003aff65e", "comment": "Malware payload (Mirai)", "value": "433b16aedd630e0a6f17c3a1d8c10af9e28b1a43be9845058cbbe3ae0a7352bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327223, "uuid": "b5357e84-9b03-4401-a5f2-2394582d90ec", "comment": "Malware payload (Mirai)", "value": "7920e26df232b7751e1d46d8886beb6fce778fad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327223, "uuid": "9ab71763-240d-41f5-963f-d47f15484e1b", "comment": "Malware payload (Mirai)", "value": "de9fd51ce6adabd45a47e7e745e887708266a580eafe63ca8eb34079966fc3c03c3bacdb82abe35aa374998c98bac9e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327223, "uuid": "ef25bcfe-eecd-4a35-9522-a072a3bca022", "value": "T10403F10685DB6505D53F30BA4BAEB4390600927EEF08DFDADDC039F94897A931B6C24A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327223, "uuid": "e7fb96ea-f965-44a3-8275-d0a2f2c38954", "value": "768:qrLKiCAPpJX9ipa91tO04M/swR3/gLRH9unbcuyD7UHQRjs:iL0ikpYfO0Zxvmdunouy8Hyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327223, "uuid": "5f10617f-7005-476b-b6e3-21791331fb35", "value": 37844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327223, "uuid": "03a0caa7-d5cd-4f37-8bc5-0dbba4e12e2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327223, "uuid": "79e78765-558b-422b-913e-5d96ca3795ea", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44bd3e9-02be-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770315324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315324, "uuid": "4f0f6522-4e85-4bd0-8be0-4106263dcb7b", "comment": "Malware payload (Mirai)", "value": "23ea4ed33b937aa60286900f07262df9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315324, "uuid": "daa998bc-83eb-4e4b-b71b-031db2a73ee9", "comment": "Malware payload (Mirai)", "value": "434646603515c319b0cb0f6bd7861bf69a16379dc2b10e56955c7bc5465865bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315324, "uuid": "c6a2a6e0-d8a3-450b-955f-6b096fa68d89", "comment": "Malware payload (Mirai)", "value": "5b6ad943b4685eb4a8df83174ada9f99df49a8d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315324, "uuid": "97c145d5-ccef-4970-8ed5-a3a7e26efbc2", "comment": "Malware payload (Mirai)", "value": "9609f7a5e8ab9a325d5f99b34be10a0fd59c027cb1aa94a77204d89526560d76c22a1a7beb074189e9074fa3390913e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315324, "uuid": "669cda66-c1f6-4a07-a314-9cb6af6d52e8", "value": "T1D064F95DF8809B7ACBD0627EFA9502CD33334F68EBDA710589356B3837D6B25943A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315324, "uuid": "8defd78c-b19e-4848-8a5c-5978e7787064", "value": "6144:rZf2dv+0o44xn7YZkpJ3xTJvydYlkDMsS6z5v62WAgKmR860MkLBGCGHt+k4qm8o:lekpMpS6zr6/EGNPM4GQTXdmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770315324, "uuid": "f0a90c3c-bfde-431f-a347-0d7c1ad0541d", "value": 313420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770315324, "uuid": "2f40feae-ed89-41af-a1f4-777bdd2b2f58", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315324, "uuid": "2fe425d2-f5d4-4372-98cd-a8b1b5093225", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5752c95-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770303381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303381, "uuid": "61f4d43c-d5ad-4cbe-a7fd-eafc99521648", "comment": "Malware payload (Formbook)", "value": "9f3e27d7a12528ea3a4f59a6add85c24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303381, "uuid": "4a058a95-138c-4683-9462-5347867367c8", "comment": "Malware payload (Formbook)", "value": "43c908e7637a49e3e7402d856e5042d505abd2c281cfb95872136d859346d83f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303381, "uuid": "2ae7b2f2-6f48-4f71-b054-165cc6e365bf", "comment": "Malware payload (Formbook)", "value": "8d623b5eabc6b0a581545928eee9d47606c07380", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303381, "uuid": "1470f180-8f62-4a22-b264-8d16ee854573", "comment": "Malware payload (Formbook)", "value": "a70df5093eaf35f1fa1d498f15d3630c47d5e02c08f96454e484faf0061f5deac5cb656679d54e935069539824b1d857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303381, "uuid": "5e27d99c-76ad-436e-aec3-b43728b1bd90", "value": "T1B4F40218225BCD43D4D25FB6E9B1E2B03B24AEDBAA92D257EFC53FDF74392854440281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303381, "uuid": "76b82df6-cf52-46c0-8d72-95920a23fbf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303381, "uuid": "3f0a3cad-728d-4408-904a-3ab3f178e8b9", "value": "12288:ghyjnG85HJrMt3We+0J3nfMjlM00Rsz7w1gznLSYB4ctN7IBWXWW:ghyi85HK1+0RfMjl/3XyETrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303381, "uuid": "5067d8ce-2824-48b9-ba93-f43ddf2eb218", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303381, "uuid": "2dbf0f51-be21-46a5-be98-44720107a919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303381, "uuid": "d438197b-36d6-48c6-8e48-5147ce7cf776", "value": "43c908e7637a49e3e7402d856e5042d505abd2c281cfb95872136d859346d83f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be55775-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770307955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307955, "uuid": "27c2f974-2df6-453a-84c8-02e3bb149cb2", "comment": "Malware payload (DarkTortilla)", "value": "8737469106c728024fbca86965588fee", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307955, "uuid": "6125ddda-a38a-46d6-9443-c09eef2ec989", "comment": "Malware payload (DarkTortilla)", "value": "44d7eb1fc0f09147291537db5d572d1960108376645c7ec2fe8f96e39f3de41d", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307955, "uuid": "96a46a5b-7a0a-46e0-90ac-e9b78e1a329c", "comment": "Malware payload (DarkTortilla)", "value": "2b8ee79a9b46d2d957dff81eb4482b9bf824ea2c", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307955, "uuid": "e738c8fa-ab24-4bbd-a709-8ecb41847ff0", "comment": "Malware payload (DarkTortilla)", "value": "919dc8cf25b6b7df6bad52618c4942b94b48fa8637abcf2274f8ef2881d3d4b110ebf471fe34cd3ae8a8b114232e1bdd", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307955, "uuid": "76847d5e-ef01-4f38-bfaf-ee55104c6985", "value": "T1CBB5121B1AD641B8E4E9CE34E3FC05A852F066AF9521A7BB554842F4DF2174FB6032B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307955, "uuid": "45bfecff-7969-4aa1-9378-036d6c0423ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307955, "uuid": "3de09661-f5d6-4928-8ed0-87b368e8b4b8", "value": "24576:2F2RRHGAWq6/p3ojZPk8/5D8LoA3B/UoMOmxYC1xa7Rl7VL5h4gXTkZyPM2Ck4+d:35GAmOdPk8R8LhB/rS87PWEPMc4i7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307955, "uuid": "f889c1c2-a821-4dac-bd2e-cf313e9c4b83", "value": 2433024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307955, "uuid": "70f914db-e5fa-4311-a9c3-8ba76351e7e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307955, "uuid": "4ad19393-71db-4bf7-be8e-37674ce0211d", "value": "44d7eb1fc0f09147291537db5d572d1960108376645c7ec2fe8f96e39f3de41d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7500cbb5-0287-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770291623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770291623, "uuid": "6efc19dc-b871-4a68-8215-df939fd7087f", "comment": "Malware payload (SalatStealer)", "value": "c82e8d92dcbf761d1f370250b10d4fc8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770291623, "uuid": "d040ff38-74e6-4bb2-83f2-73e33b2f822a", "comment": "Malware payload (SalatStealer)", "value": "44e7dd8533d999a94931470ae4c06787740719a0ddd0453574f6cf2de9fbc085", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770291623, "uuid": "40a07a71-78e5-462c-b5f3-d20e2df30ad0", "comment": "Malware payload (SalatStealer)", "value": "c7a6b93c2eb17d06e0d245840cd251b87dbc9b29", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770291623, "uuid": "5a9656c5-ec3e-425b-ade9-0009c834c368", "comment": "Malware payload (SalatStealer)", "value": "29178ee4ed50be39d86bcc986e5958894cfad24bebd5d444121dc75a6ef487d0ea680aab15a797d0f35ec85b37ea909e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770291623, "uuid": "a7419095-c136-49e0-9470-199c3d76c260", "value": "T1A756127372CBE47EE42E073644B7916908F7693A96626C5A82F494ACCE311711E3FB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770291623, "uuid": "b8d1c8c5-5117-4589-a194-8225a2c76be3", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770291623, "uuid": "79a888dc-fb55-41cb-a338-ac79262e7938", "value": "98304:Ur7QeWfKAbVPdDOTmdl5ogaUwSQE5j5O1fxf5nXd60H12Y58LdOfwY5xpwB1J8iH:y7QeWfKAbVPdDOTmdl5oga3G5j5+fxDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770291623, "uuid": "9c991948-52e3-4e3c-84e5-8818e55136c4", "value": 5936419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770291623, "uuid": "aa2c7c16-f2d6-4e57-92d1-1359a9f4153b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770291623, "uuid": "589eda22-60c8-441c-97d8-5ea5fd619a9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b792e38d-026d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770280567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280567, "uuid": "d1b1e07a-7f04-4fdf-b6ec-dbcaf6b1e5ca", "comment": "Malware payload (Mirai)", "value": "c191632b6832a799aadd5e99f0395513", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280567, "uuid": "074e91a8-55f0-434d-8b83-c7c92226f87d", "comment": "Malware payload (Mirai)", "value": "45547576ea8c148ed259a7ad5529b4554f10042cfe80193a205a1764468f3644", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280567, "uuid": "7942268a-c520-4938-b5d2-45cac06046fc", "comment": "Malware payload (Mirai)", "value": "224f6d0b8e61a782cbd8077c652601862503eaea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280567, "uuid": "b3859e96-72f0-4a6f-a592-05675586ec16", "comment": "Malware payload (Mirai)", "value": "94b8dbfc18323a7ea6afa143d1a3c3e33f483caf85500673ab7e9649749fba7c3d8f8bbb7c41ece2d392da9ec0ec682c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280567, "uuid": "69c81ee2-8f4c-4af6-a7d6-189114c3b6d6", "value": "T14B148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280567, "uuid": "8ba6d271-913b-46fd-a2ed-6e15967df5b5", "value": "3072:BcHZcggFy1tJmajThwnKBDMOzsjJjL1lCRuUKG:BcYFAJ9/hjzsdjy5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280567, "uuid": "1f2299dd-ddda-420d-a3b9-876c65935d9e", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280567, "uuid": "f2ccc8ff-68cc-4c5f-aefd-03f637096ac9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280567, "uuid": "ec379f45-67c2-4f70-af7a-9f2289ff1fce", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3805a77-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770304693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304693, "uuid": "edf11024-9dda-45d4-9d03-70cb7857619d", "comment": "Malware payload (Formbook)", "value": "683406243f6cb2b92bcbc4ad4dbf622d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304693, "uuid": "f108f99d-dca7-44d1-9886-0b740b89e792", "comment": "Malware payload (Formbook)", "value": "45997dcc03ccfe687fc509e4e688614b059566577e51d70c18b07d250a70e3a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304693, "uuid": "ee881d5a-a629-423a-afed-dc78418424bd", "comment": "Malware payload (Formbook)", "value": "7f491a5cf19fe5567228c316d3f723b06da53cf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304693, "uuid": "bc12199b-2cc4-4ec8-a873-06d077ed53ea", "comment": "Malware payload (Formbook)", "value": "20b5a726d9566e92be08175796b80d23038f3b607478b7bba2eb93b7b9f585d3b32fc1a0a9371d85deb2d0efc933fdb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304693, "uuid": "f4747a52-9b71-4336-9984-8c5ec7791dbe", "value": "T16E150144375FDB23C5290BB80860E27517792E9FEA01E2069EE8BEEF7971F014D50A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304693, "uuid": "7ead0b60-eab8-4f00-88f2-27428e159215", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304693, "uuid": "6893ddaa-9c5e-48bd-85b3-26e29b7bab96", "value": "24576:W8fOClCd6BTuPI60jSu50NTY7J4+MMDaHGFkr:ROClCdPIhjSEGTHyaHKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304693, "uuid": "b113cd61-a162-47c5-bdab-1089cdad8e2a", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304693, "uuid": "ebfe5cc1-794a-45f7-9ad9-65a3de4cac1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304693, "uuid": "c2f64eba-174b-4c8f-8f45-9a299a8f12a4", "value": "45997dcc03ccfe687fc509e4e688614b059566577e51d70c18b07d250a70e3a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72abbeea-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770307081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307081, "uuid": "051c801d-466c-4d10-905c-fa1a8718a2b3", "comment": "Malware payload (AgentTesla)", "value": "14db305cce099116a282b22d35a8ab5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307081, "uuid": "6c93fb28-7c8c-496e-9936-7d2167ed34e7", "comment": "Malware payload (AgentTesla)", "value": "45e8d77904415b19b872e4ae94e0cc03fa69bdefc547bbbbd1da41282088844a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307081, "uuid": "7cea99aa-3219-46fa-9834-939634d66f37", "comment": "Malware payload (AgentTesla)", "value": "4fbe1d8bf43eda50a4a22a7e2a2e6f77561a0230", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307081, "uuid": "dfc86a66-13f5-4678-89e1-48342f03fd1e", "comment": "Malware payload (AgentTesla)", "value": "0e78e74f3142fe17b6e0e65e29f8db8cfb405fd87c2a078a85614b6af216f48c04f93d56eb76fadc821e51aafd30e676", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307081, "uuid": "778ea5f5-145a-4412-acf3-6b6bc39ead6a", "value": "T130D42252A5C59E90C18127308832CD6046BC38A1AD057BBEC72EE16B7C747D3EA77B6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307081, "uuid": "3faf0a0c-7b51-4c03-8a8d-df8b1ef500fc", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307081, "uuid": "4ca63668-039d-4efb-a961-58bba62b7f1c", "value": "12288:Dz7hU5I5yuNHIgzSFKxWltRohBfSTso93UuoCu01ODSwIkC97A85:Df+iN57Gtene3DHu0AOwILeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307081, "uuid": "5a030bea-9cd0-4a88-9a20-e49b06bbe5ac", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307081, "uuid": "77d7cc7d-cbfd-4b1e-813b-03927556e9ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307081, "uuid": "47676a27-4bfb-4dbf-820e-2debdfa066ec", "value": "45e8d77904415b19b872e4ae94e0cc03fa69bdefc547bbbbd1da41282088844a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef0484d-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306699, "uuid": "e63f3875-b947-4f4d-a967-e5888c6e6857", "comment": "Malware payload", "value": "a54f63accabccb202b37f5313ce96e97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306699, "uuid": "6a6e44a7-ab8d-4941-a985-7c292889a1ef", "comment": "Malware payload", "value": "46b4659b5ca9556dc49e5644c23d255b5f33028064a528081f4af1bd6b0c4572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306699, "uuid": "91b86ba1-64e0-4abe-8742-4d5a8225c750", "comment": "Malware payload", "value": "2394460ae9b0da66bb976742b77a348b394df98d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306699, "uuid": "1c1b546b-37af-432a-a2d1-df641fe5cc0f", "comment": "Malware payload", "value": "c0fde1a3f6031f569afe1e73231822b724154bf91a8e8c26032237aada0ad06c5ace3aeef992dd9ce7a4dbbb56297162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306699, "uuid": "0b6399ad-e999-4dac-b668-d662c83c87cd", "value": "T10BB4D712EA50B42AF95315753D78A2867A2D3C362A81EC0BF7895F9B3671583B1F031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306699, "uuid": "95477b42-9fb6-4644-8e92-c1df7afba94e", "value": "ff512c717d541a89b26751ae0a94f086", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306699, "uuid": "c635cc7e-0766-4c10-b953-cbb5bc2126e3", "value": "12288:Ev6zYcL5zciMiNkfVcELuMW2ydf/14e8D2k40C0c:SkL6Lup911", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306699, "uuid": "45ee275c-8875-4152-9bf1-92a744e14e57", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306699, "uuid": "b3aa63b3-7608-44d9-a116-97f148cf020a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306699, "uuid": "3dd594a7-98e3-4aca-b979-15fcb75ca72a", "value": "46b4659b5ca9556dc49e5644c23d255b5f33028064a528081f4af1bd6b0c4572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de13eab8-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305113, "uuid": "bcfdbfd6-ebac-4c5d-95d2-953f629a85f9", "comment": "Malware payload (AgentTesla)", "value": "facc45dbaf6128f44fb434a05f2bdaab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305113, "uuid": "c7ee3d04-8840-4777-ac92-0a1b46a8c5fb", "comment": "Malware payload (AgentTesla)", "value": "470ce68595ae8ca768012d0ec974f0099d2bfb4995d6d8547df82c7186752853", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305113, "uuid": "f5455792-e9e8-481a-96e3-f174fa2377ae", "comment": "Malware payload (AgentTesla)", "value": "ce58d9c86fed759b9e8cf393ad7154908b102822", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305113, "uuid": "1c857234-d848-4978-b076-298ca9ebedbb", "comment": "Malware payload (AgentTesla)", "value": "480ed9f07b0b98ac8cad3eb2a70289c50f45c2734c58f9509867140df95a647b6df8739859c9ad2a059721f6c426c965", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305113, "uuid": "56e2f49d-2509-4197-8ae0-0d6124ff014b", "value": "T16935120437AEDA12C9A15BF01AA1D3721775AEAEF020D3864EFE7ED73465B521C483C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305113, "uuid": "19f64e70-599e-476d-b6b9-9198ed6692eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305113, "uuid": "6c37ec00-e0b5-48a5-942f-af9bd009370c", "value": "24576:3JbLQ8y/J0UQ9g2SWdZDBcMlsspZ3suMfOb1r2z/k8m:3JvQrBI9yuDBcMlH3OG5iTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305113, "uuid": "bf8ad2d8-3acc-43ee-a3e8-177fc62f1a5f", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305113, "uuid": "c0b32143-571f-43c3-94f5-0b015555a1d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305113, "uuid": "60eb8489-14de-421a-90c9-6581235bdbae", "value": "470ce68595ae8ca768012d0ec974f0099d2bfb4995d6d8547df82c7186752853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690d6987-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306206, "uuid": "b944bdff-d26d-4de9-a2b4-8c3c36b821d1", "comment": "Malware payload", "value": "8d91fb4270621742b6652398fcf2628b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306206, "uuid": "2ab1be5c-47fa-4e50-b4d9-ce45441bd014", "comment": "Malware payload", "value": "47c6ba872eea70cf59233fabbdb6d1978cfc7c5602d4710b4f3d123e91f91822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306206, "uuid": "0851f384-c5f2-42fd-8962-4acbd6c0503f", "comment": "Malware payload", "value": "3bab2ac2ef5e9771667eb1abe5058892464c2905", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306206, "uuid": "fafcf381-fd70-41fd-af95-14dfca4150ce", "comment": "Malware payload", "value": "b910c28c4e0a663c3a64238905832f1b690b1f53e0341d75ca74355584bc58b4905861899873a9124bf5119b0bc8f314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306206, "uuid": "39d0eab7-3882-4265-90af-0c249ee1a673", "value": "T11A15BF15E3A404F8D0A3A6B98D568511E7767C4A4760EA8F13F17ABB2F333D09D39B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306206, "uuid": "9774f7fd-b94c-4399-946e-7e15ca8d52fc", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306206, "uuid": "be7df2a0-ab4c-46a9-bd07-b8aeac0b410d", "value": "12288:nhoVY2+LfWvRSECKG4iRkTXTEAmDGpS8NNCm1ShUMtJKCQgmiOGBj4vONTGJ8Mzt:hb2+CvRSEHiRkTDTpxz0UuKRngmvON9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306206, "uuid": "dd1b2582-adb3-42b2-a353-6a6e2cb5d39a", "value": 900464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306206, "uuid": "324ee03e-e6e1-4c22-ad4e-f31c666f7a59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306206, "uuid": "5065f31d-6d47-4ae8-a5c1-7a11ca3c4baa", "value": "47c6ba872eea70cf59233fabbdb6d1978cfc7c5602d4710b4f3d123e91f91822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c4c673-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770305365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305365, "uuid": "a45affaa-2f6f-4f6b-b576-b4574fffda8a", "comment": "Malware payload (Formbook)", "value": "dbebc60f0ef8caef947b1aa0ceaefe03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305365, "uuid": "de2b25d5-99a2-484f-bb7a-686585d3e0b9", "comment": "Malware payload (Formbook)", "value": "48510d143ff22d526e875bae83f017ff97e46fac7353a63f375b34c33481e3a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305365, "uuid": "96f3f488-cf35-4b69-85e8-e3d5fe5e3eda", "comment": "Malware payload (Formbook)", "value": "4ac3c3d345ca87cdc500be81a21ba1c89fab21fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305365, "uuid": "6f775497-5787-42f4-89c5-8cd178c0ce9e", "comment": "Malware payload (Formbook)", "value": "d79773dca50b6a7b97ef4df5b7dbdd80d42a10c231ae45d0a93342fcad9766123a32f9cd43d40443656e14fac73d0dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305365, "uuid": "2adcb295-10c7-4974-8641-12d0f31370a7", "value": "T14945BF0273D1C062FFAB92334F5AF6215BBC79260123A62F13981D79B9705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305365, "uuid": "8516b517-556a-4854-a9f1-52c15902b45d", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305365, "uuid": "cee844ad-1fb6-4c45-84f8-c074ff85505d", "value": "24576:S5EmXFtKaL4/oFe5T9yyXYfP1ijXdaKx4o0zlG22njkaRp:SPVt/LZeJbInQRaKDiG2Uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305365, "uuid": "b0a61451-8b66-413d-9029-2427b2f522eb", "value": 1253376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305365, "uuid": "df70633b-6959-4625-ae5c-0fac2e26a536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305365, "uuid": "20f0ab30-1df8-40bd-8ede-aefca02fceee", "value": "48510d143ff22d526e875bae83f017ff97e46fac7353a63f375b34c33481e3a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c642f3e8-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305932, "uuid": "c56bdae5-ba9d-4598-958f-ee50857efe02", "comment": "Malware payload (AgentTesla)", "value": "c82ded1f2d3e25d854bc09b60a668613", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305932, "uuid": "6e854c04-36b5-41cc-aed4-7761eb340881", "comment": "Malware payload (AgentTesla)", "value": "486faeaf4db04e05f86f7edf502e3cda3cde907972ed497d2a14a582bec938aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305932, "uuid": "5ef4b832-ea93-4ff6-8011-3780189f9826", "comment": "Malware payload (AgentTesla)", "value": "b9a342ea311d6d6599593e18bbfc627a109553b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305932, "uuid": "8ce406fd-5c61-4b15-987e-62ef5208c264", "comment": "Malware payload (AgentTesla)", "value": "2277c8b9cd04ab3d14de48cd1c18a16d704a272b6f4b0f3786deceede4a9c166d5673cb359233afb28186f315a71bb30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305932, "uuid": "d806bad3-1218-4361-9852-64f749ff58ea", "value": "T130C422A29A809D50C594B330C936CD9149B83D315E55333E8B2EF92BB8347C7FB26A5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305932, "uuid": "e2bd85e5-5f93-4903-ae7f-56d1a304a6d5", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305932, "uuid": "a4560a07-2ecb-45e6-8ce0-aee677f6c466", "value": "12288:Cz7hU5I5yuNHIgzSFKxWltRohBfSTso93UO1wCb2isHTj6Vn5flXjD5:Cf+iN57Gtene3EX6p5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305932, "uuid": "d76acf45-fb99-48fd-8ad1-e313e23f9450", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305932, "uuid": "444edd18-c758-456f-8595-2c7b8e81c239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305932, "uuid": "6fdd6b75-d29a-4fc7-8939-fa9170b2fc62", "value": "486faeaf4db04e05f86f7edf502e3cda3cde907972ed497d2a14a582bec938aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c696f80-0276-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770284146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770284146, "uuid": "0ccc177d-f86d-43d4-ab09-c71ea989220a", "comment": "Malware payload (NetSupport)", "value": "a772f8fc304311f31316c949acd2236a", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770284146, "uuid": "e656bc85-2a4c-4667-b8ec-83447fe08619", "comment": "Malware payload (NetSupport)", "value": "48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770284146, "uuid": "40dc5ce9-dab5-421f-80a4-5eb38b1cde40", "comment": "Malware payload (NetSupport)", "value": "4df88bdd12ac3b926d21bccce6b8501bc0c401d3", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770284146, "uuid": "5679a5a0-cec9-42a1-91c7-5f0e037d46cd", "comment": "Malware payload (NetSupport)", "value": "c4d68124a35f69a74c3366c308d901289969c4c09cf2c12f0c3f2098531cc0a22fcaf2dd59536d056030653e9ff78750", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770284146, "uuid": "d7f0e3fc-bd6b-4c25-982d-71efb9a53ae1", "value": "T1661112ABD1502839E9530EDC6DC66440818F412B050B3A68F79D49812F9BF3DD9B812F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770284146, "uuid": "63745423-207e-4b56-9840-64d7edf08d9b", "value": "24:1y2A4s9+NdgXTz3ZP70da2A4Mx2Ag0qGaQH6xvu2AQ2Aau+s:1lI9z3h0bM6JQcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770284146, "uuid": "33baa24f-7437-498a-99a2-dfa5b584b5a9", "value": 909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770284146, "uuid": "5066981d-1be0-4d70-b162-2f95e6ff3449", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770284146, "uuid": "d8b78cf9-d1b1-41ce-821d-638a53f88b6c", "value": "sus.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7dd0b4-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1770304146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304146, "uuid": "11eed12e-053b-41b8-921b-bdd45418617c", "comment": "Malware payload (ScarfaceStealer)", "value": "a1f4b420986cec01dba2e7245ca6a2bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304146, "uuid": "3d5cad4c-a620-4486-bc1b-c9e85634f4b7", "comment": "Malware payload (ScarfaceStealer)", "value": "48b61fd09c0fcbbc0ac4dde7b030be1b4163fcc18b7bbad7c558d30d889c0f3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304146, "uuid": "debaddc2-9125-4550-98bf-d2558996d39b", "comment": "Malware payload (ScarfaceStealer)", "value": "f0cd9db7ff783bc71db4635bda557409daa158d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304146, "uuid": "b80d9253-f560-4824-bc69-cc3729b0cd28", "comment": "Malware payload (ScarfaceStealer)", "value": "a094e74b72fdc310c85099e6402129f7d3e1110e3f4bdf75eede06d8005465efd5e2c8f6ba4523ee7af1e3afa610ddb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304146, "uuid": "890b871f-1235-4d5a-8fc0-f6a5c51e800e", "value": "T104E623E72AC963A4D0878E30D28F478575F2F7CD85F6961A3BCA1C02A231F934649677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304146, "uuid": "24112cd0-eb47-4d48-a6d0-64c76699c508", "value": "c6e890f2bf1c766e673a9f6fba99f26a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304146, "uuid": "e316c4c5-65e4-4682-a473-f3a5ef75a0fa", "value": "393216:40LSmbemc1mhBd61WfXKf0TFm1Pcl+dZM0qqZ:4MBzhBd61CKf0QRAoZM0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304146, "uuid": "aed4df20-c8c8-47c5-b5e3-324aafe4c360", "value": 15256576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304146, "uuid": "224d169e-c80e-4dd7-824a-3304b2bbd9d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304146, "uuid": "32800c06-f0e1-4980-afb9-86538ac109da", "value": "48b61fd09c0fcbbc0ac4dde7b030be1b4163fcc18b7bbad7c558d30d889c0f3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07930b0-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770308097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308097, "uuid": "e98f4882-90e8-4c1c-a311-3aaa452ad56e", "comment": "Malware payload (GCleaner)", "value": "a54ec04f3f4fae3e0a2ebd948cdb224c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308097, "uuid": "9a4646f4-3d9d-41ec-ad3d-54b10ea34fe4", "comment": "Malware payload (GCleaner)", "value": "48bf1772d7dd8c1d94bcf263dbc9e800e72f7143ef4e041753adef7907b34cda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308097, "uuid": "20852b70-4cf1-4c75-8fcf-b09f0202667e", "comment": "Malware payload (GCleaner)", "value": "614b95fdd825c362fe8672c6e5ba9a351ec29aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308097, "uuid": "6c18693e-c756-4a98-b249-e22aeb622dce", "comment": "Malware payload (GCleaner)", "value": "482542837bbf9c21521721b3c763ae59f6bf6097d7e9a7d0a794043836dc396ceb6cc33b7ba73e1eadb83c1c3bb8f188", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308097, "uuid": "e7fc80ba-00de-4439-92d2-fa6c206c44e9", "value": "T1A8F48E32F650A432E0337A39DC1B9D64542DBE9029F8695A36D83FCD8F767812476B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308097, "uuid": "e0a5de50-4cad-46be-bf51-7b494dcac1e8", "value": "07f608b4818de60660a6d587f85c6c18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308097, "uuid": "6c4f3641-13a7-4508-b604-ecbc339e395a", "value": "12288:oTYcy8yZ08zaVh6E3DXDurA1wLbvol4tdHnkajG:ospV/Ydmrs2b/Znk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308097, "uuid": "08e63fd5-8c01-46c3-8fcf-391d024874cb", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308097, "uuid": "741c01a2-f412-41c3-917c-343f75800b93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308097, "uuid": "ca1283c3-233f-4e20-8133-8a11b3e16473", "value": "48bf1772d7dd8c1d94bcf263dbc9e800e72f7143ef4e041753adef7907b34cda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f72af1-026d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770280316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280316, "uuid": "6dc0554f-f857-448d-8e3d-b0ea5ad0983e", "comment": "Malware payload (Mirai)", "value": "dd1392851914734c2476ee9e92a4f2d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280316, "uuid": "50d76826-36fb-44f3-acb0-8e2802658837", "comment": "Malware payload (Mirai)", "value": "48cbd01d0f113117cdcf8db93cb5f2e8bd0af3c37a920484d5cd9818eb2d95ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280316, "uuid": "e733a05b-a9bf-4ffa-8529-74440572fbcb", "comment": "Malware payload (Mirai)", "value": "47f27d98903437559b52c898f8a9fbb2627a0b03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280316, "uuid": "73e86c56-68d2-46cb-9aac-0a3a12dd68bf", "comment": "Malware payload (Mirai)", "value": "d074fbc1d3d1842a71e6a82d159ba2a67ca964b25452528473d31aab0e9a22995e33ae896db77b497054cf645e74f1ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280316, "uuid": "e525f276-e409-4b05-b485-ffeb13b06d41", "value": "T1B25301A150F5B46AC66283F151148F05228BDA927B02CCDC34DA132B6C9FF9F5F95AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280316, "uuid": "2f4459fc-b3d8-41d3-9c7a-e714b81a6404", "value": "1536:LznwRRM10ac1B010ZtaS4SV/zQUjsPwttl6CA4Lkg4azHU:XrREB5taUVLQlwtt0YLGazHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280316, "uuid": "996e9c73-6975-4471-b93d-ebd9937028c2", "value": 60788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280316, "uuid": "3a4fd3ab-6d84-414a-8d6d-621e2d0ed1d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280316, "uuid": "3bbb4754-cfbf-4a05-b32c-b9c0e8a90399", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d6f010-028d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770294258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770294258, "uuid": "27521aa3-560d-4f4b-b530-fb8e34bb8f3e", "comment": "Malware payload (Mirai)", "value": "1da9c6dd73705550d79d504f45c85b66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770294258, "uuid": "e7e71e40-224a-405d-ad2a-9fa77721a580", "comment": "Malware payload (Mirai)", "value": "492d0ec2ba5e7a0281867433dd34b16c1f9d974d91446aaac4df40498f11ba6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770294258, "uuid": "bcae2513-c993-4f7f-9502-7b23dcb2f2b8", "comment": "Malware payload (Mirai)", "value": "808435cb80ad4d1a926892670dc337ffeb6f5db6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770294258, "uuid": "4be4be6e-39cc-4ca5-8fb7-ced971573e7b", "comment": "Malware payload (Mirai)", "value": "b4ff08967123a7480df37aa150ca28efd709cd7885b5b3d2605e380da65c82c37e758c3988f5b39ef98215f36c0eca10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770294258, "uuid": "a41e254d-8db8-4ea8-9aac-151ca4f6d6dc", "value": "T105B3AF87B1907ABEF0A45E3FC4135E26E6259F705583273D71BDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770294258, "uuid": "db90ad51-352a-4126-b53e-401880aaeff5", "value": "1536:toOxCg+uUGWkCqYUqwaJ1XqfXg5AcS5blaZeCtjHXNLdCS2T15OvhSkzf8rSx:t1xKlGWnqTUcXgZS5gZ7CSXhSGUSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770294258, "uuid": "4eadeaf6-b142-47ea-a882-7f215db988ee", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770294258, "uuid": "15b973d3-f84f-475c-b2c6-8250eff56319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770294258, "uuid": "fe460fc7-5e32-44ae-898a-7e69e5d965bb", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dda75f2-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327205, "uuid": "67ea380a-5002-4ce8-9743-f1433e9039d8", "comment": "Malware payload (Mirai)", "value": "f0ed74cf8bcb151edd82b7c2c08f6458", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327205, "uuid": "00ab3fd3-ec88-4342-ae52-a9419bef20a5", "comment": "Malware payload (Mirai)", "value": "494b6a2775656278942b5031258b15e38eab32c7ed79baec6d8407f6806a6914", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327205, "uuid": "7df4f36f-6cb6-4783-86c4-52f05bd6ad3c", "comment": "Malware payload (Mirai)", "value": "d764c25ddc0880817d3bc9b2ffa6dd99f84a23c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327205, "uuid": "6f1e6458-7f34-4293-b028-bb490e55db43", "comment": "Malware payload (Mirai)", "value": "c749079444691ecba0d25a2669a5e8ec50a727677b767605f7be1670fe2bc28a7c672e164433c52490f6a06eb3cdd6ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327205, "uuid": "ecee2855-08fd-4fdf-9950-4454c56b883a", "value": "T116B2C0E066656921E371187AD75CC3505BB340B493EE62BE14369BACE6CE007B7E8B07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327205, "uuid": "60a7bc28-dfd7-45fa-a4c9-0d965986a3f4", "value": "384:hPOPKl1O7BWlKppgNGunjW7FDhwlJToFSJupVEr4dpk+AbWNDZH0RyWShymdGUov:pOPK27BWQppYGEW7NhQJncffmbWNDZN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327205, "uuid": "5de6a358-c2c8-49ef-990c-244200dc82dd", "value": 23412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327205, "uuid": "65ca9c9a-10f8-4e39-ada9-689b5b39e2a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327205, "uuid": "e8cbc336-adca-4978-9b9d-2725432fc56b", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04775b9-023b-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770259054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770259054, "uuid": "4c171457-2112-496e-95e4-0efe07a33c4f", "comment": "Malware payload (RemcosRAT)", "value": "ff7eed927bbff449cd72e7683999e4f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770259054, "uuid": "ebc8c886-aa14-44aa-bf2c-ee7ae592914b", "comment": "Malware payload (RemcosRAT)", "value": "49af01f9215248c4f6a5e180940b0ad6c1b7bf596b8b9c4eb8251a4dc81eacad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770259054, "uuid": "9aeb7f0a-aed4-46a6-8d11-f92725d77b3f", "comment": "Malware payload (RemcosRAT)", "value": "e0e2b2261c07ed1b46c134f080cbd60529fb9ceb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770259054, "uuid": "cb16a7ff-b459-408e-8396-e068cd92feda", "comment": "Malware payload (RemcosRAT)", "value": "ac52bfc65cf8d4c648d419148e51f6e820823e47adb9dc37590d7378bcf324366d385fb81c4e24d3242d417a446c5edf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770259054, "uuid": "bc4f1821-73d3-441c-a335-8770e20360fb", "value": "T1BD452261734ECD9BE6AE1BF01032C33097B54E2AF213E3858EEA6DEFB9667514500653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770259054, "uuid": "76d71b19-6d2a-4d2e-8bbe-ce1af812be72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770259054, "uuid": "c634c164-ca2b-4888-b553-8fc4a5fcebdf", "value": "24576:9/guQuAsOvr82NOmHtu226YQs977hbcXOlhOeVoj9V0X+lN:GuN+82AmHtD26Ah7hbMeaj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770259054, "uuid": "957e049a-a8af-451f-9ee6-248d4e00770f", "value": 1235968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770259054, "uuid": "bfb0e952-1907-4fd0-a07c-4ca0b11ce6af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770259054, "uuid": "7d41ba44-89d9-4aee-8e24-6c7e7a7afaea", "value": "TPE26010007 HBL Draft - SO#3075 TFC - HBL#TPE26010007.PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6830c8dd-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305345, "uuid": "8e71d0f4-2322-4c43-9d79-97971fbdde7b", "comment": "Malware payload (AgentTesla)", "value": "67486f85b047566d155c2bb187c58ae4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305345, "uuid": "3acbb8b6-bd5d-43f6-b028-be15cc4539f7", "comment": "Malware payload (AgentTesla)", "value": "49cf6ac94593fa09849a81fc318729e648ac0611e5e7f1306f0cf918c31778f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305345, "uuid": "d3f8751b-785c-4367-a5c6-ce27bb03dbff", "comment": "Malware payload (AgentTesla)", "value": "64a7da5198978867e9bddf5f11b76a56af3f1ad7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305345, "uuid": "e50c1ec1-2d4d-4512-890f-37910803ea42", "comment": "Malware payload (AgentTesla)", "value": "e4d9811a2436551a9b10db550451314dd6a87b2770ad383bc3f5c5f49f50fc39a62454a0e29555bef53d5d47e8458a34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305345, "uuid": "3434d704-6cd0-46d6-9cf4-429f5762f2af", "value": "T1A635AE027381D062FFAB92734F5AF6115BBC79260123A62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305345, "uuid": "f72717bb-0964-4f10-811f-f117162ba552", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305345, "uuid": "7d0c6221-2a42-4839-9ca7-b7d4ff078530", "value": "24576:x5EmXFtKaL4/oFe5T9yyXYfP1MAXDzLXpK/icobfO:xPVt/LZeJbInGizLZUJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305345, "uuid": "ad2160e6-d388-4241-a8d6-8b299a5d1f7b", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305345, "uuid": "6dff2682-cb08-416a-b718-0ba6c279dd93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305345, "uuid": "08f36427-aaf3-47f8-b79f-fd80df7438bb", "value": "4f373533a0324e13b5cd7764cab27bfc7f41d4e86734ea71218fe18a59a4fa7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46e70db-0231-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770254846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254846, "uuid": "3e3e6dee-a529-49ab-8125-87bbc4ca01b2", "comment": "Malware payload (Mirai)", "value": "9467fc56dff5f78f8f691b9c0296a146", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254846, "uuid": "f1e34949-8182-48f9-97a3-9d54ab61f9f0", "comment": "Malware payload (Mirai)", "value": "4b1259e69ad6c6324d7b67591d3cf49453e251c139ff1e12a3f00a785704e9f6", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254846, "uuid": "17d1596a-1bac-4448-a372-fbdddfdca415", "comment": "Malware payload (Mirai)", "value": "6bff5b08f026a94a1a582e23b2176f23d03977a2", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254846, "uuid": "4b21cb42-d2a3-4247-85d4-508d4aa50a94", "comment": "Malware payload (Mirai)", "value": "c1d1f6284c981fc2d0aa54fdd500427a5c39f39cad597299ba422f816949c37e26b159ac4958fd5cc362825a13a7c1ce", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254846, "uuid": "7ad4b358-79e2-4bca-ba66-91fb263c88aa", "value": "T186043C03659189FBC4D6DFF91BDB95128933F8392B32220AB798BCE51F0DE946E1D214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254846, "uuid": "17b29d40-bb0f-414e-8ed6-9f16c8521afa", "value": "3072:LwB04VMozdqOMyJKUayTrqCT/mAiCHmOHnd4wvnOp5EHhO:LWnzvwaVqCHmOHnd4wvnOp5EHhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770254846, "uuid": "ed5ab6df-3028-45c6-bb55-4aff356d2273", "value": 176381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770254846, "uuid": "1c4d8b08-efd6-4914-97aa-bed8c191d2f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254846, "uuid": "b82a6ec3-dedd-4b07-9665-5a21178ab3dc", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c208c0d0-026c-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770280156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280156, "uuid": "7d29b371-cdb6-4a35-8e1d-63a43a71c7d5", "comment": "Malware payload (PhantomStealer)", "value": "4054bc777759caeae4b107713a8e1a05", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "info-sanitechsolutions-com", "colour": "#CA985B", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280156, "uuid": "868cd94f-0023-4e0c-9cd8-26eca404161a", "comment": "Malware payload (PhantomStealer)", "value": "4b250434bed12ef47cdaea60072ffb83c48e94d873dcbfae378620499d2ec13b", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "info-sanitechsolutions-com", "colour": "#CA985B", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280156, "uuid": "44f38908-1c80-4557-9ab0-7747363274be", "comment": "Malware payload (PhantomStealer)", "value": "1e73b11e09bd1b2709a45fa0af3a526d91f437c5", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "info-sanitechsolutions-com", "colour": "#CA985B", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280156, "uuid": "1be74168-d235-4087-a205-b1cafb9a162e", "comment": "Malware payload (PhantomStealer)", "value": "74e386364976608dca457976249f94f4619888dcbb679e01c8f9c0b5c10c0394bcea6d4c0f41c281bed9a65ced7310fe", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "info-sanitechsolutions-com", "colour": "#CA985B", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280156, "uuid": "cdee13a8-8b1d-4f6a-9170-e23d9c7768e1", "value": "T1CC061110CA06CE95065C925860AA1ECB26100EB74C14776A3F9F5F8E0F6FA5FD4B62FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280156, "uuid": "dbbad0cb-38b0-446d-97d3-f44013748743", "value": "49152:NEa48a4UTqg8jcp7rkyI90HLdYdC+AL4AVgy7zm:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280156, "uuid": "46864269-ed37-4f60-af4a-11873fcffa43", "value": 3725989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280156, "uuid": "2d61f868-7b01-4a6f-8a4f-f7ffd20abc98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280156, "uuid": "c8624662-59a1-4222-ac6b-04eb50f2d3a2", "value": "arryaaaaaaaaa.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3678e1-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770307179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307179, "uuid": "3908d453-28bb-4de5-83c9-a57edf871b94", "comment": "Malware payload (PhantomStealer)", "value": "8e99af535473ada7902d1c9f6cc1be94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307179, "uuid": "6431f075-1d78-4b15-b48f-d04086d03839", "comment": "Malware payload (PhantomStealer)", "value": "4b2c011ecbfda0d65b5af0c997d7cfff27384f22180ded716deab08b9abf7304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307179, "uuid": "3396f868-cc3c-422c-bda8-ea540a69496b", "comment": "Malware payload (PhantomStealer)", "value": "a85be6e30630bcd5a4324aec2a927c0818b8096e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307179, "uuid": "3e518735-d199-4a76-aa3b-eff50df86d95", "comment": "Malware payload (PhantomStealer)", "value": "7da73296be402d64e07fb8500fafa71a9bbd60cf871476b2123dc5ac57ab136306b482ed104db46c8cda9f86b7ea4180", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307179, "uuid": "4ac91a6b-bf69-47d5-9a73-5804eccab3a8", "value": "T134F4DE6873F81A01F1FF5B71A4B59951AB34B513A9A1D71E15C080CD0EB2B918F8AF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307179, "uuid": "677b9f85-5cf9-4800-9b45-da41cc9cece3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307179, "uuid": "e4a1b786-9af3-4fa5-81a6-507d098c406c", "value": "12288:p9lsBGtikqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQabQLdlLUwi:p9lCkqjVnlqud+/2P+ATAS/JYeSlLUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307179, "uuid": "b61ca9e5-1d40-468c-93da-67777e8d2f9f", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307179, "uuid": "bc2dc37b-3318-40de-b331-cbeb11fa821d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307179, "uuid": "64c18750-95d9-410a-b664-5d5b9ea7851b", "value": "4b2c011ecbfda0d65b5af0c997d7cfff27384f22180ded716deab08b9abf7304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667401d3-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306631, "uuid": "e9e142ff-181a-4604-bf4b-886ae4fe065e", "comment": "Malware payload", "value": "0fbaa8040209253acae1bf14f056fd25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306631, "uuid": "f892618c-2624-4d1f-b0db-9f6bf6352544", "comment": "Malware payload", "value": "4b77022bcfa06abb99386e4c80cb75baf767dc449a45f8ffbb5e1dfdadb9348f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306631, "uuid": "23ad5d92-710d-45ec-af75-5f217dae0e87", "comment": "Malware payload", "value": "6aac4e6a9f59ef596e9996e75265f81a560925c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306631, "uuid": "fc785008-6bb1-405d-a859-b99e6c043191", "comment": "Malware payload", "value": "2eb5121f71ebbf2514ca6995cf3a81b96a857bbb16e3108277746cf8bcd39760fd0949a29fa4a002ad13f01eaad39310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306631, "uuid": "0700c923-6741-4c4f-b740-b88230d5e900", "value": "T17355CF0273C1C062FFAB92734B66F6115BBC79260123A62F13981DB9BD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306631, "uuid": "c4581ea3-269f-4841-92c2-d38a46a7f680", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306631, "uuid": "894b0798-4b06-4ce6-a52f-334196e7e1be", "value": "24576:k5EmXFtKaL4/oFe5T9yyXYfP1ijXdaf+9ZBo1Fvce7s9QmlM:kPVt/LZeJbInQRaf6ZBo1Vs9Qm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306631, "uuid": "1e615f68-76af-443d-bcff-147f0e372eb5", "value": 1341952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306631, "uuid": "dcd9024f-d07b-4a5e-bd60-9959e76cdd71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306631, "uuid": "e5606b36-ad34-4ea1-b0ed-f7be8ca20695", "value": "4b77022bcfa06abb99386e4c80cb75baf767dc449a45f8ffbb5e1dfdadb9348f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481a7a7b-0268-11f1-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1770278233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278233, "uuid": "8469850b-016d-4bc6-8048-4fe7c9e34ab7", "comment": "Malware payload (SimpleHelp)", "value": "caa2949205c1dffccf8ee1a77d4f3bff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278233, "uuid": "240e3c88-9401-4284-93c8-90b6f6c98f7a", "comment": "Malware payload (SimpleHelp)", "value": "4c157152266def1d6212eb8400e297a389cc5edeaf667d7ff523689bd2a14cf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278233, "uuid": "f29f302e-ed02-4369-b483-754a902d014d", "comment": "Malware payload (SimpleHelp)", "value": "d6f1a8aa3f94670487c58cc2c01dcb996552a96a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770278233, "uuid": "b43fea66-eaaa-4b23-8eef-b4d74dc3fe34", "comment": "Malware payload (SimpleHelp)", "value": "d4023582e5d6b2be4f549b8e55ce257b9a7b86a9905c9080aedbc786ec83568c1f4f7397780b1af296ae0d55fa0a64d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770278233, "uuid": "e5788863-cf90-4e00-9d97-fc0118b66ead", "value": "T15585C034E6A15DBDCF37AAFCD08E44DB979BB9A203C5012717F086D68B613D0542EE29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770278233, "uuid": "ce38b708-1f91-4555-95f2-643a7d434d8a", "value": "8e73f0b1ba8e9ea271385585fb4d5c02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770278233, "uuid": "50f5726d-1116-4411-b736-dc5ae33735f9", "value": "49152:MOlCQ8msodjHF2bg2h0kSKX15dIpRkud5ou/bth:PXJrVRR75ou/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770278233, "uuid": "16cf8b81-7311-4d20-9989-84459c4e49bb", "value": 1721928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770278233, "uuid": "ce1d3b21-dd63-413f-b045-158df4cb8a38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770278233, "uuid": "9d1ff7ed-a649-44d3-8d81-29f013ea5bf5", "value": "2026pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d126ba60-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1770303803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303803, "uuid": "acae7050-e6a2-4139-9d3c-003db20c325c", "comment": "Malware payload (DarkCloud)", "value": "039d3ed581a75ae7f85a38aeec34bd52", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303803, "uuid": "40b00004-f0f0-4d66-b240-ea4dcd459f47", "comment": "Malware payload (DarkCloud)", "value": "4c4a6b192a29dc870b65acb1c3fbbdb9dc0c323bca79e64b33705018acdf2b2b", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303803, "uuid": "7a8be555-3c13-4514-8878-74ed8929368c", "comment": "Malware payload (DarkCloud)", "value": "e45a2f3cd1520f7005ce8280c8772ec9708b8189", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303803, "uuid": "b879a53d-e385-46ab-9661-fe90d94939a8", "comment": "Malware payload (DarkCloud)", "value": "08ea338b0aef9cd00d05a269c2f1d7fc71cf0a550c51966fb511ad563f9bbf4ce3b143f3ad24b6bc117e23ab75eedf21", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303803, "uuid": "d37765d0-8f91-490f-8136-fc07faa42824", "value": "T167150125239ECA02C5A45FF41971E2748BB97EDEAD10C25B8FE6BDDB7932B145880343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303803, "uuid": "efab10cd-c998-40d1-a77e-3e536b7f2a0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303803, "uuid": "6ee6d36e-40a0-40ef-847b-006ee91937cc", "value": "12288:rhaXITnp2vukM54SAOkmvlO4zKgrdgw6kNSUS4n6S5jgJxlMk5SVCbVyFEF:tLr2SA86Tqn6S5jGlMEbVya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303803, "uuid": "aabe95d7-33e0-46a5-b485-3b8708ebf52d", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303803, "uuid": "c6ab210c-e62d-4e9b-a0e3-b06b519a74ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303803, "uuid": "f9a76d2d-c949-4165-9049-334ace035972", "value": "4c4a6b192a29dc870b65acb1c3fbbdb9dc0c323bca79e64b33705018acdf2b2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc043e46-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770307687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307687, "uuid": "15f95be2-f7c7-4983-9a21-88db8b0676d3", "comment": "Malware payload (SnakeKeylogger)", "value": "3a075158f5b80e9684eca260ac594cd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307687, "uuid": "7f889932-7291-4513-9556-2b236b125cb9", "comment": "Malware payload (SnakeKeylogger)", "value": "4cae3a50c0a3809452f6e22312c6d0f6b0a15ed509f88649ac344ed7d730cc05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307687, "uuid": "7fe355df-7b4a-4332-9729-4a36e4f3d92d", "comment": "Malware payload (SnakeKeylogger)", "value": "e1c25fe22edd45df8fd938a1899c7cc52a7ff327", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307687, "uuid": "d5456f95-2594-4a99-adc5-09539937767f", "comment": "Malware payload (SnakeKeylogger)", "value": "6b36f851901ec5531c844d4e380bd321e31fcd325b197cce15aaa64fac5ddc8784a7a103ff2bc8fbe68871a27458374a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307687, "uuid": "5d089109-c28d-4165-9172-6f71f7d658dc", "value": "T13225121CBE9AA603CBAC0F77D543510886B6858AE223F7791BED1DE20DB1F00C51B693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307687, "uuid": "f1a24ff6-d9ad-4f2a-b70d-1d3c6e209f5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307687, "uuid": "f88f2dfd-4b47-4bf6-9787-0a241b73b679", "value": "24576:BLtLpdx8dh9omoN06/STyIFxh7xhb+4mfDPS8ie:vLpv8GmG0gmxh7xh64mHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307687, "uuid": "31ea7acb-4b36-4505-a342-96b59cf25b10", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307687, "uuid": "eee20f96-1e07-474c-9fde-ea390866134f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307687, "uuid": "a7147216-e38a-462c-8ae3-59c2ca674d20", "value": "4cae3a50c0a3809452f6e22312c6d0f6b0a15ed509f88649ac344ed7d730cc05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83feafed-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303674, "uuid": "c08c58b0-cb63-40b6-9ea4-ed1a8ca9e417", "comment": "Malware payload (AgentTesla)", "value": "1bbc410d44644d9e5a73882195531494", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303674, "uuid": "80dc9f24-650d-4d15-92b7-e5b709e020dc", "comment": "Malware payload (AgentTesla)", "value": "4ce42f872a55b78f937b36fc38968788eb0db778a8a9e4cd2bef5db79c2b4f2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303674, "uuid": "d271149e-3b8c-4639-a37c-957acac87634", "comment": "Malware payload (AgentTesla)", "value": "9bdc63bab838255f210ec6f4a90802d2ae90a4e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303674, "uuid": "127ba302-5cd8-4650-a5fd-3e26e53a655f", "comment": "Malware payload (AgentTesla)", "value": "cb70cf9acc233831e2711294774f7b295e2de55ce90d8f75a69ceafb3331cf210aa0d7ccbcbb496c4310764efb37689b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303674, "uuid": "445541fa-5f91-4616-88b3-2ad03422d111", "value": "T10FD4229665C1A820C1546330C436CDA889383DB0AD12B76EC76DE5AFBCB13D3EA3665D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303674, "uuid": "35b2279c-a322-4ed4-aa42-7f03a8d745b1", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303674, "uuid": "7cf769f7-8bc3-446f-9eec-95128ab2b527", "value": "12288:bz7hU5I5yuNHIgzSFKxWltRohBfSTso93U5wj5/p/GMXv2NNxQevB:bf+iN57Gtene3gQ/pj+NNievB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303674, "uuid": "d0bb291e-87e2-48e6-8290-260bb8cf3a90", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303674, "uuid": "f543bf96-deb1-4d73-a7ff-eeadb86ff4ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303674, "uuid": "85fe2620-9aec-4a99-8e2b-b3fb33ef04d8", "value": "4ce42f872a55b78f937b36fc38968788eb0db778a8a9e4cd2bef5db79c2b4f2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62cceb7-02c7-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770319300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770319300, "uuid": "c8695eba-a502-40c3-89fc-b60c6ca48a7e", "comment": "Malware payload (AsyncRAT)", "value": "e7842742c19d8945ef3ed52d34b6650b", "object_relation": "md5", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770319300, "uuid": "e483bacd-4e4f-4c44-9db1-d5064ea52219", "comment": "Malware payload (AsyncRAT)", "value": "4d70749c8ac5a6a7040c99716ac58f28b2ad0f7fa0b83a02a86784f1fbe2cc06", "object_relation": "sha256", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770319300, "uuid": "7547ac84-270a-4ede-b7be-a9100e1f69be", "comment": "Malware payload (AsyncRAT)", "value": "78a496740f3f37c2112248768bf5db6045144a49", "object_relation": "sha1", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770319300, "uuid": "f666d818-aed1-47a3-b045-5b631449880e", "comment": "Malware payload (AsyncRAT)", "value": "fe99e3784bd3ffac54f3263816ce90a4d278c74c61e3ca602927a2bd73cc0346d92fcc6364aaada69c810042e30be909", "object_relation": "sha3-384", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770319300, "uuid": "6ba8f884-b8a3-4b13-b8b8-fa999f1162c5", "value": "T1D0231A0037E8812BF2BE4B7869F26245467AF6732603D54E1CC451DB5B13BC69A43AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770319300, "uuid": "040fef00-2910-4bef-ab02-2482853a9be9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770319300, "uuid": "cad22117-28ff-45dc-bd2c-5075c3b19226", "value": "768:FugnNTjgkH7F7WUHF9pmo2q7IL5P02FUFdxYkk8PIgzjb6gX3iiTGOt8cR7ivBDG:FugnNTcIb2TLDmWBg3btXSnCFR7AdSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770319300, "uuid": "069fb53f-e656-4658-aa33-3f433ee8c174", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770319300, "uuid": "addeceed-04a8-4c23-811e-2772e733ec7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770319300, "uuid": "e206f6ca-1d8c-42c3-8d65-b979367bd9bb", "value": "4d70749c8ac5a6a7040c99716ac58f28b2ad0f7fa0b83a02a86784f1fbe2cc06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0ffbf0-02ae-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770308331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308331, "uuid": "ef3e22f1-e460-47ca-9dbc-e0c462720eed", "comment": "Malware payload (a310Logger)", "value": "36877f28b927d75227dc3bd2741bb5a4", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308331, "uuid": "e065b7e1-8d51-4141-b1ee-c1560dd2ee31", "comment": "Malware payload (a310Logger)", "value": "4d9d700211293b717f4f81e873e82fd57754ba880666ed1f214b67f4e0ac796e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308331, "uuid": "c328b527-6450-4ce4-88e3-bb6af9cc5177", "comment": "Malware payload (a310Logger)", "value": "c7078fe72800734501de2ba194f5a46c6bbb8e52", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308331, "uuid": "722a1132-dd31-41e0-bae5-6266ded4e833", "comment": "Malware payload (a310Logger)", "value": "7a6fd9fe4951d52bab6a925cbef5eb65d2475415e2b4b9bb3c8769e79e0be7358a2d4b3c0b30cc5af53d7f37726017de", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308331, "uuid": "593fb5b5-b989-4ace-bf26-d376ce418f4f", "value": "T18255F20A07E546A8F4FECB34D3B8006593F0B59BD625E7AF690D51F49E22B46E603273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308331, "uuid": "03d70547-d13b-4f21-ada9-fdf1e7f08252", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308331, "uuid": "76bf7c5f-a9bf-4dfd-964e-810cb6bb0d31", "value": "24576:AF2RRHGAWq6/p3ojZP6pojZ6tm48Ya1KObEN3:l5GAmOdP6Oj94p8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308331, "uuid": "8df999d2-d814-4284-b490-b78623a59067", "value": 1307648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308331, "uuid": "413298d6-ee17-4344-b48a-c0c2c84b3108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308331, "uuid": "76c8a9bb-581b-4c87-8498-1c57844f1730", "value": "4d9d700211293b717f4f81e873e82fd57754ba880666ed1f214b67f4e0ac796e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f82584-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770307727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307727, "uuid": "9f72c4bb-2052-4d2f-90bf-75f23180549a", "comment": "Malware payload (GuLoader)", "value": "ff066bc0fc47e21c9e8de11b8d23dcac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307727, "uuid": "7a2dc824-86a4-4f62-8725-c4af6a94fc03", "comment": "Malware payload (GuLoader)", "value": "4de64ea0b588837773c8b257af5a90a1636f61c99b3955016ee0beee3f85212c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307727, "uuid": "d3f4c7d4-e9dd-403c-952b-d2c0e9f95501", "comment": "Malware payload (GuLoader)", "value": "8f4ecc97e6eee8b8b591a25e0b21c44a70b7eeb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307727, "uuid": "35f49048-c0d0-4cb6-8e28-964ab16be6f4", "comment": "Malware payload (GuLoader)", "value": "82424f7ef24beef41c18bd2f1f17ab62e2c39be56d631be96b34da02313d4b25a2195321c5b8c78aea27d1111667c239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307727, "uuid": "4d28742e-c7be-4fb3-b712-3b5c229f7146", "value": "T1B2E4237336718973EA931A7084128FF73DA6CD22146071772390BA49FD75AB1DD2E346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307727, "uuid": "488d566d-e753-4c44-ba77-4ed4e6ff2750", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307727, "uuid": "36d762b0-be88-4f26-8208-9181490ea52d", "value": "12288:3BNUqfqIw7zGGYtvwSGRk0OobvoE5j4RcWaKIyOiy3P:XBSFTY5gReGoG421ey3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307727, "uuid": "4cc84556-6f34-450d-8801-46923e4231ac", "value": 663048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307727, "uuid": "5b60b34b-42af-4a2c-bc4b-7dc2e8cfc438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307727, "uuid": "863ad1b1-19c2-4b5c-88bf-00367e05a0a2", "value": "4de64ea0b588837773c8b257af5a90a1636f61c99b3955016ee0beee3f85212c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b795d9-027d-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770287171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770287171, "uuid": "962f4036-e3c7-4a53-88c9-14ce0fa943dd", "comment": "Malware payload (Stealc)", "value": "8186eaf06f47d78af7ab8082ab64b3ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770287171, "uuid": "59bd56db-5320-4a61-aab7-0f5286317a27", "comment": "Malware payload (Stealc)", "value": "4e330342b5f5050bcda28cef53c3cae669ed8dce5a4c7815b4c2d79e9ad091b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770287171, "uuid": "1e5290cf-e914-4472-8ef1-632f726148aa", "comment": "Malware payload (Stealc)", "value": "88816f54af72f1ffab473a57202cc92a813de5f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770287171, "uuid": "d4aaf998-6640-43e9-8e05-0de8286df6cc", "comment": "Malware payload (Stealc)", "value": "279dd31d3a04eda1df369004a9f743ed0711d146ce960a8363aa0333d3c7eea9ce56e4c537f9eb858a533a787366af4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770287171, "uuid": "f04b57e4-fe20-480d-984c-62dbb539320c", "value": "T142F48D5AE7A602F9D0BBC178CE424553E7B2B8155370978F03E15AA61F372A05F3EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770287171, "uuid": "a6d498c1-9e7d-4942-891e-20f537814406", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770287171, "uuid": "779e1cd7-8f2f-4029-9570-ae18a5d4e7bb", "value": "12288:MU8VHX4ZPBuvzkOkW7UE+YTRqwJ4iQti6ALSQTbAK4lVA4:GVH6BuvbkW7xXVVm1izQA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770287171, "uuid": "2d93d5e4-929e-44fe-a562-e7e930b86599", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770287171, "uuid": "6e5752ec-61ba-4cbf-af4e-e005c5a0a06d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770287171, "uuid": "36bfe277-e445-4176-a481-430509137f79", "value": "x4e330342b5f5050bcda28cef53c3cae669ed8dce5a4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7310f14d-02ae-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770308370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308370, "uuid": "517ad6cd-a9bc-43ad-8766-407941641e90", "comment": "Malware payload (DarkTortilla)", "value": "4266fc97c1a250cfa9fdc5dec1ac5ee5", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308370, "uuid": "9be28dae-2622-4b37-92a6-c3639e34fdbe", "comment": "Malware payload (DarkTortilla)", "value": "4e351a7ca7fb4a59daa108005a7a88c274d5893d7a490c48323f3ce42ab95acd", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308370, "uuid": "874e5910-b917-45c9-a40d-792f112e9d8c", "comment": "Malware payload (DarkTortilla)", "value": "1565408b13f7d28c915afa220956f48b2e62317e", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308370, "uuid": "d5b91fca-0ac1-4dd0-8b81-e5c273c370c6", "comment": "Malware payload (DarkTortilla)", "value": "d617bc2002aad9dbcba9750c30862834c8aad2e94e1651e62c0fe0bdcea247f55f88264286154b48f06fc23e33be60e1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308370, "uuid": "d9902ec0-3e0f-4eda-a401-e70437fe9596", "value": "T190E4DF0A13EC4669F8FE87789574112187F4F896C236EB6FAE4D90F41D32B90DA56323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308370, "uuid": "599f3088-909e-496f-94c4-62af532c82f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308370, "uuid": "21d89e86-5080-4157-8137-061fc32cba2e", "value": "12288:pQF0BXNjJ+iazMA84SVJDypS1WcHgOhH6/pXHMNR3j6YdAyPGhDZHCqih6z:iFrsRHGAWq6/p3ojZPGZi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308370, "uuid": "93e12bba-e666-444f-9895-02ed6ef0e4d6", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308370, "uuid": "56f55a1f-c362-45ce-8e5c-bb98ef94c64e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308370, "uuid": "0b9e1243-38b2-4301-b251-cf322caefa69", "value": "4e351a7ca7fb4a59daa108005a7a88c274d5893d7a490c48323f3ce42ab95acd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45030388-02ae-11f1-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1770308293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308293, "uuid": "2b62a2b7-5335-440b-ac26-36db814ec5e3", "comment": "Malware payload (Adware.Neoreklami)", "value": "d46c6bf004d80c4765747e4d05d0a5b6", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308293, "uuid": "77d7b26a-5d3d-42d6-87a0-ea052e60f4f6", "comment": "Malware payload (Adware.Neoreklami)", "value": "4e61f3cc656983855c523afc28a5c66c12c18344d25fbe74c6ee3d9868a1b23b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308293, "uuid": "5a2a825a-9716-4b3b-aaab-aa7c9c188f48", "comment": "Malware payload (Adware.Neoreklami)", "value": "dd44dc02ebb2163ad5427d28dbf337b0ebded369", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308293, "uuid": "8b62cd89-67f5-44cc-af39-e5bea217bea6", "comment": "Malware payload (Adware.Neoreklami)", "value": "468ac11a14281c4c0d3c5d218ddbd9d6e39d754a60afbea7f1ffa9970316f91f188aacfa577330f60f38a4b1812eb444", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308293, "uuid": "29ea4222-1521-4b6a-9a2c-633b77e3109e", "value": "T1C2763360FBC1CC75C0004D369E4ABFE1F2FF092549B089B376695A5EDD38A434AAF619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308293, "uuid": "eceb960c-891e-4aec-9b4e-77e9445b9174", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308293, "uuid": "031e8022-e66d-4613-ab5e-c4ae86264683", "value": "196608:P1OSUTUZEt1NOmbrsJHVI6vQMS6TBWyIG4BrPHIlQ5QC8Fxfp4Z:tOS2riYsJWEQMSgYyIGMGQT8Fxfp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308293, "uuid": "580438d4-82a7-4586-ba2c-8bdc75d510b5", "value": 7543725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308293, "uuid": "bf95e8be-d385-40a6-9e60-b5972f3e3e32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308293, "uuid": "7a7ae5e5-9ab5-47cb-9c1a-2786c98b4cec", "value": "4e61f3cc656983855c523afc28a5c66c12c18344d25fbe74c6ee3d9868a1b23b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e13e13-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305178, "uuid": "3fdb4dab-f7cc-4ed3-918c-2f2d33dd383d", "comment": "Malware payload (AgentTesla)", "value": "b471218c84782ee5c5e04d2d6c7ecb05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305178, "uuid": "108acac8-7ccb-49fa-a5b3-46bf664773b4", "comment": "Malware payload (AgentTesla)", "value": "4f373533a0324e13b5cd7764cab27bfc7f41d4e86734ea71218fe18a59a4fa7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305178, "uuid": "20b0b928-6c36-4e72-be80-fbef33ff3801", "comment": "Malware payload (AgentTesla)", "value": "fba3360932638d5bc1dfb95b80710240394bd9c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305178, "uuid": "8c794995-bd4d-4e55-b2d8-f3390e6bd858", "comment": "Malware payload (AgentTesla)", "value": "9a66a395d8e613414090e677c8cb37ed8ad6bccf4836a6619db4626345cb912bed9ff5517983a796c19dc45afd7a2e96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305178, "uuid": "4b7feebf-2c96-4117-8332-252500bca597", "value": "T135D4126A99C19951C15163308836CD904A3C3A30AE57B76E8B3DF96B7C713C3ED62B4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305178, "uuid": "ad829322-8b5f-4bea-9230-042cdf760f7b", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305178, "uuid": "cf95ba31-7fba-47df-89e4-27b8e88422e9", "value": "12288:Jz7hU5I5yuNHIgzSFKxWltRohBfSTso93UO0xDCRdHpKTeoJ2Pq8eobh:Jf+iN57Gtene37/pK/icobh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305178, "uuid": "d6ce5243-885d-4f70-8aec-d8bb807253d2", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305178, "uuid": "437f6544-a55d-4a98-a88a-375a9ffe2e8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305178, "uuid": "ed43c952-d6cc-4c05-ae6e-f2f2f4d47bbd", "value": "4f373533a0324e13b5cd7764cab27bfc7f41d4e86734ea71218fe18a59a4fa7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5a0c12-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303470, "uuid": "73081163-be65-4b36-a6e2-681ce2827a2d", "comment": "Malware payload (AgentTesla)", "value": "b51d883dab9ec139b21001040078b348", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303470, "uuid": "9dc23ebb-c67d-453a-9288-859882f0242d", "comment": "Malware payload (AgentTesla)", "value": "4f3ec11e21c51ccba5632b9dc1cf5b6da6d5eedbc5cdada85de4d1788effc6ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303470, "uuid": "705ad51b-9ce7-4b07-9d61-8e4ef6ef4256", "comment": "Malware payload (AgentTesla)", "value": "50771d59e776f11e7414b883544f15eea87ed7d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303470, "uuid": "b8c0f580-4574-42e5-8ca4-6e6de9f87457", "comment": "Malware payload (AgentTesla)", "value": "452993311f55a37bc7551339b49122134a1dbdd54c7bfceb5a0f253b01f02335cc3627aa26c31859a305123f82729451", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303470, "uuid": "b25e123c-734e-499e-9e72-af44541ddbef", "value": "T10AF4235299E0CAA1C2557330C034CC94D6747C70AC96B7BA833CE5AFA874393DEA761D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303470, "uuid": "989f9f16-5fc2-4c03-8de8-213b5c8556fd", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303470, "uuid": "14eaac89-cc7e-41a9-a311-2585396f5b5c", "value": "12288:/z7hU5I5yuNHIgzSFKxWltRohBfSTso93UVyrYONJQA97jNu6mikD/9L:/f+iN57Gtene3OKfbHFu6mbD/9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303470, "uuid": "6f0f5311-17b0-486a-9096-9ad2fa86065b", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303470, "uuid": "9318cdd2-abd6-46bf-af1b-e39cf83749c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303470, "uuid": "a5b18d94-6088-4cea-b6d5-7a42f3064091", "value": "4f3ec11e21c51ccba5632b9dc1cf5b6da6d5eedbc5cdada85de4d1788effc6ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adea9131-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770308039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308039, "uuid": "70f16bf7-336a-4848-8cff-4221d7dffe91", "comment": "Malware payload (GCleaner)", "value": "99a79e400df194d1c7f65acd808b5aa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308039, "uuid": "66181ef7-857c-48be-aa31-04a7b0caf6c6", "comment": "Malware payload (GCleaner)", "value": "4f45f14f7539804220fdf88714ae0bffc5d2d9a728c43fcdda8c218ca2e8719e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308039, "uuid": "442dd475-64c7-456f-912e-9fe8e1f35d72", "comment": "Malware payload (GCleaner)", "value": "d4940a5c90ddab8709973f3769eeddb32288515f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308039, "uuid": "fe46c4cc-621a-4577-920b-dea63734e6de", "comment": "Malware payload (GCleaner)", "value": "505e061be1b8422e374f4d2196ef598c7a3858533ce2fdd56fe5c6fe99604b5760c132eee15e70fd9678a06969103cdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308039, "uuid": "c51b0fdd-ae99-4daf-b8cf-b7f0f0da336f", "value": "T104E49E32F5B0847AE1731A79CF1B9664583BBE98393868493EE83DCD4F753813426297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308039, "uuid": "f7247891-2d4d-4d5e-9e15-066cbba6137f", "value": "07f608b4818de60660a6d587f85c6c18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308039, "uuid": "e3aa4a0e-f80e-4cbb-a31f-a8c25be45697", "value": "12288:FTYcy8yZ08zaVh6E3DXDuUl20bbzDiAXL8zzcrXWtG:FspV/YdmUlPozzcrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308039, "uuid": "503fcc95-61b5-41de-b6ae-ffa8faa87528", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308039, "uuid": "929d5523-493b-4a0f-a61d-a7eb6d802fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308039, "uuid": "826954e8-d83a-4d5b-9d70-1d8becec07d2", "value": "4f45f14f7539804220fdf88714ae0bffc5d2d9a728c43fcdda8c218ca2e8719e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d011c783-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305949, "uuid": "4c05e3f9-daa2-4d53-858d-a14444214c70", "comment": "Malware payload", "value": "809ea17ac7b1a9c4f9b84046ff66c188", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305949, "uuid": "5c24257c-85ba-47f8-9375-50827824e928", "comment": "Malware payload", "value": "4f91531d32926dcedac750f239ef2d135330b47b72f90d0fd90c4883047c4d67", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305949, "uuid": "304f719c-f843-426f-8c4b-041bfe3055a6", "comment": "Malware payload", "value": "5e2862bcc691c059cfba6d55c9c5fcedc29f67c7", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305949, "uuid": "d30b8a5a-1346-4901-9d17-88dcb2a79633", "comment": "Malware payload", "value": "f3632ec6ec7b9509471c982741b0f240185986592553d3853b22e0a515f65b082076fc1afd09cc208266b4ddb897f398", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305949, "uuid": "2e6b8483-1ab2-4fc8-b0f5-1f81d618cc0f", "value": "T1C675B0BC76047DE6266F176BDA96ACDD13B627239AC7A4CC806877C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305949, "uuid": "6c1cda08-29a1-449d-a965-f180d95c6c0d", "value": "24576:p69T7mWVh6mmqNNs8JJjOH8nBgAMf49HwGOeExZSIx1HyHssIHjPvU/VX/ZlZNJ3:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305949, "uuid": "622444d7-1982-438e-97a4-0bd2191be3d0", "value": 1571635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305949, "uuid": "04fc9a9c-e10b-409c-bd64-ae698b6cc945", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305949, "uuid": "158429a4-3f7c-4087-b140-d4c751a1cb47", "value": "re42.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98f19bf-02b0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770309320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309320, "uuid": "a3c974d5-a845-445a-a708-a4e70d0f8bbd", "comment": "Malware payload (Mirai)", "value": "f0276631b1c757d1db7398c34966012d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309320, "uuid": "985151b7-378b-4cbb-90fe-f18e2438ca4a", "comment": "Malware payload (Mirai)", "value": "4fa16890875710dead8bacc2b9db20a59e744d9bf33649ab55d807bbc590aaf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309320, "uuid": "95887409-7c04-4d1a-b310-6070bea6ce60", "comment": "Malware payload (Mirai)", "value": "65e56b11ea482e541b4eac12adae2c5dd4666ed6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309320, "uuid": "41076909-bc47-44e9-8858-75e9103ad31d", "comment": "Malware payload (Mirai)", "value": "8a18b9352fa0b4c225def4fdb05c321ad9cc3bcd8cd07218883e4ad36132508a6092ee69892dfd1489b10ca6396e1553", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309320, "uuid": "bd90fc4d-b811-4c36-9d54-d3be1419bd37", "value": "T128144911FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309320, "uuid": "4be747aa-1a11-4b98-a0a0-29533e65279f", "value": "3072:ty5+GoCEggi4NerYqltSwJpH6+cYstkiUat:o5H5BT48rYq1wjY2kY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770309320, "uuid": "8eb5d712-a3dd-460c-9886-a32e52575fe4", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770309320, "uuid": "31a8087a-0552-4197-8a5b-a5c1c5f1375e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309320, "uuid": "ae800a75-6ff5-483b-989b-5fd10b029ddf", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fd4053-02be-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770315270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315270, "uuid": "87bbad15-75aa-4502-abfe-4d7a2601d713", "comment": "Malware payload (Mirai)", "value": "a5708a9888fb597ce77b7c9e3da0c806", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315270, "uuid": "9425866d-84e6-4e12-8bbf-3b0d13e60853", "comment": "Malware payload (Mirai)", "value": "4fd631c791b99ec20662c4c4fd87390bb9e68140ba353b76a14dbef58b1a0434", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315270, "uuid": "f5c85741-5439-44d3-b47f-5621dfc0c36f", "comment": "Malware payload (Mirai)", "value": "dc3edbca85e6bba11a46447721bc9aff0775de49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315270, "uuid": "903698f3-251a-4eaf-8bfc-0155a202b221", "comment": "Malware payload (Mirai)", "value": "dbb0021aae719b271fb002703aa051b7b2d9303449ea007986e565d34b9c6ce4300726916f2a1a9ac327fd9a79b2907f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315270, "uuid": "b3a17dd7-a244-43da-888f-53824fe97484", "value": "T12EB31288B66685B1F52D8EF83CE241E66B995DD04A32180FED09B085CDC14DFADEDF12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315270, "uuid": "ee646e50-9031-421e-9b00-1da1ac58a1c7", "value": "3072:9Taj1ykWeMgG93Fy0jGPuWRiC2dw5kp1zNpyTKG6tV:haR1MDpHSlkCRKLN4KG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770315270, "uuid": "7b69d1a9-298d-4efa-bd4a-b828c2a67018", "value": 116340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770315270, "uuid": "125e3de2-f77e-4fdc-8ff4-59e7b8d877a6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315270, "uuid": "2bf90256-c581-4e8c-a92b-e50438d175cc", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c5690f-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770304698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304698, "uuid": "b64d3a4b-22c0-40d7-9020-361923d4d4c9", "comment": "Malware payload (a310Logger)", "value": "e3492e3f226937e47adda1c699a6a1ed", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304698, "uuid": "b522d502-5be0-45d2-9f9d-e168ab0086ff", "comment": "Malware payload (a310Logger)", "value": "4fead88e016935cd8360765dea5ec29ebb70c08f5d6756c329caf9b388d4a98e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304698, "uuid": "04da1a8e-b8c2-4de4-b9f0-0ed6cd9f3b7d", "comment": "Malware payload (a310Logger)", "value": "53de5389599204b6f24c6ba807145cafc23c657e", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304698, "uuid": "8c59c546-dc37-4a50-ab6a-0350d19204f1", "comment": "Malware payload (a310Logger)", "value": "6c937bc17c4ce4c925f6abe8358be42ea4513c6beb8a00356d117c29d5f4bacfc1c160b416cc3be467c02cfe5e5c27e2", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304698, "uuid": "62be077f-7ab5-4cbf-abc6-8e587191ddc5", "value": "T19155CF0273C1C062FFAB91734F5AF6115BBC79260123A62F13981DBAB9705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304698, "uuid": "f1d02e60-38f0-4e9d-abf0-0c41c064033e", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304698, "uuid": "797b1d53-a4e4-4525-a6c5-fc35d3adac7d", "value": "24576:J5EmXFtKaL4/oFe5T9yyXYfP1MAXDzVhYakC1+PuTHl5057mhAMU5dpJ+:JPVt/LZeJbInGizVNq2TEhmLU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304698, "uuid": "95f58fd1-1ebf-4039-b506-1a73dd531a07", "value": 1339904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304698, "uuid": "d60d00f8-042a-42ff-b9b0-f6df57057a30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304698, "uuid": "ef9a2ade-d4be-4426-b28b-76206ef26be6", "value": "937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cb48e5-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327210, "uuid": "277c2f28-1046-468b-86e3-e3b1f60068d5", "comment": "Malware payload (Mirai)", "value": "8c2e6abe5f213e801013fccba1b8d15c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327210, "uuid": "1701f870-947e-4e2c-87ab-7c14f7f15a70", "comment": "Malware payload (Mirai)", "value": "5060a03828ae9b87b5552685074d8260b036c58d08e750e20fce2fa812bd602c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327210, "uuid": "2eb27ca0-5db5-4ac8-82ac-7b20eb7db84f", "comment": "Malware payload (Mirai)", "value": "235b06d189eaeeb9f4d154bf8330a31ce7c3f185", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327210, "uuid": "88ab8480-1248-4ba1-b428-7917330c3f82", "comment": "Malware payload (Mirai)", "value": "ca584c6f04bd2de792b0e9682578549409aa298e447c587811c0bafe9dcd6b61579f03fc701d3f4c2d8e2ec3cee0a8fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327210, "uuid": "9115cd62-8358-4d45-95c7-121212dc2fb6", "value": "T10F03F15B8528FB16CF34C630EB6C47861BA819FC91BB720A02F10DB161D0F4D926AB97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327210, "uuid": "433d0b30-062e-4758-bd96-8a39d4d1a8a1", "value": "768:wstHVgnL7tthUQeo7kugRPOAxUljsUre75do9rSrcags3Uozq:wstHV47SPa8dF2VsUK75dqecczq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327210, "uuid": "76f5a555-daab-4c16-ba9d-580d44b03c2a", "value": 39940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327210, "uuid": "ace77d14-6fab-4e65-b10b-e2daabaf64b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327210, "uuid": "27d96829-791b-4698-95d2-63da4ae3cfe2", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44471975-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304855, "uuid": "b7bb11da-d00b-4d99-bfb9-9b287004a1da", "comment": "Malware payload", "value": "18069bea5fb070d6ff287612cfec26fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304855, "uuid": "c8ae8bb2-86e6-436d-a4db-ae37ae5947dd", "comment": "Malware payload", "value": "50681a74fd565805b9fa7d22dcb00ff4578b6821cdefb8c4d0f0da619f5621ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304855, "uuid": "34d2aa91-b213-4473-b6cc-f9460ee2ce28", "comment": "Malware payload", "value": "d18c0bba0ced3ffa930e2036af2e6b0b695f6468", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304855, "uuid": "6d61bbd2-3f96-4863-af9b-bb8849c15d14", "comment": "Malware payload", "value": "f82a2dbd5f987d64f682c98116b925c03b9a316b5a5d90aafcf0abf20113434adf1f6c1f02140135317f7e9d7c80687e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304855, "uuid": "7278b4ab-cce8-4ae2-ac71-ce3128931cca", "value": "T1013512C42AC8C910DAF603B51A51E37947B96ED5E920C657CFDD6CE73C607812C8D3AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304855, "uuid": "a82bacea-56e7-4be9-b469-91b7ff762716", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304855, "uuid": "79dcd65d-d6a5-49d8-a773-93bbda2acbfe", "value": "24576:x6u2mvtXzAFReskCun+cuAnJjt0PCiJRiiukwJwnvw:x6HmvFORmConj0+iukg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304855, "uuid": "b6450626-9a2c-44e9-ae80-742b8865ebf7", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304855, "uuid": "e2d6fc27-c1f7-48bb-be9d-3c328fa07778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304855, "uuid": "3ce24a80-2afe-45d4-b223-ccf59be142a5", "value": "50681a74fd565805b9fa7d22dcb00ff4578b6821cdefb8c4d0f0da619f5621ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23248932-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307377, "uuid": "22ba26ea-6b93-410f-8803-6ab130d3dcf4", "comment": "Malware payload", "value": "cdc0967e278bad9211ce5d03bfffe0f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307377, "uuid": "673d5afb-0dc2-4e0c-8a1e-1a718bb2880e", "comment": "Malware payload", "value": "5080325f1b68ad0f9af73374860a3ca7bcabccca2dd1fb2527683a63416de2da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307377, "uuid": "75d9ee16-1519-4594-b72a-72a5f84ef223", "comment": "Malware payload", "value": "ced823bf21f64b1e159835dcc19bc7d2b673c0c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307377, "uuid": "5ab52c19-50c0-46c2-8a56-6209eb5a8569", "comment": "Malware payload", "value": "6367c074d4787100c690d8d790773f11807cdefd8d603a030b6579e91ea5a7aba95adcd0d81a39230d60ac7d7cf55066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307377, "uuid": "87c8fa01-2e75-4922-9da6-a4a268f76cef", "value": "T134247B67A42CA7AFDEDA2F32ADDE8A2353A65FC4C991103E0C44730E3C671095E39566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307377, "uuid": "fc755445-80bb-435a-b709-d58b9012bac9", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307377, "uuid": "f9282474-0127-478c-9c82-21002ac3b924", "value": "6144:vynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g3W:anO56dyO7Wc8oNrRHwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307377, "uuid": "34df5738-6c78-4f1f-a052-988b739aa965", "value": 226917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307377, "uuid": "dbfa387a-fe13-46c6-94ff-1c4b859257ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307377, "uuid": "dd22af05-1d12-4cc1-9323-aa1066d7ad6c", "value": "5080325f1b68ad0f9af73374860a3ca7bcabccca2dd1fb2527683a63416de2da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c3f53e-02d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770326794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326794, "uuid": "a6e0e871-c678-41c2-bbe7-7d39370a8988", "comment": "Malware payload (Gafgyt)", "value": "a5db5dd2a6759bc628e6b0f27ca2d566", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326794, "uuid": "96dd10c2-cf32-4af8-b97e-214c693ecd56", "comment": "Malware payload (Gafgyt)", "value": "5087c8d21baf493a9b9b39daa0b2fd95e411b3cd36f1067ebe957e5a1e3a1ede", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326794, "uuid": "fec706c8-1a46-4f21-9f9f-1fe933f315eb", "comment": "Malware payload (Gafgyt)", "value": "dc86290fa47a6dcbd85f8d7a432990d176dcfa77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326794, "uuid": "0251e402-7e81-4901-8daf-985d7fbb43e2", "comment": "Malware payload (Gafgyt)", "value": "e17383041a6a3055dc7a35fae56a0874e3dd9cd84149fbe4e5db3986664c7f2c230920881a956feb543717b4d64ab02e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326794, "uuid": "47b25f10-8be4-4222-807d-2923b9ca0e86", "value": "T1D4833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326794, "uuid": "8550d349-41ee-41ee-94ed-c8f255977c78", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LwWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Y82oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770326794, "uuid": "c232b009-a2a4-475e-8f7c-0621355c339b", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770326794, "uuid": "b9fa7b77-993a-454f-9049-da08522dcc04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326794, "uuid": "fac0f42a-9453-4f3c-9848-488bbbb3e58a", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f32722-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327226, "uuid": "a9736bcd-8928-407b-8246-2b18738dca7e", "comment": "Malware payload (Mirai)", "value": "a54a3ab7e681886fde0aa707ec4cde9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327226, "uuid": "7b0ff990-2d0c-4606-8ac9-e59f4258700d", "comment": "Malware payload (Mirai)", "value": "509c8adef184b261713caaa05e70ae384ff5d80961bdd9e966ecc431eab9ea40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327226, "uuid": "6d7b2297-d39f-4615-a0e9-2cb2b4336f78", "comment": "Malware payload (Mirai)", "value": "d0e4629e15c2af559d0d77c39a69d1271e1a3035", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327226, "uuid": "26133582-e6ec-4d86-8dd4-28bbb1dfb812", "comment": "Malware payload (Mirai)", "value": "699122e6d4a3ea9a2e13a090fcd9db2782d8958757aae9a47cc48d7e40285342aed5ae0850042bafceaf35e3db9fa4fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327226, "uuid": "9cbfad8e-565a-4b13-98e4-8cbdbfa072cd", "value": "T16B03F215D61A924CE43FE3331ABC7D004825C17AB0D9416EFE587A8F5990F2DB92E2D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327226, "uuid": "23bbd1d5-12d8-4ad3-859c-d8728caedc8b", "value": "768:7N4qEpRhUFNm0sJL228cDVvv2BZosK3lEPVCeUnbcuyD7UHQRjX:xwMDsdp8cpX+KGBUnouy8Hyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327226, "uuid": "ab725efa-666c-4dbe-91e8-f85bad378096", "value": 40024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327226, "uuid": "70f359d3-ab86-4250-bd64-faec0e1dcdf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327226, "uuid": "50d0d746-0875-4d5a-a406-0c55e1f8cd8e", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b12f83-028f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770295159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295159, "uuid": "009acc07-ac98-49dd-8f25-66cf2e67cda5", "comment": "Malware payload (Mirai)", "value": "5ef645470c1c75a4d8e9cfde71ee2f28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295159, "uuid": "c13812c2-cc08-4de7-b80e-b6105c22909d", "comment": "Malware payload (Mirai)", "value": "50b067c596b71ad722eb676414b2f32ebbdc3d92ec6e00a8a91542612376de48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295159, "uuid": "ffbbb6fa-025f-4d29-bcf9-7221bb7aff8b", "comment": "Malware payload (Mirai)", "value": "7e8cfc2945ad2ab6b25b3026c1777b32acb0abe1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295159, "uuid": "b261783a-ddc0-4bb6-b1f2-52b07ec54b4b", "comment": "Malware payload (Mirai)", "value": "308f5794f89fa97b95e3577726fc5a1594f2420aca8e7de86afade376b30ec07d14db8a977920a2d40a1b11ee37386bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770295159, "uuid": "30c38067-372f-4f81-9ed6-11cfca72b048", "value": "T19C148E68FE8E78D2D2C7E37DAD4A0FA230277D749565C0B11A00A29FD5EAFD489D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770295159, "uuid": "4c2ea8e2-ea76-4b41-ba8b-8c2b44802078", "value": "1536:OYtdyYq3BANtiz4UoUWHyeCFbjKEdAStt8YTpQURvqL4dqiofCsHNNjzPx+P7d/8:/yt4wz4UJP8EdAxYC4qfiofCeNRzPx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770295159, "uuid": "b667c29e-d2b7-4102-a1be-25504e8ed880", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770295159, "uuid": "71a42916-65d5-490c-8236-c004b0fcaad8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770295159, "uuid": "38bd0034-e93d-4606-a2ac-3c4ab435cfa8", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218470d0-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770303509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303509, "uuid": "4f503685-36a4-4840-8863-65603b322707", "comment": "Malware payload", "value": "8a3d4f19d6a77d7b7e14df138c864c59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303509, "uuid": "4b2001b5-705d-48b6-92d4-2cf3b41f9596", "comment": "Malware payload", "value": "51060f9a2eb5025c7df8e1859a31ac41b8c8e944cb16352d5a6f8fc0c5facfe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303509, "uuid": "b39e96a3-9cfa-4994-a0ab-c1b728cf53f3", "comment": "Malware payload", "value": "009c349cc13509fa9698f6ddbe090a559db8a6c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303509, "uuid": "2a91d74f-4e2c-4c90-8956-b5d7e97e9436", "comment": "Malware payload", "value": "278b55b61c5011f641fce10f12d5183a1ee6d1ee5c1803f20c1038d03e5f8670a52c167f7f68e918254ea63fbb43b262", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303509, "uuid": "ec495104-93e5-4e38-9fa5-cb70af34f535", "value": "T1AD05235C564AEB11C39217F704F2F3B1A3741E9AD815E323CAED9CFB7909600B8946B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303509, "uuid": "bb215ff4-ccec-40a0-bfb7-629ab6676ca4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303509, "uuid": "9352ef84-01e1-4a70-a143-fba4eccdf88a", "value": "12288:8XBvVw/C02RsjItbdX7+owPlICW+1r2+oSiRxmYEtRwZG/iGjbnIrvMDwEvJuZVr:8Xwa8MJMzK+oqYEtS0q/r0DwEvJCtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303509, "uuid": "e22c45ec-bab9-4c77-b57d-c0446f448c34", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303509, "uuid": "e6279b7d-ec73-4e7e-a3ab-287ae1fdafc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303509, "uuid": "ef5c752e-d1eb-48b6-93d3-893bc13f8a21", "value": "51060f9a2eb5025c7df8e1859a31ac41b8c8e944cb16352d5a6f8fc0c5facfe0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7021b23e-02c4-11f1-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1770317814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770317814, "uuid": "71f83326-1c57-4b09-96ae-955b072f59b7", "comment": "Malware payload (SimpleHelp)", "value": "a13b9c8ed67415b83e8404f0acbdf0cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770317814, "uuid": "fa9b8992-6901-4988-b8f1-1cc69a30c6e3", "comment": "Malware payload (SimpleHelp)", "value": "514c57aa1a8b7fa47d535037e5496b3826db895ffad6ebcb680dfbc4864ed71b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770317814, "uuid": "e48a17ef-b698-4cdc-bc02-cc5ea4fd7d7f", "comment": "Malware payload (SimpleHelp)", "value": "881063f472c9be5f4f0dc18ba416bba38f0a2f1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770317814, "uuid": "59e62810-6375-4a71-bbd0-ccf85627f912", "comment": "Malware payload (SimpleHelp)", "value": "0d163229316ce538ac66c646f9eafdf394176eceec4dcd8a85eee33f521c6776b503ccba47cd67bbbb113cefd0f7ae3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770317814, "uuid": "a61eeb42-02f0-4a4d-88db-04c8054ad541", "value": "T14387331AF29599FBDE33D0FCC0854447EE9679E54382422717F085EA4E206E58A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770317814, "uuid": "4da7be96-b7ed-4064-a53c-3f8f616dc7b9", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770317814, "uuid": "4e562208-ed94-43cb-aa2b-1b7e8d4f6e9e", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1bl:/uRf+nAu2FuQd73XyFeDMnKTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770317814, "uuid": "4da88b5b-c727-4879-a091-a5ad31914419", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770317814, "uuid": "61c8e477-4a99-4f29-a85f-31731fc0a375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770317814, "uuid": "8dae3069-6f75-416d-8593-1b67f0e99227", "value": "514c57aa1a8b7fa47d535037e5496b3826db895ffad6ebcb680dfbc4864ed71b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3b47a5-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770303797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303797, "uuid": "6b4541e6-c29e-4d36-93e4-2e99be59669d", "comment": "Malware payload (PureLogsStealer)", "value": "031c02d5a95223074c0771eff6799cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303797, "uuid": "a0831274-418f-4327-93ec-684580f22750", "comment": "Malware payload (PureLogsStealer)", "value": "515638dc230a649284288bef533cb91f915a666b5380ecbe7703d28c0a0409e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303797, "uuid": "565050cf-b87c-45a9-be6e-16455c884839", "comment": "Malware payload (PureLogsStealer)", "value": "84a437ada773a6679b20fa2fe205e6715c35481b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303797, "uuid": "0266df74-e6ee-4f86-84d8-3ab0c7d82a5f", "comment": "Malware payload (PureLogsStealer)", "value": "5fd6152d76667948e6c35319caffcd6872e67b058f0a52f5fbc52f1798b705c8ae32da6c94d1e61c738093ad6099da88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303797, "uuid": "c44648a0-9a83-4cb3-bf3f-59c63129aa6d", "value": "T17CF40118261FD806C4A11FB419B2E3B89BB58FD9B941C607CFE53EDFF13AA581854386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303797, "uuid": "fe146a7a-dbe6-441b-b18b-6cdd02adbefa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303797, "uuid": "539fb802-c38f-4b3a-9803-094ea0259d7e", "value": "12288:W3ITnCtqwm6lf5PTAh86LqNv5x7Be5T9rKrPmI2IIFlRiCh5TL8WysQBF:72V1nswx745T9rYT0nlVNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303797, "uuid": "35318e22-6608-4130-911e-893686a70d26", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303797, "uuid": "aaa8c2be-4c2c-4726-b92a-82ee83746396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303797, "uuid": "8358c91e-723e-4328-979a-e1e79d0451b2", "value": "515638dc230a649284288bef533cb91f915a666b5380ecbe7703d28c0a0409e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6092c003-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306191, "uuid": "374e7c24-0213-483d-af54-d28a973c94cc", "comment": "Malware payload", "value": "85e29c1cfa7fe6e72b42c03c1913d442", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306191, "uuid": "d66980d4-93ea-452b-8d1e-249b0a1836bb", "comment": "Malware payload", "value": "5159bfa737000df0fa7fabe3cdc6e5bc6c87618401b5ecc2426eccad84abfcc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306191, "uuid": "4a5b06ae-8a6c-4973-afee-9b38f50e2d38", "comment": "Malware payload", "value": "5d65db3f6cebae3e49a3405c4b81860a35ae2d9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306191, "uuid": "5e024c97-c4bd-4c62-aa9d-ea6ad7943d24", "comment": "Malware payload", "value": "cb1616d7a5f4a51807c97bbbb7931d9d132587ba0a6789fc2a73b7ad88651a628caf5a23d8bd83d7f7780ab5fd1b4ca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306191, "uuid": "fa8bef8f-a78b-43f5-a13a-4c32d3e58a0d", "value": "T1B6A26F02B24094DAE58506321C7BC3F65973BC246F278E476690372E6D31E519B1FEAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306191, "uuid": "ae3c7fe7-65ba-4314-9926-cfc7ac11e6f4", "value": "8d162cbc7e2e56a9b395a94f110c275f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306191, "uuid": "066df987-d479-422e-9436-e5d0aeb46b81", "value": "192:ZkfmyABI0B+BJqXx4lpm6nprkV6lDHpJYgbEV9Ek4/OzAUOw3oHD:SfmNmzBJqKDteV+DJJYgbGKZm9Ow3oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306191, "uuid": "c160cd5d-0e54-44c9-b91f-08865211f5c4", "value": 22534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306191, "uuid": "b1a3ccd6-56fd-4be6-b45a-625d948b124e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306191, "uuid": "17e45f12-ae41-4b99-88b6-bfe69ab08e12", "value": "5159bfa737000df0fa7fabe3cdc6e5bc6c87618401b5ecc2426eccad84abfcc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c614f78f-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304644, "uuid": "1a0e94db-af27-4cfa-abbd-ec8b6486c052", "comment": "Malware payload (AgentTesla)", "value": "5873049e86dd07a560ca147a2b08aedc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304644, "uuid": "41fa54d3-e7de-43e8-b8d6-0655157f95fe", "comment": "Malware payload (AgentTesla)", "value": "519a55562c202e84170b1b174a1e94ef4d5ce9323620bd70238760a294b02a18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304644, "uuid": "dccf5f52-cd98-4157-8d0c-6632cdbfef0b", "comment": "Malware payload (AgentTesla)", "value": "3efae71ab85cb6fd09c7bfab437039ad3da78695", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304644, "uuid": "173b9b37-8dcf-421c-9871-04f52e9e5835", "comment": "Malware payload (AgentTesla)", "value": "c677675916bb670edb43971caea883aff30b48a03225e008aa02a79675e62953d83c9bf8f903f3475c3f31922ba24dd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304644, "uuid": "624568c8-0450-4dca-89e2-05432798c1e4", "value": "T138E4124272745853D9771270DCE39A381BB6EF5995AA220F3382BB013CB3687551F3AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304644, "uuid": "74ff8ca3-9fa6-41cd-9629-0e17fa880a39", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304644, "uuid": "2d6560c4-b709-4a27-a3d6-29fd1b862c4d", "value": "12288:irZ3v/6YiS3F/bcD4yhs2ms2xPfl18YXzl3SZ0h7TAgociQFqr7S+/ZP:ird/HjFAsj2p2Rz8YXYOpLowFUG+/ZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304644, "uuid": "a3eabbb5-39ab-4ec3-aecf-9fd8783c4f70", "value": 686608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304644, "uuid": "0db90e36-8b3d-4c88-bc8b-ac4d92e2304a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304644, "uuid": "d151a0ed-4bff-49bc-b6b1-242934951c06", "value": "519a55562c202e84170b1b174a1e94ef4d5ce9323620bd70238760a294b02a18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f9b117-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305080, "uuid": "92bbc3a4-2091-44ff-8cea-b2498049b734", "comment": "Malware payload", "value": "b182bce6659654661d8bf366f67d5071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305080, "uuid": "4ae1b09e-1596-4cc5-a897-ed585cca80b8", "comment": "Malware payload", "value": "5224c9d89382c808099072741c431710bc891d4122f928caa3108f9e9ad777b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305080, "uuid": "f32e6d1a-1cf4-4465-b656-b4a20535ddda", "comment": "Malware payload", "value": "dbbe8dd6c9b3619580548b6aa56c9f7639506239", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305080, "uuid": "c5389653-5999-4988-844b-4c3a7f756ff0", "comment": "Malware payload", "value": "feeabf8949772856d9a5f23948057350bfe5477312ea65f982fdcb079ed6a4679e383147f862b715907f5bd70a51f671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305080, "uuid": "c85eb9b1-7e57-4f7f-8d38-376ab0647756", "value": "T1CE94D516E660B126F99349B03D78A156792A3C392640DD0BB78EEF463B71983B1F131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305080, "uuid": "addf7f92-46cb-473b-8cc7-b11d47233425", "value": "53d87c1f4a419d40d3cc07fde2be7432", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305080, "uuid": "4f2453a1-0ed2-4efb-a8c2-2ad18de50e4a", "value": "6144:PlivMDjfKM2qibCPYwXPGCxdntY0gD6gw57TqKgfqu8N1rZ5X:NwqZYwXPGCxdntYkTqPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305080, "uuid": "8be50146-81a8-4224-b0e1-f155ac5b580d", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305080, "uuid": "0ac02c51-9cf2-4aa3-9900-3bf61bb8643a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305080, "uuid": "290bf23e-ece9-4cf8-8392-adca02e5ea0a", "value": "5224c9d89382c808099072741c431710bc891d4122f928caa3108f9e9ad777b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b836c9d-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303633, "uuid": "359fe066-8931-40ee-b923-ad31c28ead9d", "comment": "Malware payload (AgentTesla)", "value": "25eaec404e9979b9dce90a2b5bada0e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303633, "uuid": "d0dee5ff-bdbb-4f81-a158-997114958014", "comment": "Malware payload (AgentTesla)", "value": "524caed8da7e4b466a5806d5ad78dc4c586f7a84d4cbed6fed3bf6897ed300a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303633, "uuid": "bf1e1b6c-a014-4bf2-8590-b681706ab691", "comment": "Malware payload (AgentTesla)", "value": "fa2795e79eb907420e76aada33e53e984b7dfef7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303633, "uuid": "d02f1af3-7d63-4cd1-b6c9-9511d1acec6d", "comment": "Malware payload (AgentTesla)", "value": "5f7387a3bd9edcebab927a55301826f5d37b2d97c8d47655deced0c57fa2fa87c490c521908420430c56acd66468c7e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303633, "uuid": "65052938-e716-414e-89c6-7a201a301091", "value": "T150D422969A849D51C14063308437CD6589793875AE17B32E872EE46B7CB0393FE73B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303633, "uuid": "179db789-3296-4cd0-9cf9-d726e033e24e", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303633, "uuid": "de912697-58c3-40ad-820a-e6bd26690a63", "value": "12288:4z7hU5I5yuNHIgzSFKxWltRohBfSTso93UwDTdiby1bn04gZjC+Tyc/:4f+iN57Gtene3p8obHgWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303633, "uuid": "a669a9b6-e10f-42e2-a1d5-5fbe11e9861e", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303633, "uuid": "dd33cb3a-6ac0-40f5-bf0a-e99117bc60ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303633, "uuid": "150d75f9-e7b3-485c-9e1a-e325be4bf93d", "value": "524caed8da7e4b466a5806d5ad78dc4c586f7a84d4cbed6fed3bf6897ed300a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c682957-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305003, "uuid": "e17e716c-4836-4f43-9bb4-32bcdf5d4aff", "comment": "Malware payload (AgentTesla)", "value": "837f0765460174c5c532309161a45f67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305003, "uuid": "1a419859-1346-4af8-ac32-ce88511b8406", "comment": "Malware payload (AgentTesla)", "value": "525eb93f16cf416e36be2c2147f46e0d912ba3cd141c7f78f9c06c73e2c6b91d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305003, "uuid": "f5419c3c-e13c-4ba2-a4f7-85c4de674d71", "comment": "Malware payload (AgentTesla)", "value": "aa7e7bc90633abc5c85eb79b74617de52c18d9d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305003, "uuid": "1e30abd0-d823-4cec-b0e0-d558dbf4e7d3", "comment": "Malware payload (AgentTesla)", "value": "6823b5ba79e6c3367f4283b5292be27dd13f78aff8a678bd284f6387f14e83e4204a8d28a9477085c8fb7b6ed41ff214", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305003, "uuid": "a1c77f45-ff08-4321-8f5c-3693e270354f", "value": "T1B4E412513660CD93DE7B5BB0EC76863565B2EFA822D9430B3350BB04BCB399B4649387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305003, "uuid": "ad07d864-ced5-477f-9a1f-d7d1175877d8", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305003, "uuid": "ef8bcfa5-c737-4276-a657-1647d88cdc3d", "value": "12288:pVBk1OIHWD6yTVIMdhd5J239OqJbaxi5cFGDftZxO1l5:pVqP2D6GIghzJ299Jbaxi5cEftjOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305003, "uuid": "b5c69712-7b67-4367-9956-2050c2586127", "value": 685552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305003, "uuid": "b5884078-9f86-44dc-b2d5-1711869e142f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305003, "uuid": "757df9fe-78a6-47da-81d7-cb823a015a0a", "value": "525eb93f16cf416e36be2c2147f46e0d912ba3cd141c7f78f9c06c73e2c6b91d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e0cd7d-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1770307227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307227, "uuid": "c63033f5-c1d3-4597-a7cf-f2b279570fcd", "comment": "Malware payload (Loki)", "value": "08b332929eae225d4e9e2ec06d95c9c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307227, "uuid": "3b0b649c-1da9-4cb1-a935-de9d45b49f26", "comment": "Malware payload (Loki)", "value": "52da8cd69505fb064d7fb290e75beee3c14b4ec5fabe4c2b80c2c089833a07cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307227, "uuid": "2a650b32-18d3-4b9b-9675-5a2dcac05583", "comment": "Malware payload (Loki)", "value": "355936ad73a14ed93200f6ca8fc32590dab074bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307227, "uuid": "3e443290-c817-4115-ac4c-a0bd81d734f3", "comment": "Malware payload (Loki)", "value": "72ea2b62879a1e9ed266d7d46792655ce0b769800e7f81ece6c79b4c62d2bf3546e121cc53a97fc8f1b55e069d769ec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307227, "uuid": "dc9cbebc-4d3e-4d6a-b255-419a634ec17a", "value": "T19E84F01FB4B4F4BAE24AC3F14E1A83581E68B9341FE4C2CB4EC62E5B1AF26755061753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307227, "uuid": "7cb75000-0af8-4d1d-a6e0-e9b7977bbbb6", "value": "3f775446b66e793775fe55de1058550d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307227, "uuid": "dad73e3d-682d-411f-b62c-022e21a4b25f", "value": "6144:jCJmVehHrXDor9xuO0/fCq1M5QfAL7BnNhCv5uQzF994BCuE:XVehHD0r9YOCCZVXBN8v5uQj94BF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307227, "uuid": "53397269-808d-477f-a3d6-04ae8713abad", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307227, "uuid": "e951b7bc-2ee3-4433-b2ee-11d492c09032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307227, "uuid": "d166507e-8ee7-4609-b29e-f6c37a77c712", "value": "52da8cd69505fb064d7fb290e75beee3c14b4ec5fabe4c2b80c2c089833a07cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a60a2b-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327274, "uuid": "20b91fe8-77de-44f6-9027-9355ffa7c1eb", "comment": "Malware payload (Mirai)", "value": "61ba38afc8d187b8efe295dc8316da8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327274, "uuid": "cd8e286f-a619-4f6a-a274-6823cc524859", "comment": "Malware payload (Mirai)", "value": "52dea849d85dabb0e6fef5dac0aa927465baede8c09903777cbbed433bf43841", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327274, "uuid": "6b49c946-92bf-4ce6-bf1f-b7295c143167", "comment": "Malware payload (Mirai)", "value": "0a33182f6c9b278521a2df3f3e617b97dd10651c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327274, "uuid": "65efa484-62d2-4115-b2db-b152877db6c4", "comment": "Malware payload (Mirai)", "value": "03bc83596454deccd931353585ac31a6566e5acdb96b141d627e4c2d38c011ebc964cb0cb8a2ad49ce5d4ee41282ace5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327274, "uuid": "8c21248f-3774-4e87-a47f-fa230a83c404", "value": "T119A3C509BF510EBBD8AFCC3709AD1B4228CD655722B93B797634C528B64B24F29D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327274, "uuid": "249a163c-c861-4161-8435-ebf041b53654", "value": "1536:JxODm3pPRWNqq28QDSfIMFQfgAZ+0u8vZjemPT9ESKhC7qJr:J0DOpPRWu8ERZ+0u8vjhhqJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327274, "uuid": "f1fcd759-969e-4eed-859d-3f1782a94814", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327274, "uuid": "bd5ef09a-bcde-4ee9-8176-651e1bca2cd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327274, "uuid": "e527eb69-bf2d-4691-8629-1f57ba89fe85", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468b666f-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327193, "uuid": "fcf949ce-3264-4f36-8040-d909975f4116", "comment": "Malware payload (Mirai)", "value": "6f8a683f20a767aaf9104a4d1ceacd21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327193, "uuid": "3f976811-f9f9-441d-831b-d33189837ca3", "comment": "Malware payload (Mirai)", "value": "52eaf552dbeeccb6b920271ca1d96bc0145433bdbf215610b27c74a521a6a06d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327193, "uuid": "5aef740c-7be0-46b0-85d1-0f6fe8d2e964", "comment": "Malware payload (Mirai)", "value": "37697efff4561434d7678b830818b2d1be6811aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327193, "uuid": "bee350eb-0028-414c-b52c-0ac625aa1a75", "comment": "Malware payload (Mirai)", "value": "77b894d04cb7c63b75304bc9e5fc8bb7c50a86e2a0a80ae702c1cb5cd41e9f27c2bfc980b99e0490cdcb5a9c29d66040", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327193, "uuid": "f9253e75-2f3b-4f86-8978-8c3955182bf2", "value": "T14BF2E150E61034D9DEAA18391CD5E6C077E25FBA33996FF16AC11F02190DC2BE896DEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327193, "uuid": "828f80f2-8f9e-4e43-9ac7-404950ebb40b", "value": "768:x7160aX0xrq5uHZEUZxhIvTyWKeB/StjibaDS4uVcqgw09S:x7160akRou5EoxqyCh0jeCS4u+qgw09S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327193, "uuid": "87e2f53b-feca-4f80-a285-d67721f5d1df", "value": 35108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327193, "uuid": "68876a19-ca72-474c-a6b1-9c11173a6dcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327193, "uuid": "a6d4fc6e-8236-4347-b0eb-e9b53ae2318c", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e09cf99-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770306241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306241, "uuid": "cdc8ed7e-48aa-40b5-aa8a-f44b7fc8bcb1", "comment": "Malware payload (ValleyRAT)", "value": "70821e4e00a8fea1f896a7bc11050e6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306241, "uuid": "bd7d2226-5836-43e8-bbcd-261b81c88246", "comment": "Malware payload (ValleyRAT)", "value": "531e6b5f9b075ae2dd0c18dc3baa1050d82205e335bc9d32e6c868e1cfbecf38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306241, "uuid": "4d16d4e3-9d27-43b5-b2b6-0723c5ab1020", "comment": "Malware payload (ValleyRAT)", "value": "af9ac918c48e07241fd4c456202960ec8c541ce1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306241, "uuid": "01f07e7e-dcc6-4918-8ad6-e73af123e6c6", "comment": "Malware payload (ValleyRAT)", "value": "aa868a845fdf7a5e851025bea1db9bd5347bb2407db422e10ac0cfb856f8c8eb752785fcaefe48f7cf482dacb9781ef0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306241, "uuid": "87e1d678-dea9-4704-a246-96f5f31755c2", "value": "T1A0151289DD6422BBE2B615B0641755DCFAE40DF10B79C0BA03FA07D776722F9603A293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306241, "uuid": "3f6ba8e1-7270-4d85-860b-1cc60c421351", "value": "dc4276fbf1aaf5db0bf3515524df201a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306241, "uuid": "11c4eb84-773e-467d-bec6-da1d178622d6", "value": "24576:SgqE2twFOEZkq0LtJNKM1flEECxfxnFrWDZSFdLysAMvHx:SgqM3kht+ClNCxfxhWtSTAuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306241, "uuid": "870fdaac-d388-4519-9dfe-99075a087f78", "value": 909371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306241, "uuid": "de359675-acdb-47c7-8eb2-9329a9bd9ea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306241, "uuid": "638ba04e-c60a-49d0-88e8-f4a19ecd7362", "value": "531e6b5f9b075ae2dd0c18dc3baa1050d82205e335bc9d32e6c868e1cfbecf38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cb8baa-02ae-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770308339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308339, "uuid": "395fe9b6-d7b4-41cc-ab26-b8c762dc5885", "comment": "Malware payload (QuasarRAT)", "value": "cda8a259cda8de1adc7c175d9982e0ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308339, "uuid": "19bf704c-2bc3-4ea9-a86b-a49922e40ba5", "comment": "Malware payload (QuasarRAT)", "value": "53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308339, "uuid": "8cb1fe11-c3df-4ff6-8726-2d2567123b37", "comment": "Malware payload (QuasarRAT)", "value": "1542fef97ff4d732d26f4d91241a15aba7b1619d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308339, "uuid": "a12c262a-066e-49fc-840e-a71c9d0d726f", "comment": "Malware payload (QuasarRAT)", "value": "4f5d0f8ea3fed216c4fbf028d8d9dacf0289fa20053354316fd589668f28329099f167fb01d4520fc6ac0e9a7bc38c47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308339, "uuid": "05afe386-9914-449c-accc-ad573c04d4bc", "value": "T10146231A33C69958D57E837444388983ABF0B5CB6B11CB2E758E23DC5E01796BB12B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308339, "uuid": "0fc689ad-49fa-4883-9216-07e5364ab709", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308339, "uuid": "67627b0a-bde3-4e81-9e7b-68c98334e264", "value": "98304:+5nlJQ/2a9Or4cW+PvkNDHmnQq32yeDGWJ:+9lVagr4cW+P8mQwnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308339, "uuid": "a5f69a1f-86be-4844-938a-8cd5fd634468", "value": 5615104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308339, "uuid": "67c8e84c-f45d-4edc-8696-3bc756e0ee0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308339, "uuid": "264b6fa9-2ee9-4f26-a26a-c8db7f7260c4", "value": "53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e7ac15-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770307655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307655, "uuid": "07865814-ccda-4450-bcc2-9b8805afce88", "comment": "Malware payload (a310Logger)", "value": "8bca63043ea69ee674ddac711d34fe32", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307655, "uuid": "b7d52bed-8b70-4483-abf5-129125ef4224", "comment": "Malware payload (a310Logger)", "value": "53c4ecc82fbdc5f91d6a63ab46bbdef2241437719f4edd2c71318064ca5ebc5e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307655, "uuid": "db7f4df0-dba0-476a-9c49-c2002e94578e", "comment": "Malware payload (a310Logger)", "value": "0419762b534a30f2420c4fca93325184781376b5", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307655, "uuid": "e3e40288-2194-48ba-8348-21b2e93d5818", "comment": "Malware payload (a310Logger)", "value": "647f650ae030db395bbaec5d8a9be12ab4f3ff4d74725f788a8072fa0220cb1c30630857e601b720faeec1aa71c62847", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307655, "uuid": "6e406cc0-a801-45a8-b86f-8bc41e5eb4d3", "value": "T14C55F10E07E546A8F4FACB34D2B8006693F0B5ABD621E7BF690D51F49E21785E643273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307655, "uuid": "67b28662-f349-4b94-9e8c-b1faadbc062a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307655, "uuid": "bf6b62c9-6744-4d21-b802-10a610490adb", "value": "24576:xF2bGRHGAWq6/p3ojZPgpojZ6tm48Y21KObos:f5GAmOdPgOj94pI+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307655, "uuid": "7f17ef37-bc4c-413e-bdf2-a6d5fb221100", "value": 1307648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307655, "uuid": "31039943-19b5-45ca-b33e-636e6d78b310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307655, "uuid": "7d1b4915-193f-4f96-9cbb-327735569329", "value": "53c4ecc82fbdc5f91d6a63ab46bbdef2241437719f4edd2c71318064ca5ebc5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bc360c-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306062, "uuid": "cb168bf5-3709-4adc-878c-65c2983835d2", "comment": "Malware payload", "value": "1273b2d19ff7d2d591792c74a8c5be89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306062, "uuid": "bb24379e-fa17-424a-97ec-2cd50ee77b45", "comment": "Malware payload", "value": "53d2b9f714e9487096f63770e9c659e4e4cdde4aa6d17d58af0699e8c0f886c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306062, "uuid": "7faa9de5-dd20-4a50-84d6-939de33f180b", "comment": "Malware payload", "value": "65e6778d2cd9df4f34df17ceebec6909a2b34c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306062, "uuid": "d0e98d68-e16a-494e-a07f-8638b17556c4", "comment": "Malware payload", "value": "bf25e224fbc82b877798258dd5bf1109be518f4c9b49523bfeea8528d6581ad19729d748fb937acffb6a073952e2e13b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306062, "uuid": "f890d2ac-7e1c-4404-8b97-3dcb7ddd2a1f", "value": "T1B2B4C416E6607525F98309703D78A267742D2C3A2A41EC0FFB889F9A3671987B1F471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306062, "uuid": "2f0a12ff-e7a8-4b24-938b-85728b69c106", "value": "7ebd97f1fda837f84eb8829ff15df3a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306062, "uuid": "21810e48-3002-451b-be91-d976f65864cd", "value": "12288:294bmoriZcE7R1K0dImSisR90YZpozCoF1ib0AK6zBEy:wHdImSisb0Ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306062, "uuid": "c897f6ec-8e5f-4a4b-84f8-80fb32b23c02", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306062, "uuid": "735108b5-78b4-4a32-8b0d-845ec8035014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306062, "uuid": "067820e3-c743-4e86-ad31-75f68594939f", "value": "53d2b9f714e9487096f63770e9c659e4e4cdde4aa6d17d58af0699e8c0f886c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1706e9-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770306610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306610, "uuid": "115216a5-0a77-4bed-a411-de160446fe55", "comment": "Malware payload (PhantomStealer)", "value": "fe1d857e3b539e1ba46950a2e0467ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306610, "uuid": "2165832c-f169-4286-9940-89ac31c2ac5c", "comment": "Malware payload (PhantomStealer)", "value": "53fa73713016ccf9636f69659053fc115cc779b1e17506d50cf4181474a27e8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306610, "uuid": "e9821b9e-3194-40a7-969b-8d470d72486d", "comment": "Malware payload (PhantomStealer)", "value": "e229a9b254e1207a033efd47db9dbd6afb42a635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306610, "uuid": "b9da0a08-6d69-462d-bc5f-b0bbacdc24ef", "comment": "Malware payload (PhantomStealer)", "value": "25fef3cf007316a901dd1412696167009e0a5bd5b91e609461dca9ecbe3c3c096a74558c0adeaad8df2c050bfaea6657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306610, "uuid": "8ded1d3b-7248-4e3e-b68b-90746cc67902", "value": "T1686523A43359E803D65687741CB1CBF01378AECCA501E3A25FF9AE9F78256D6349E2C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306610, "uuid": "afef5c2e-2e39-43ed-a0af-e32942ad2a97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306610, "uuid": "f0324d66-cb0e-4323-921f-8f185955c3da", "value": "24576:7QTqI7Ks5koCAcUNYWse8Ttw7lTBFI9unWQroAXhNqUnlHdJ6YE8:72RmlVR5EJBFI2BrooNqUlHdJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306610, "uuid": "b5dbb3e5-9f25-4d8a-a8c1-7ba37f68fa38", "value": 1496064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306610, "uuid": "d2acacf5-1b7b-465b-9904-32280038b452", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306610, "uuid": "d46fedb3-b183-4208-a70f-280267539930", "value": "53fa73713016ccf9636f69659053fc115cc779b1e17506d50cf4181474a27e8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754428b9-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327271, "uuid": "969594bd-5764-488f-bb3c-3a2652b89bf4", "comment": "Malware payload (Mirai)", "value": "4d05bc5b2d08676df4fab78550be2842", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327271, "uuid": "cb0c8d4f-d36b-4b01-a79b-1df630562676", "comment": "Malware payload (Mirai)", "value": "53fb3ce45801b4de3b0032f9943fc518cd7b52621319a26beeefb65aadcb1cca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327271, "uuid": "f03f27ac-dfd4-416d-8143-6cb1a3e304f9", "comment": "Malware payload (Mirai)", "value": "fd3622dad18fc619fd6d02454a284e11118a6846", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327271, "uuid": "87f34c40-9e0c-4870-b299-78270258e0b8", "comment": "Malware payload (Mirai)", "value": "10404791000f7ad81763f8dacb31b3553c7525cf917d983c11dd84657f90793bd85dc5e6e68b56bfde43818475b418af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327271, "uuid": "7772d433-ada6-41c1-8a94-762cfa2b4cf8", "value": "T1B1735B41B38C0D43D1971DB03A3F2BD6D7AFE9D122E4FA852A5F9B8691B1933054ADC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327271, "uuid": "882e3049-b4f4-4658-8443-916324b2ce05", "value": "1536:k3fm9vWGC9nCFwUzQz4ln7IHl+94tCy/fVQ6t:IfmhxCMRkg7IF+7SQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327271, "uuid": "b4650da4-4223-4ebd-9c64-a2d69514f1ea", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327271, "uuid": "2786bc73-9755-4ce6-9323-204d67ecef84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327271, "uuid": "26ab9878-d912-4d63-b24c-222aea9143c3", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4aba653-02bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770314600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770314600, "uuid": "cf773aba-71bc-412f-95fb-9630c0134118", "comment": "Malware payload (Mirai)", "value": "b87756ce767ccde5cb7cf7da7ecf38f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770314600, "uuid": "ebaefa5e-df80-49ad-9003-6116bb6c1288", "comment": "Malware payload (Mirai)", "value": "54313b47d8dd2cc7038d7085dc86d2c8e9b523b60d2fee25f07101a56e01926f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770314600, "uuid": "81113808-7173-450c-90c3-c3a5276566ca", "comment": "Malware payload (Mirai)", "value": "558eb7f958275bb9d7ebfd8767073ec12230597d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770314600, "uuid": "7e0f5a81-5a78-40bc-8c07-1d6086e18dfb", "comment": "Malware payload (Mirai)", "value": "bc1d7de215bf03b46bd13b738e0723d5a4ec421507d17c4312b39d14c363cba01ac3e0021b30b0e30820244e60ca0e93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770314600, "uuid": "913f2681-85de-4366-a320-c69a8ca32d20", "value": "T1EF847CCCFB4DFF42C28293B6E96B0613B33934607B4A95637D12213EEC967986C67146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770314600, "uuid": "7e07327c-a91b-43f3-876b-661afcc47fef", "value": "6144:uPUcfDbnGU7nguKEr4STcc8EIKQgHCKfXr4nQWAFLohjE0y8BtyWZ:bcfDbnGU7ngXF4TbrmQWApoh/BtLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770314600, "uuid": "93fcef39-2fa6-4a0a-88ee-782121062859", "value": 371368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770314600, "uuid": "601aabaa-7c6f-4a8d-98c2-b4efbb5ff0d4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770314600, "uuid": "d242ebdd-bfff-48f4-8e44-4e68e810aa92", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23495215-026d-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770280319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280319, "uuid": "cdb9c94f-765c-4e72-8bb0-a40cdc3f90a7", "comment": "Malware payload (AgentTesla)", "value": "4ab2d0c1cd22d0d94ea484c6a3f61dca", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-hhautoinvestment-co-tz", "colour": "#EAB50F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280319, "uuid": "aeb28f32-eaee-4937-b647-4a5104a972e5", "comment": "Malware payload (AgentTesla)", "value": "543bdbe29635cd71265a6a7f7fd1553ab31822c01f1aac1e9db622b4a22e1c55", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-hhautoinvestment-co-tz", "colour": "#EAB50F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280319, "uuid": "9ca2324d-cb4f-4c3e-a4cb-c36fdd7cd52b", "comment": "Malware payload (AgentTesla)", "value": "52814d0785f9ba1967c2b15969ec9c357bf5395f", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-hhautoinvestment-co-tz", "colour": "#EAB50F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280319, "uuid": "3c74633f-5e5b-4861-8359-6dd8f0fb7789", "comment": "Malware payload (AgentTesla)", "value": "0951dd6659a1dfc36c47c1cee46411e29de16c5ac5417413cf5366bb7cc8cbdf8566c30dcb661c9dabbb16172a2c1aa1", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-hhautoinvestment-co-tz", "colour": "#EAB50F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280319, "uuid": "99ad2dd1-824c-4396-9cf0-2428ed24404d", "value": "T1B5351211DE18CE510A6C826124669D82AA914EB79C04777A7F8F4E4E6F5F4AFC2313FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280319, "uuid": "ef245bb1-5fea-4c9a-8f83-f45e3381438a", "value": "24576:GItIaxOuLagmd2eKCwBvbWZxMeMI/awsnmn:HzLnxvmxUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280319, "uuid": "955c5ba8-b85a-499e-845e-ef320e5f34e7", "value": 1079277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280319, "uuid": "6f8b7f89-bb10-4477-bb02-bc66c30191ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280319, "uuid": "72deac66-7caf-4ab2-987f-8112e83e81d4", "value": "STEINN.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23a9628-026a-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770279351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279351, "uuid": "02a9d149-3b9f-4d6d-b52b-31cc5fa08e5e", "comment": "Malware payload (Formbook)", "value": "c83c00e8d79f8d1492e5e7865569f7f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279351, "uuid": "1d760765-189c-4a03-bda0-9925b9769994", "comment": "Malware payload (Formbook)", "value": "54553d7730e83a80b5c81a63f1c39bda4f549abb276a7198bc804ded6c25daf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279351, "uuid": "fc9a5f34-8c12-4be6-9105-ca12dc24cd22", "comment": "Malware payload (Formbook)", "value": "f29019fa0a29a9154cd97a15f9c0f3e92620f5a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279351, "uuid": "bff62627-8f80-40f6-ab81-6e4569994c41", "comment": "Malware payload (Formbook)", "value": "206f4b303ea8a40152b7a26413438e4a58bfc9b64b6e7c26cab10b73f9c84f965fcf4c8586a64c65461fb6a265722b58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279351, "uuid": "ea368ef4-4d8c-4a42-b329-778bfa56bbf3", "value": "T1EB45BF027381D066FFAB92334F5AF6115BBC79260123A62F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279351, "uuid": "928497ea-fa55-4b4e-993f-a144d82f4802", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279351, "uuid": "a76f71a1-e0e9-41f6-ae7b-6f56c4307388", "value": "24576:U5EmXFtKaL4/oFe5T9yyXYfP1ijXdaJhmUP8n9HsRDnT:UPVt/LZeJbInQRaJhmUc9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770279351, "uuid": "4ed0a511-3ac7-4fd4-afa5-708e1a266942", "value": 1261056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770279351, "uuid": "8c790368-f9c0-4f94-9b14-aa47ee7865b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279351, "uuid": "a538dac6-85e9-435c-a157-48453c90a72b", "value": "PK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7c3d41-0283-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770289941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289941, "uuid": "04a20064-d89d-4554-99a6-bc6fa7dc6a95", "comment": "Malware payload (Formbook)", "value": "e81c7bb58665b95d12d1ace53c2686ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289941, "uuid": "1d313f27-1bed-4458-98b6-4510ead86188", "comment": "Malware payload (Formbook)", "value": "553c9e5d87bceb0b9d3b74c6f742f0c54eb56774654ff1cf3cfc7a0cd3fc4178", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289941, "uuid": "3313d8e4-70c5-4efb-9613-2a8fc764185e", "comment": "Malware payload (Formbook)", "value": "60bd91bc8d2d9d0f96f320c3a2a2e27613368b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289941, "uuid": "0e5b2da2-1672-4e02-abb1-7382bf7d0160", "comment": "Malware payload (Formbook)", "value": "f8471459323a72e3a7f2395ea75b2bb043d06b1f9bdb87b7a26836f06c59194db38df42224fcd983bcc8679d56c9108a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289941, "uuid": "48eaf82f-ed0f-40b9-9480-4567b9affb5d", "value": "T16455BECA33818022FF9B953A0F56F61947BD7D268123A61F13983979BE705B1063F663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289941, "uuid": "3a3e02bc-e283-43fb-9de6-02ec0d0f27c3", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289941, "uuid": "8fe389c4-be78-4803-90ef-49de4e0b9aaa", "value": "24576:t5EmXFtKaL4/oFe5T9yyXYfP1ijXdackBcJUCLYTR57opGd:tPVt/LZeJbInQRaDBchLYTRRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770289941, "uuid": "296352be-62a5-41fd-a88d-761de4c34472", "value": 1363456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770289941, "uuid": "a75ee615-069e-4399-b86b-f97fa5397335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289941, "uuid": "10d6c952-33d0-46a4-a380-7684db118317", "value": "553c9e5d87bceb0b9d3b74c6f742f0c54eb56774654ff1cf3cfc7a0cd3fc4178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985bb676-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770304996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304996, "uuid": "bdee089d-31ed-4cb6-a557-80848d440e54", "comment": "Malware payload (MassLogger)", "value": "a3cd879220e2b392655483f727fb447e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304996, "uuid": "8d07b1af-ab00-4db2-8617-4c1f56c38612", "comment": "Malware payload (MassLogger)", "value": "553d904e1d73497fc05af9b9fa570cd6ea72043a445b2c358ce27bc84d28d226", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304996, "uuid": "1feac3f5-6265-4036-ac48-6a8b4c96ce00", "comment": "Malware payload (MassLogger)", "value": "c114238d1c93b1689c8898f783cf57a6b166211c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304996, "uuid": "97b900de-8094-496d-8f2e-61b0ba7f4ea5", "comment": "Malware payload (MassLogger)", "value": "2711463e041edebd351cd7d828735c8b0b0a04a4a3bb5691f36cfafcc3501b2d6141a60191fdbdebe5107349b63ce554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304996, "uuid": "60ae9a96-8e25-470f-ab8a-661f01dc4a2e", "value": "T1E425025427D9DB13D8F61FB50930D3790BB8BEA9E511D34A4EE96CDB3870B02A884793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304996, "uuid": "ab624ca3-c284-4add-9adb-a6d69b8517d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304996, "uuid": "719e2499-d6a3-43a0-887a-3261400d884a", "value": "24576:yjyltlqqzrH7dhRP2u77XrCPmFAfeqHL:ys7zTRuA73qHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304996, "uuid": "da8f2cab-f6ff-4572-bbc1-fdd361b1e874", "value": 985600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304996, "uuid": "cedc7b37-ca80-4254-b9d5-8e19b48b514d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304996, "uuid": "4f200dfa-2563-47d7-b51a-0d7d2ccd24c0", "value": "553d904e1d73497fc05af9b9fa570cd6ea72043a445b2c358ce27bc84d28d226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86814e48-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770306684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306684, "uuid": "e059a849-d020-481e-9f38-083ee5c13def", "comment": "Malware payload (SnakeKeylogger)", "value": "36075be6da92bb9556f13d8057332fc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306684, "uuid": "9226c158-5171-4cec-ab0a-d99b8e5857a4", "comment": "Malware payload (SnakeKeylogger)", "value": "558283a6cb2d8ccb37ce76c846b2f41b61ccb31c26db2093f5ff470c28af8524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306684, "uuid": "dd193bf5-a558-4002-933e-89592296b229", "comment": "Malware payload (SnakeKeylogger)", "value": "5b8c9d487fe32bb3750f7f6a00d6cfebce0a21af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306684, "uuid": "46c375f4-5951-4e90-8eaa-224bd0a43af7", "comment": "Malware payload (SnakeKeylogger)", "value": "307dc04eb94d52feb4c248113e709f821d6622cf486fbf41d4366f90148c8c3677957e737c884eef3b15bb9bc0dab0fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306684, "uuid": "cb988ce5-4186-45c6-9d79-13a9acf0d9ee", "value": "T17485AD14E3D911B8E567EA34CA619332DAB178464371E58F0B99D71A2F33EE09B3B311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306684, "uuid": "ea16fe4f-3629-4dbf-ac16-4448a86137a5", "value": "b31fa30c377b7584dd6c4a686890d3e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306684, "uuid": "f4e4a803-7925-42e4-ba4d-1585d085dc6c", "value": "24576:ZHr6L9n5D0rQvCLQEbSnCLy2tbRnaAYR2+bt3JZqkrxzzkk5wvVqmH+U/Y/t1:ZHr6L9nK+Oq2+tZrxzmNqIY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306684, "uuid": "bbe2c12d-cec1-48dd-b4b9-1ccb58eb08e8", "value": 1789440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306684, "uuid": "f0adf1a3-6f72-494b-952a-01e7b9626fe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306684, "uuid": "f3e47b00-2bbe-4d5a-95bd-e432951f7220", "value": "558283a6cb2d8ccb37ce76c846b2f41b61ccb31c26db2093f5ff470c28af8524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe76f663-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770306027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306027, "uuid": "b1b469fa-7975-4f0b-978a-5c139775e8e2", "comment": "Malware payload (MassLogger)", "value": "7965c92ef3a0bd1e92a8ff216c0fc1a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306027, "uuid": "79a1826f-8960-412b-8255-4b9a062b31a3", "comment": "Malware payload (MassLogger)", "value": "55b98e06e135730fa23bd4af65b161ba5055a9e915164eb99b9402ad07e6e6df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306027, "uuid": "81fbef4f-ae00-435b-832a-4a52cbffb8b4", "comment": "Malware payload (MassLogger)", "value": "44dd9c9c51bd6b99521bd3ca7b8866d8084a540d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306027, "uuid": "5b3c3a3c-c3d7-4793-9edc-ce70c4a1df78", "comment": "Malware payload (MassLogger)", "value": "3608ebd0b316a1b77996af6583e36991c3d5b4458911af79a5dcc3189fea978c0ffcc7993d1345aee0c8086835620ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306027, "uuid": "4260f386-7cfb-4c07-bb66-e0e6b42a181f", "value": "T1B72512683307C611C1669FF41872D2B91B795FDAAA21D207CFDABDEBB43AB601C45243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306027, "uuid": "0bef8bab-44b3-4e63-b03a-9630280e645b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306027, "uuid": "3a5fa55a-2735-460f-8f6b-56ff82f3dfa2", "value": "24576:rs40vhuIGNisyLPA2s//6zBUgkoW6UdS+:Y405uj4syUb/kU4sS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306027, "uuid": "52ac3a0d-13f8-422c-9e0b-3aa6749ef33e", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306027, "uuid": "7e2142c2-0c95-42d4-af39-61eecc9e48be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306027, "uuid": "536040e7-e3c6-4d60-815e-12cdb8d52a1b", "value": "55b98e06e135730fa23bd4af65b161ba5055a9e915164eb99b9402ad07e6e6df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdf3b8a-02ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770313733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770313733, "uuid": "e72e8537-7306-423c-8894-a11d92b5818d", "comment": "Malware payload (Stealc)", "value": "26f77eb14e0d838f4a8da44862ecb832", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770313733, "uuid": "8998d4bc-ef86-4749-a133-6c51b06f314a", "comment": "Malware payload (Stealc)", "value": "56a524ab14ed748549767eaddb993df9a9ef5b0bbe34a7b8aa7a5be052fdac06", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770313733, "uuid": "782704fe-99db-4808-bad1-6b76ac6246d6", "comment": "Malware payload (Stealc)", "value": "45f6ce3e17bff8a29470fc7c64f41b4b13b92565", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770313733, "uuid": "0c16c44d-0d16-45e2-98c4-02d47e6d94cf", "comment": "Malware payload (Stealc)", "value": "7d9dcef0ef1b1afc283f0b35725bff9c17f04d44af07eca1131eb81b387da1e86709fc9c110cda353c3c8aebea0cbc6c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770313733, "uuid": "d9eafa45-80ba-4faf-bc75-a19c3dee5570", "value": "T1D4162380DEC71A9AD86F233501F353764133EBBA9BA2091B66C97074D6633D126B364F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770313733, "uuid": "7dd48573-dd38-48be-a736-340735ffdb7e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770313733, "uuid": "1e52328d-abec-440d-b5ad-a1958eb7b300", "value": "98304:bUdJUrYKSdoYENrxb8awNLMzxlgkeMfKQO:2JykOnlAawNmxPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770313733, "uuid": "7c9c4839-9c4a-453e-b366-899b10d16307", "value": 4177920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770313733, "uuid": "44e5e3d0-2d13-4989-bd18-b37008dc6961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770313733, "uuid": "68720186-5161-4d0f-bb43-203c0c362f5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c41022-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307348, "uuid": "aa40af03-e2bc-400c-b078-2085a5aba317", "comment": "Malware payload", "value": "1044de34b9a37013dca4f4e4317c0496", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307348, "uuid": "b66c557a-f6b9-4c39-a7bc-7f022d6b3343", "comment": "Malware payload", "value": "571a8cbc2f78c7515b4718337cfbb8abfa9846997e5abf257ee04b951b231b63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307348, "uuid": "9c11f655-e9de-47fc-a7e7-19dd1694ed31", "comment": "Malware payload", "value": "17818d2aa7f65d56d827fd2d94d22152235e0c8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307348, "uuid": "644eca00-c855-4118-af03-56d0bbb8d007", "comment": "Malware payload", "value": "1a182655effd6e141ec443c951dca144098fb1f137eda9aeed336948ba9067f16ed83b1a2054a1ae47e097d9ec9a9180", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307348, "uuid": "45514d3c-d0ae-4e8a-a08b-cf033d50693a", "value": "T14E749D0B75958F21CB440B72C4E7553003BAA6CBB6B3D75D2E4A03D9AE423F99C1B693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307348, "uuid": "ee43ffee-ff08-413d-9b01-71f2d4202c7a", "value": "6144:zc/2DhchcQDq22m67t7slhyIn8c4Z3v+2B321YQZATPe:zVDhKfPy7slhyU8b1vjm1YQZATP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307348, "uuid": "ddf1fa0b-3bbb-4465-8604-64fd3a079bea", "value": 365056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307348, "uuid": "53196d2e-9826-4a10-8c37-a3e5d7ecc09a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307348, "uuid": "39773dc2-1e1f-4af8-b4ce-11ea3abb6578", "value": "571a8cbc2f78c7515b4718337cfbb8abfa9846997e5abf257ee04b951b231b63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98549b6-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307173, "uuid": "3963ee81-48fd-4fac-ac22-778df8a7e2e2", "comment": "Malware payload", "value": "47532e42c50eceed2c81f6e69d30e62d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307173, "uuid": "ba3c89e3-ca3e-415c-b3cc-191606debfc0", "comment": "Malware payload", "value": "574fcf070fea538f31895cc5881fd74b796d9d5ec0d24cb524ae279661db0754", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307173, "uuid": "27360989-ae45-485e-8b57-3b9a4abc5c53", "comment": "Malware payload", "value": "ae04741d4979e490fe6adde47e83887122d6b0a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307173, "uuid": "4eb552cb-8381-4d73-9a88-f011606ed76b", "comment": "Malware payload", "value": "4fea0191ec138bdc52b8bf3aba75b6eaa35e926e0b1e4baf0501b7f687894c29b086fc0e0997682fe5174012de8295e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307173, "uuid": "cdecfa6a-4abc-43a0-abd5-a776cee75402", "value": "T177C5241A1AD641E4E4E9CE34E3BD26A942F0662F9525BBFB424412F8DF2535F71032B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307173, "uuid": "21f5b46d-4615-4cf2-8932-570bd28fe991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307173, "uuid": "8469dc67-2fb5-47db-9f33-bd68e81c1c2d", "value": "24576:acfMs1hsAdBen2pqpv8M5D8LoA3B/UoMOmxYC1xa7Rl7VL5h4gXTkZyPM2Ck4Sfp:acfTfeH8C8LhB/rS87PWEPMc4SfsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307173, "uuid": "098fc79d-3c30-44a5-9e7a-0be9cd400f63", "value": 2530304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307173, "uuid": "0a7c63c8-0de3-42c8-845e-7cbe75d3f06e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307173, "uuid": "fb3a3be2-7c1d-414b-9df2-b80f98c7bb50", "value": "574fcf070fea538f31895cc5881fd74b796d9d5ec0d24cb524ae279661db0754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b349c3bb-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306760, "uuid": "8d3ec666-9896-4fa5-897c-93771c21501b", "comment": "Malware payload", "value": "ed1b90cf82183662dd1e6d2e63b7f6fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306760, "uuid": "2f5637ca-f023-43c2-9c39-127c309e85e5", "comment": "Malware payload", "value": "5751ef75bc84dd977766c9766ac9f7e726a61476d6e9fd5bff1a6c80bef5cbc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306760, "uuid": "56a55637-d8bd-4cc0-a3b9-e76d3ba7f66d", "comment": "Malware payload", "value": "ff035e9d2dd4e2ed9603efd4aa43bedbf9a256e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306760, "uuid": "e2647dd0-dfd0-4dbc-b865-a88347c5d3ef", "comment": "Malware payload", "value": "a72796a43fe9437966242d7b84ca24bf7d25fcff488898e78f1461c40bb8b13f6778d2866a93a5578218235b698f6afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306760, "uuid": "7426d739-764e-452c-888f-49f06013b1fa", "value": "T10AF423693E40C61FEB440A303BB9DA612647FD3A1C68168F73E06B6FB8A74B51C1E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306760, "uuid": "9b4bf384-f77d-4349-ba20-2aaa676faf02", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306760, "uuid": "05ba09c5-b99a-4ddb-b781-796692c839e8", "value": "12288:lgNm4Z+aASq3atEcMg8t6l5p4ShlO7Ozb+9jEBRwzt6aRUq+g7QjhI5RvMB:lgNj5AVYzu6L39b+JEBeZBUqHoI59I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306760, "uuid": "10665dc1-a6d2-4abc-b2eb-e2220d284b77", "value": 741232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306760, "uuid": "39bbe33b-365d-4f0f-aee2-49ade214a945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306760, "uuid": "038c8100-41cb-4de3-a14a-e35974fbac5d", "value": "5751ef75bc84dd977766c9766ac9f7e726a61476d6e9fd5bff1a6c80bef5cbc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bde4058-02ae-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770308197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308197, "uuid": "848c3021-72f8-4054-935a-8f7953e4188d", "comment": "Malware payload (Mirai)", "value": "9784f3af80a91d3f3f5ea7679e650242", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308197, "uuid": "df4f11fd-978e-4dba-ba07-7ad61ac93823", "comment": "Malware payload (Mirai)", "value": "575cbb10a952afa7d32901affa109046ff380981f2318f51496faa0985dd8143", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308197, "uuid": "5f0e7569-167a-4276-8f92-d51f9a0f862b", "comment": "Malware payload (Mirai)", "value": "0503584ae724ab73133343ed7c7870a3c01d3c70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308197, "uuid": "30532d10-5aae-4ec9-ac8a-2ddedc8b7bf3", "comment": "Malware payload (Mirai)", "value": "b98bfc664fdbcf8f9e02cccf8712e18ca91d9d5097f49dc9d57e34740f970ae7293c87792f603b2294d4de68066d162d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308197, "uuid": "bd80f06e-10be-4cc8-be7f-699c4d2b0592", "value": "T10954F75CF8809B79CBD0617AFA5602DD33374F24EBDA320589356B3437EAB25A43B241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308197, "uuid": "0d24f9b4-725a-49dc-bc17-14698339894a", "value": "6144:EtcuY/tajcYKzIrrAGJU9r0dGZtum8YiNvrcYj6nIT9j+WXeEh+BL63EM45ci03k:Rf/pum8Y0JXRQd5/qdo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308197, "uuid": "89adcfde-a2a2-4283-ab5b-c05bd80b744a", "value": 300008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308197, "uuid": "d9dce195-ea7d-4d0b-93d6-afbc85409082", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308197, "uuid": "a2b7a56e-94ad-4a72-a426-4303677f6863", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a4949e-026b-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770279655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279655, "uuid": "ada0c2cf-ac5b-4681-8560-f2b11e1cdbb9", "comment": "Malware payload (AgentTesla)", "value": "4ede1b79761ae3382be5d51c325c5c55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-diesel-turbo-gr", "colour": "#062EE5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279655, "uuid": "8d395981-e818-42c6-a8b1-2f4ba8f06fb2", "comment": "Malware payload (AgentTesla)", "value": "575d5279d360010e36ac2c9c06467bd5a4a01de805b597064d6cb839d8bfb5aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-diesel-turbo-gr", "colour": "#062EE5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279655, "uuid": "aa17ae36-547a-408d-8baa-51ae872a258a", "comment": "Malware payload (AgentTesla)", "value": "cb99b56e05e84e87f8640c4fddce5fd60d713998", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-diesel-turbo-gr", "colour": "#062EE5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279655, "uuid": "28fef16c-211a-4395-9162-1797f7429c25", "comment": "Malware payload (AgentTesla)", "value": "ff994908c5e728695caffd4132c83836c1ef012beaf1703b6a6de1c0f9a56044245c634b061af8945f13e5245c754467", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-diesel-turbo-gr", "colour": "#062EE5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279655, "uuid": "e628f78f-552d-46c6-8de7-7a5747992a85", "value": "T1693533F343BC009516B861AE4DD4B904B69B46228B7E8C778CE39BD6763748A0C754BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279655, "uuid": "1ed13085-8e70-49b8-97f2-4994c897292d", "value": "24576:MXDikKLH6qVs03AfvWm/0lNnvc7kfQtrdmGOcwRN5oyoO07L:UwHbs03QWvQB15OnNhoOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770279655, "uuid": "a45b952e-81e9-4cb4-b4eb-6698af66de1f", "value": 1078178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770279655, "uuid": "a2b0305e-05dd-4a9c-870d-48a37bd4833b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279655, "uuid": "575770dc-006b-45a8-808d-8f7211fffe6d", "value": "EURO 3.112,46.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be857544-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mydoom)", "timestamp": 1770303772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303772, "uuid": "21f0b06c-c61e-4a06-bb47-d702e18101e4", "comment": "Malware payload (Mydoom)", "value": "858014b16212d4aa16fdb2f5ee4d8b96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303772, "uuid": "8d2d0d93-31dd-4238-8791-eb0216d1a074", "comment": "Malware payload (Mydoom)", "value": "57940dd96f0fe583fcd67eeb1f24971e4587abb4e41e67475d9b679ce90d118d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303772, "uuid": "014e29e2-3327-4d85-921b-5a8fd7c31a21", "comment": "Malware payload (Mydoom)", "value": "886c2ea79faa1a809e8462267de42104a7a2c58b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303772, "uuid": "fe74a768-59bb-4e1a-96f9-5f9868b41c8b", "comment": "Malware payload (Mydoom)", "value": "1b7246df61885048eaaa8f5aa0a7a353cfef833e00e7b5309c513da26cf9812dc0cd32098d7d0689fb83af0885ac7dc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303772, "uuid": "e187d7f3-6ea8-4fed-af21-6683e5935cdc", "value": "T1B3138E3BBCD2842AC54380B014A19B6DEF7F69360750A852F74C5E9F6F744E5A83D287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303772, "uuid": "8aac1ce4-c8ca-48d9-8ab9-46d250560da4", "value": "953df40d1e1c7d3e56ce3fd6ccf56744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303772, "uuid": "f3366176-5213-4a60-b2b7-ae84902ea95e", "value": "768:nExoEtklIUmKoTCZXFl9rAsa1/TAXDnmLZnAJit8az4:nOoEo2KaCZVli51cGZn6az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303772, "uuid": "108a0352-f70f-45ec-99bc-df9ebdc01bbb", "value": 43683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303772, "uuid": "c014ac43-fea3-43dc-bffa-e7188bfefeb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303772, "uuid": "b528b4eb-641c-4f2c-a94b-390108ddc38f", "value": "1c805c1ea96436b23fc0859c4f6fb618502b6d6eea272fb5622c044ae8b31247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9196614b-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770305415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305415, "uuid": "47908854-f12d-4aa1-b7c0-eb6407ba58a3", "comment": "Malware payload (PhantomStealer)", "value": "88fb99baeee1e2f493d85fc4050f01c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305415, "uuid": "acb0c9a3-3099-496b-98ed-8e10d326ea6d", "comment": "Malware payload (PhantomStealer)", "value": "579ab0f67ffe302e779f7f73696fabbc2c5678a912960952d179ca94d883c533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305415, "uuid": "4a6d3d00-2dd7-48fc-bd65-b820ed83f7aa", "comment": "Malware payload (PhantomStealer)", "value": "53dc5d2672396b8dc9349a14118a7d60fff89aa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305415, "uuid": "d9e23e0d-1376-485e-b9ec-bb6992677efe", "comment": "Malware payload (PhantomStealer)", "value": "570feb7354679dd8af63701f109164ee259613be2ed6c1a5d7c72c6109ae452bdf4945f48b67ae7153ef1ad1f9d2987b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305415, "uuid": "8b73461e-45db-4654-a699-846e23b6a3a7", "value": "T1068522102B89EB15C9F20BB01A61E2362BF46ECEAA05E3164EED3DDF70227595D543D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305415, "uuid": "84987b70-3cea-49f8-b932-670406935b7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305415, "uuid": "1face155-df33-4875-9cf5-90f313793667", "value": "24576:j1WL0pduhnIAsonMtoRf7CZbW3y5CBDsAZjd5t4frwuICze5e/zCKIYSk+ZKhPsA:jhpEIAso7pC54Qr1ICKscFkqKhP7nIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305415, "uuid": "f9459803-2c56-4b53-95e6-77a294dd865a", "value": 1757184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305415, "uuid": "097fcdbf-636a-4cd5-a782-f100fc3d34c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305415, "uuid": "05c1b2fb-ea87-4c8b-8956-139bc79c0bfd", "value": "579ab0f67ffe302e779f7f73696fabbc2c5678a912960952d179ca94d883c533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826a8fb9-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306678, "uuid": "00385a82-efd5-4a18-acca-df0d9d19486f", "comment": "Malware payload", "value": "a0289e607c97f7195d6cd72f2ac4deec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306678, "uuid": "74b4eec1-cc66-48b3-abc4-13c873465bcd", "comment": "Malware payload", "value": "57efd1cfac6b5f995efce90065ddd272049d232f8c33749f0ed7b4d2220456c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306678, "uuid": "305ff155-3d33-4e25-bd8a-49d035f0eb00", "comment": "Malware payload", "value": "4fc3db8436b11db36b1c04bb93f17e1798390e8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306678, "uuid": "24761580-a74d-4db6-9967-897db6a9e172", "comment": "Malware payload", "value": "5317d93ee15db4a98aa35a2fb6ee1a6643afa8660a044237d72e0cb4bcd2183e505333a0d7ca52f906897af9243fa6d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306678, "uuid": "2c8510c9-9bb2-470d-827d-cc6af1cf5e63", "value": "T1EFB633B13185D239C5535839CFF9B09C8E26969B437207EFB67E6EAB6D003C57224DA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306678, "uuid": "afe80bdd-bfa3-4d62-9d7f-05e2ba6ec229", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306678, "uuid": "9c36eab2-5fac-436c-b6d3-e97721da92fd", "value": "196608:bGMxW4bVu+oC2kKXycTjNphHiGsuNWxa31txv/XlwcqjNVfQKBn03YGzV:N04PoC2krCHiBu4xaFtbIimn03FV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306678, "uuid": "75af22aa-801c-48c4-8fa1-6f95220dcfe7", "value": 11359232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306678, "uuid": "e39549dc-29a8-466a-a3dc-ca54b30a6824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306678, "uuid": "cc0e1da3-df50-4b16-9ae3-edc803fc7d7f", "value": "57efd1cfac6b5f995efce90065ddd272049d232f8c33749f0ed7b4d2220456c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdb165d-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303553, "uuid": "36b04cf2-412d-44c2-be07-21850068eb78", "comment": "Malware payload (AgentTesla)", "value": "5d5f6e7e73465c4d7dea9291d51154d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303553, "uuid": "71d02bd5-e2ac-4670-8be5-a68f9a623018", "comment": "Malware payload (AgentTesla)", "value": "57f8a8b81cb321c1a8c1f8f65c8e9dc453a1f18c008fba870fe10f74aeb9a06a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303553, "uuid": "ad4132ce-1762-4aa6-8f90-92fd06d16537", "comment": "Malware payload (AgentTesla)", "value": "2d1129778be90355ec0b4dc477651a27d574b0be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303553, "uuid": "4ef52596-cd33-49d3-b48d-8ba0a9882099", "comment": "Malware payload (AgentTesla)", "value": "2ebda809dd49a61d409e385be584557d27e342ebd4aee6391c8699f8aa418577dd19f0e5ccf52629f0be3d594792bdd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303553, "uuid": "c0c05080-f396-46df-9f95-30b36493fbe1", "value": "T118E4015037759B12E9B69BF156B2D2310BBA3D8E5A20D3088EEA5CDF307AF541950F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303553, "uuid": "80c24977-2174-4f3c-bdc7-3691f66a0de6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303553, "uuid": "804729f8-d3f5-4822-a36f-61cc82159c0d", "value": "12288:/MoA11DCFbVcOawwoNLPlZc9kaw3nCwJRWx0IR1Hok0DmW6mTwjhZIHB:/MoA1KiEw9kN6x/zoPnghZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303553, "uuid": "1df2d9c3-3e09-40c9-9981-f87c2b24a186", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303553, "uuid": "a756a8df-e3c8-49d2-9f49-c98785f9edc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303553, "uuid": "65c57e87-207a-4cf7-8fce-f711f1b8431e", "value": "57f8a8b81cb321c1a8c1f8f65c8e9dc453a1f18c008fba870fe10f74aeb9a06a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f62130c-027a-11f1-a129-42010a9c0007", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1770286084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286084, "uuid": "49949667-c4fe-4faf-9fc8-32ca0a77ae00", "comment": "Malware payload (Cobalt Strike)", "value": "a1c7a313f1bfd62f3505e6cfa994d36d", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286084, "uuid": "8c692f96-f2d4-4c7c-83d2-8fc970d78a6c", "comment": "Malware payload (Cobalt Strike)", "value": "5804ab1cab517dbc9c314360988d0f44e9226626071c933c86f336fc68d89ff4", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286084, "uuid": "cc0d6f9f-2fca-4c65-8765-85767dd2fde1", "comment": "Malware payload (Cobalt Strike)", "value": "a9b1a25d4fe88a07a645bbedaa904d7b3d4387ff", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286084, "uuid": "ab77cfb9-6f73-4845-a728-de034c5fc4d7", "comment": "Malware payload (Cobalt Strike)", "value": "a1f621ef475afd3898214c6e3e2c63f14dc9e4faeeb4d6e647adfecdc9d2fde8d261e7d17e4bd37c388a5864b548a381", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286084, "uuid": "67da5766-0a90-4897-be05-b60633cc1b5f", "value": "T1F8755C07BCD118B6C0AA92328966A5927B31BC480F3267D73FA0B77C2F76BD05A75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286084, "uuid": "3158f8e9-b6d5-4385-9e22-894520268428", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286084, "uuid": "1a5d7f6e-142d-49d1-8ae7-7343feaf56d7", "value": "24576:rfQo61AJwYcpqYFdbU7LHEGwzNlwR9GBk11DQw+b:rYo67Ycp3ZU7LkGwTs/gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770286084, "uuid": "c80808a0-15ea-45b7-99c6-667d1c1adcfb", "value": 1701376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770286084, "uuid": "8d69fd2c-0886-4579-b8e0-c3b85024e92d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286084, "uuid": "e650b73e-0e29-40ab-9c98-e66ae007920a", "value": "YYdispose_loader_20260205_105004_22rnzy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5385ede3-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770304022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304022, "uuid": "512f974c-e19b-46e7-86c3-7c5279c061bc", "comment": "Malware payload (Formbook)", "value": "6f66c15617c143b1552925670a619042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304022, "uuid": "6b4c8f2b-8503-42d7-9df7-cd6b6b17f69e", "comment": "Malware payload (Formbook)", "value": "580d879e602682dd79ce48481acd26611082d62ad3174a09813e84bd5b5a85f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304022, "uuid": "f2fa7b84-81b9-416b-9fae-b11a189ced6a", "comment": "Malware payload (Formbook)", "value": "0c7eb2b5d5538f76d3e27cba125d79f15be3d306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304022, "uuid": "2c4cdb83-ee03-4bff-aa5c-d3a9cc2c71e0", "comment": "Malware payload (Formbook)", "value": "6fe51642c68e2249c576c253353e8244f0b43bc653ae02117df8943b93bbad319a42b64184bc8f86e614be7d9be0c34d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304022, "uuid": "a2918a84-b081-48aa-a943-f4175d3fac1d", "value": "T1B845BF027381D062FFAB96334B56F6115BBC79260123A62F13A81D7AFD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304022, "uuid": "0ce92a33-a93f-467a-9ac8-22f2365cbfb9", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304022, "uuid": "7cbcc217-687d-41f8-b82c-b8fd84d8ada8", "value": "24576:W5EmXFtKaL4/oFe5T9yyXYfP1ijXda7ksXQMjJvnw+NoQjm:WPVt/LZeJbInQRa7kaQf+NoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304022, "uuid": "d2c8955b-46fa-4355-ae9f-5d077b522ecf", "value": 1244672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304022, "uuid": "590bb54e-3bc1-49b8-96fa-5210f183c493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304022, "uuid": "db4fad5f-6761-41dc-bc33-44d645ee7076", "value": "580d879e602682dd79ce48481acd26611082d62ad3174a09813e84bd5b5a85f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327831b7-02c0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770315992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315992, "uuid": "7ba3faa6-3b74-4360-9018-235d4a5cbb70", "comment": "Malware payload (Mirai)", "value": "ba46f4c0d99bb6af2c876936ab3b133b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315992, "uuid": "a1010658-7f41-4635-9225-d506d20aa82d", "comment": "Malware payload (Mirai)", "value": "592fc4a290af11107f8eb49aa3a3752d8a7822971f3af3861a31512f48de0b0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315992, "uuid": "3f2aca50-dbed-4fa3-b77b-941120be61d4", "comment": "Malware payload (Mirai)", "value": "0f4c6b73151ff2f2d45699c8d4f52dca6300d20d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315992, "uuid": "3676d90e-ff40-4044-a7f8-b2a654054f0c", "comment": "Malware payload (Mirai)", "value": "fa1b198b627b84bb8a4d84d817dde8f2e7814dcfdf17a650362d33bf0ee4606d70ad64a513ee520ed545ae51005b00ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315992, "uuid": "e6aefc74-bfd1-4d05-82f9-0c3d09f117bc", "value": "T1BAC32A85BC828A2289D413BFF92D01CE331727A9D2DF7212DD111F2577CAA6B0DB7652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315992, "uuid": "fc13142c-452d-4d4f-8ed0-403394d158b3", "value": "1536:/DnzCQTHuQ+NTwFUYl4g/9LyRb8MEWVTEoa3pCJG7c5TG2ekETvGVGNypfK8DxDo:ShQVnQ899wekEChf1DAtKVklaHz97VW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770315992, "uuid": "316ab5b4-0307-4c89-84b4-b582e5831972", "value": 119279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770315992, "uuid": "ecb3a485-df88-4b15-a512-f9c96120aa53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315992, "uuid": "afc41da5-a5ff-48d2-b8b7-04b6fe43c1f1", "value": "systemx64.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be52cc1-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307391, "uuid": "e340fda0-414c-405f-abdf-a8239ce31ecd", "comment": "Malware payload", "value": "f521d7b0690b70371bf9b7b9a8e88018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307391, "uuid": "31673a68-4af4-44b4-8537-9da2fa2bc465", "comment": "Malware payload", "value": "594b31cd6474437b5df890641ed8848653bfb6a2df886a9475c235f2df962424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307391, "uuid": "1cac764e-2c5f-41a8-bb80-979dd56e9984", "comment": "Malware payload", "value": "166893a759132ec7e30ad137df78a62997a9cad9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307391, "uuid": "bee1aed6-3fb2-4f4e-bfef-e4ae92d12b01", "comment": "Malware payload", "value": "b649e069af1060061e3466c11e85afa7a8afe1d96d56389e24fcc313741e8d2abe7389cf082bb3f637260a83e484b433", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307391, "uuid": "ab94f7b6-4b58-47b3-b79a-6ed588974e05", "value": "T1F485230227F925B6D0B997F641F2129B9A71BC214F2552DF02DCB6ED1A23AD0C630B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307391, "uuid": "480fcac4-dac0-4783-b05d-f9e0a52d713f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307391, "uuid": "4865f733-999d-4bfc-b5d0-5607d284d9d3", "value": "24576:A3dtYLl8VsxjJMRVuvTNYD4IzE6iYXK8uTPWfufRa9LfDRsznDHlW5Kn6UJzPVBw:XlCsfQuvTkb8H6fufoPsznLlASJ5w8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307391, "uuid": "a2b427e8-fc71-44f4-92c1-2a652e717fe4", "value": 1795584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307391, "uuid": "6ad5decb-7b1e-44f8-806d-6b3a0c216223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307391, "uuid": "a0eafb53-449a-4701-89f4-20a833f75264", "value": "594b31cd6474437b5df890641ed8848653bfb6a2df886a9475c235f2df962424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d2d787-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770303335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303335, "uuid": "12f5b778-bca2-40ec-95d5-5f15b987388d", "comment": "Malware payload (Formbook)", "value": "a2caeafad8d6e4f85de3030f8cb05424", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303335, "uuid": "0b9beeff-0216-4465-832f-deea126643f4", "comment": "Malware payload (Formbook)", "value": "596b1fc580841b99d13efcef78bdbda84d55e92f87d962126fbfd0e37cd880d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303335, "uuid": "668356b0-8200-4548-b29e-f5ce705ad565", "comment": "Malware payload (Formbook)", "value": "f1c11a3bb7f84884b2bbfb6286504981b48999e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303335, "uuid": "26f63e16-210f-4c0e-924d-a5533477a302", "comment": "Malware payload (Formbook)", "value": "454ae403c7ee24881c1f2c0dd6c014b7dc106234ba1990a0be0b2d81baa086726439a4383bf16900cbb9e6a374ebd653", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303335, "uuid": "2df07cb7-8b48-42e5-92d9-629544b5492b", "value": "T1EA35ADF037689A4BC4A6DAF30623CA704375EEC55602D2DADDE5FADF34B8B005A14267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303335, "uuid": "dcbea790-4b66-4e69-9482-a93068b8369a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303335, "uuid": "f670301a-4797-4aa9-b5b2-8ffaf8e198d7", "value": "24576:pyp9VVrFAvJ6IpavmGKUMy5m33y545FT99dwH:pyp9xNvHKUMbyO5tndwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303335, "uuid": "68a565d8-1021-4883-8d48-f777f1ea574a", "value": 1132544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303335, "uuid": "a0e714a4-3d45-4063-a976-0a32bffbbe3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303335, "uuid": "ce131841-d824-4510-b6b7-455c11b5cff6", "value": "596b1fc580841b99d13efcef78bdbda84d55e92f87d962126fbfd0e37cd880d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550588e1-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770307890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307890, "uuid": "8538a999-15d1-47c6-957f-0ca1c4cc31c6", "comment": "Malware payload (Mirai)", "value": "5f65b7dc6d20db8cef8151f51f45b6b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307890, "uuid": "cfe431b5-5263-4a2d-afa6-a352889b4802", "comment": "Malware payload (Mirai)", "value": "59a3665b991673a10c3a8fe14f2bb9e9e012e47a753f25702a8ca5508494b8d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307890, "uuid": "7ec9fe89-cd2f-4644-80da-ab62203f8648", "comment": "Malware payload (Mirai)", "value": "c6efee095af5e13bf6234ee645a9f29aa9f55237", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307890, "uuid": "9427756d-84c0-4052-9f9d-b08d77662670", "comment": "Malware payload (Mirai)", "value": "a14544b6e4e6d9c9d4dd778a9685a2c7c19c5133109b040ab7463eda9a8aa87ae60589436ed84faac210528ec5505f20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307890, "uuid": "8db5487f-d82b-426a-84e3-9bfb9fb67800", "value": "T1B7C3123EBE86E99A54F4A7FB6D9F4873F50168C5880058FED2D00125176C31BEE34A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307890, "uuid": "02e62a71-8929-43f3-ab66-add432c85035", "value": "3072:wiuOqfEgIGz7wTLufsSP0fDut1qCrEQgujrmIMyZ:7Ccq0TGeqbrEQguiyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307890, "uuid": "400bca55-c3a7-4479-b478-e481980bed33", "value": 121504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307890, "uuid": "838518b6-d841-45fd-b295-2cb5f8042b93", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307890, "uuid": "11308659-6676-4a3c-8073-d32950932fd6", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16363d0f-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770307355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307355, "uuid": "a942f0fb-dbf1-4827-8d90-62faa77a3a36", "comment": "Malware payload (AsyncRAT)", "value": "1aa2e49cdfae604498f0fc2b89574b5d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307355, "uuid": "00a1d0e7-0582-429d-ac96-63041ada1467", "comment": "Malware payload (AsyncRAT)", "value": "59aaeefcca4d5fbcb99478f4af2b378911d1e85c7cc22664e5519d460754652a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307355, "uuid": "7ba12304-ddfd-428b-b0ef-515865630641", "comment": "Malware payload (AsyncRAT)", "value": "715ea1fe6862599e5f745e21a0e2114f156ef20a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307355, "uuid": "0dbbf903-15c4-4037-9b99-81eab1534144", "comment": "Malware payload (AsyncRAT)", "value": "fd4e4e6bc1ba04afec5f7e52d6ef16ddf3938231ca833faf9301d7bf566d8c235c31eb72bcc7ec0206017a6d1ddf8bec", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307355, "uuid": "ab72ed06-4165-43e4-bc2e-30c4eea0dd3c", "value": "T1B5E37B242EEBC03EF2B3BF629BD475EBD55EF762290AA46A1051034B46139C1DE91C3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307355, "uuid": "be10c3b8-ebf4-4236-87fd-c89fb0131524", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307355, "uuid": "2fbc4165-29fa-4cbb-890a-44ea1f3ce2ae", "value": "3072:op9JyPwPUJini3jloTum5Jm1IFBqbPnvWejb68pS9ZIoVO1OciUrD:op9Jyy4inizlo64yEcpi8Mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307355, "uuid": "613f23d5-6418-404a-97ba-e6f6fb436612", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307355, "uuid": "87be304e-e0ec-4e50-9820-00944c4a1454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307355, "uuid": "4879654c-71e2-4e5e-b597-78e2b3f9ba8b", "value": "59aaeefcca4d5fbcb99478f4af2b378911d1e85c7cc22664e5519d460754652a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65818fff-026e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770280859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280859, "uuid": "8c801a90-2947-447e-a99b-cb3bdb6b7684", "comment": "Malware payload", "value": "e2fc22b92cace6eb0a4a1ff5a1ea9cc2", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "makeway3-hopto-org", "colour": "#EBEF6C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280859, "uuid": "a5004d66-3063-46df-8034-50c4813754c6", "comment": "Malware payload", "value": "59d022adfd679af667be1a704355bac5ec6f4499989355935438590ee77103e8", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "makeway3-hopto-org", "colour": "#EBEF6C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280859, "uuid": "a2a1b8bb-5970-430c-8fa5-dd6483a60874", "comment": "Malware payload", "value": "df930932d050da0f11b1245873b0beb01f3f6e10", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "makeway3-hopto-org", "colour": "#EBEF6C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280859, "uuid": "73c6d928-3d28-4416-9e4a-793a93bd6074", "comment": "Malware payload", "value": "849bb27987f81539c64129f912500b5659803471706e13ac8e14d959551a21829101c4389dde05ffbf42185f53fc811f", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "makeway3-hopto-org", "colour": "#EBEF6C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280859, "uuid": "07234c88-f30e-4d42-9ae6-979ee3f75571", "value": "T150941222EC6DDC9108ACA12528542C8A6A120F3B4C58BB393F9E6B4D1F4E25FD4757FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280859, "uuid": "3ef242c2-5922-4954-9135-722ffdec2038", "value": "12288:sz5ffxfItTZMU+vonBHNGQy64szN0UthdUW:sNSj+vonpgQEs9RUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280859, "uuid": "5bde50f2-bfd4-4a36-95c0-32e5814afb27", "value": 418477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280859, "uuid": "167eee16-0a00-4889-8c0f-9daa169a8b65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280859, "uuid": "83de5317-f712-47a9-9dc3-3bee2a549108", "value": "johnn.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f319e60d-02b0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770309444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309444, "uuid": "2d5450de-df7f-4df7-8344-74358d4b15b5", "comment": "Malware payload (Mirai)", "value": "4f3f24ddcf5a70e6ef36be6c5cd57005", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309444, "uuid": "fa9ea5ab-9114-4ba1-a051-75cbe7eaf40f", "comment": "Malware payload (Mirai)", "value": "59d2710a3cb661d9ac9846fe5931381c8c895cf329aa15f78049d81708d9ea90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309444, "uuid": "83e14d26-7781-4b84-9729-f01996bb6491", "comment": "Malware payload (Mirai)", "value": "f98836c897f0dc08df7916c15caaa6ae7f454f08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309444, "uuid": "ddc08af3-95b1-4fbb-8783-929ee4ab9aad", "comment": "Malware payload (Mirai)", "value": "269451f31c28d95325cee0698892378f002733286fef008eef9701272f4b89a95d6253a3632df7eacd19940c8000b233", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309444, "uuid": "c52ca808-5ef1-43e4-9b20-f018f4803bdf", "value": "T176B3026567129DD7D4DEDE301C786DE4790A42B337FA3E848C0895842DD78E8622FBE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309444, "uuid": "34863181-f958-4676-a177-f6877b7dda7e", "value": "3072:c3/OisEboPLnJje8hKwHSht3QP4mYCc4zi2L:c3/Dn2Jje8U/3QP4eTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770309444, "uuid": "e82e25c2-39a8-4b57-96dd-97a647e2deee", "value": 111588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770309444, "uuid": "61b89285-fe98-4523-864a-c889bbb64ff8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309444, "uuid": "4cd36099-a56a-41dc-a66d-1bdcbcc64009", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c82563-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307925, "uuid": "74497a06-4498-4731-8d39-1a485bbd431f", "comment": "Malware payload", "value": "de4fae5d9f37fdf10412f1732d7a2b7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307925, "uuid": "36e99aa2-67d7-4548-a373-c1848d26ff0f", "comment": "Malware payload", "value": "5a3dc333f94a982bc6e42f0b944880dcf8bdda1027e4be1f13c30dfe124b627b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307925, "uuid": "cdeaa2af-d138-4d12-8ccd-4bb77e7dc214", "comment": "Malware payload", "value": "dffe66a7c8baa97ef6e2925a6295c92d7a1db5e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307925, "uuid": "5dda37f5-1c6d-4f49-af66-026d957d7c8e", "comment": "Malware payload", "value": "b448735cd231d57093f48ac6b78ea61f56cb1519a3789b2a2011619524d2ba3f5f4a507601a83dd09ee03a06c31a6db6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307925, "uuid": "d9ae7b31-c78b-4fed-9423-55a9887bc6b8", "value": "T14AB5121F1AD241F4E4E9CE34A3FC05A852F0A6AF9521A7BB544952F4DF2174EB6032B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307925, "uuid": "37a4912b-3d6f-4d06-b8f4-18fee20e9382", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307925, "uuid": "69425fbc-9baa-4e51-bd36-ff0788ca91a4", "value": "24576:6FmpTERHGAWq6/p3ojZPy865D8LoA3B/UoMOmxYC1xa7Rl7VL5h4gXTkZyPM2CkQ:C5GAmOdPy8A8LhB/rS87PWEPMc4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307925, "uuid": "14521bb1-d3ae-4df7-9d88-1c6f584a1679", "value": 2433024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307925, "uuid": "5c5d4fc3-8ccf-4d2d-9d56-8dd8dfc759e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307925, "uuid": "adf3ffcd-4b7c-4406-ab02-a8002356192e", "value": "5a3dc333f94a982bc6e42f0b944880dcf8bdda1027e4be1f13c30dfe124b627b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc63b1d-02ae-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770308198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308198, "uuid": "496e12dc-9c71-45cd-a3f5-f4fa4e0737bb", "comment": "Malware payload", "value": "16c958e182d76a1bd72e8eff74ad9f6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308198, "uuid": "98b4efc1-2a19-4615-a001-d3c63e7cc88e", "comment": "Malware payload", "value": "5a6c3235fc5a7dc5f1b347e67560a2eb6dd4c46fc5b90042b8dfe0013216eac8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308198, "uuid": "473a3e1f-7b78-42df-ac53-716eb1cd4126", "comment": "Malware payload", "value": "653c2094850514988e53c777fc864886268e7496", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308198, "uuid": "501ada40-c39a-4a00-af28-c86f842d345a", "comment": "Malware payload", "value": "4c48fde90b713bbf7305875b04dca5b7e4a27df2337c53e989f0f78bb7f9542f5d2305d8ade5a3047514d37914c821ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308198, "uuid": "55b901bf-91f7-4290-98be-48e4dea18b3a", "value": "T18B852372B5E220FDE0A9A07144A062F697B338B2D6F5DBBF06904D451F672A14DBEF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308198, "uuid": "18129e8b-f06d-4d9f-b155-7164172a556a", "value": "9b7e95b6b6ed15c2747aaf0cfef36388", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308198, "uuid": "a86e7428-773d-4d4d-8fda-fe155f68cc26", "value": "24576:f395EtaJ5yizMDig3HRIGD47YC6X0OnF4U4CMzr1w4zwpWjxFXn5pLImA:j+zHR4uX7wL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308198, "uuid": "99c08f54-b5d6-417a-b714-ca4c92b43053", "value": 1737760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308198, "uuid": "1dd9f289-0e52-4ab1-ac2b-06886f171e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308198, "uuid": "e9f17e81-24cb-47ec-af03-1dc09e6c53ea", "value": "5a6c3235fc5a7dc5f1b347e67560a2eb6dd4c46fc5b90042b8dfe0013216eac8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3cbc8c-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306263, "uuid": "41df4d47-0a41-4b71-a2f0-276dc236aa3e", "comment": "Malware payload", "value": "02e49f55f0296c80af151b27fb21242d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306263, "uuid": "4a220e4a-cfac-4803-ba50-3e03d4e204d2", "comment": "Malware payload", "value": "5a703eaaed81fca9c45cc2b98bd3e7f4a9c8fb749a83ac73bec45f43fbaf9cc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306263, "uuid": "44ee8155-d6b8-4090-97c1-bd9aeaf445f5", "comment": "Malware payload", "value": "e34b1baf6f8c3007dc0228ebd4caea3289a48e56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306263, "uuid": "a2f3be83-582d-4644-a3ba-eca9b9b459e7", "comment": "Malware payload", "value": "01714ae5d01e9d1052f87b56116726cfb0945b4c1eaae6b98ba15b797fabf96bb9a151cda1fe3d7f6bf13cf6c40233c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306263, "uuid": "6c62fbe1-c07d-4415-9844-071cb2fdbdb9", "value": "T10A247A67B42CA7AFDEDA2F32ADDA892353B65FC4C991103E0C44730E3C671095E39566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306263, "uuid": "31d9a1d3-96dd-4e60-92e9-ebea1a814864", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306263, "uuid": "e5c96ec7-14b3-4feb-a724-68bd4ce28b08", "value": "6144:KynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g3L:JnO56dyO7Wc8oNrRHw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306263, "uuid": "3bb7af0f-cb40-4c64-812d-818ed4672223", "value": 227691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306263, "uuid": "e3308a73-17d0-42a0-95b2-bd498e15a179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306263, "uuid": "ca266e36-d84b-4e8d-a52d-e969efd93e80", "value": "5a703eaaed81fca9c45cc2b98bd3e7f4a9c8fb749a83ac73bec45f43fbaf9cc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac50a899-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305459, "uuid": "6ca860e9-58f1-431e-aaed-38ea10dd0730", "comment": "Malware payload", "value": "01766d161cc39085c6a1db934fc17cc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305459, "uuid": "d86d2705-5647-4c92-8fad-044853e37e04", "comment": "Malware payload", "value": "5a7e9751c4f4c4255cf2b01b230fad43d70fc0c5068501b70f8a5e368def03db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305459, "uuid": "2e13f229-a0ea-4723-ba36-00c4685377fc", "comment": "Malware payload", "value": "368e52700c474797ed3955f34ace990ddefda6ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305459, "uuid": "1fb0d519-088e-46e1-9dd5-304db2212a42", "comment": "Malware payload", "value": "73c3caaaa44086735348cc6897dfbe7b93221b883760d9f0ea9bb095cce160d3eaa3fa67ad773cb50f68c74f104fc4cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305459, "uuid": "ce611db6-63ea-4411-b90f-7bb64d14ceef", "value": "T13E45BF0273C1D062FFAB95334B56F6115BBC79260123AA2F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305459, "uuid": "c8ffcd20-593e-4a8d-b6cc-ffbc78a2ec6f", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305459, "uuid": "22d9d4f8-8e77-41d1-a08d-0948dbb38af7", "value": "24576:85EmXFtKaL4/oFe5T9yyXYfP1MAXDzojCcLtw/LTtZe:8PVt/LZeJbInGizojCcLtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305459, "uuid": "31d14b2a-436a-433b-bd5c-6271ff75efee", "value": 1255424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305459, "uuid": "0c37b6b9-e4e4-40ed-b0f4-f082423f72d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305459, "uuid": "878b20f8-0d7d-45ab-8136-2c1ec916bf0b", "value": "097dc4aec7ed02e13875b9747b379156b142f7f80ed40a0798ce98f6dde5600f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593676d8-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327224, "uuid": "bb2b5a18-826a-489c-b111-694b50a8800e", "comment": "Malware payload (Mirai)", "value": "f8c8e09e901de11b5974e79eeb90491a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327224, "uuid": "8443fd64-a3ef-4c0f-b081-96dc084a0e49", "comment": "Malware payload (Mirai)", "value": "5ab64cdfd3c20ed9855d5559fed461be35c5f1e996a7d4c2366c69119e158993", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327224, "uuid": "1c6136c6-7624-48f4-a4b7-54dee4a10378", "comment": "Malware payload (Mirai)", "value": "ce42b79abf156af99d998fe276dd6f7ada79ede0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327224, "uuid": "d764a9af-c2dc-46f9-8e37-a6a643a33153", "comment": "Malware payload (Mirai)", "value": "18119579308d582cb7f227c509ece15d0bfb4c37f72f69414ac9619839ca0a4caf5885574e13ec3abf40c164566d07ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327224, "uuid": "303d7b38-91fb-4969-b32d-2e0abad87af2", "value": "T11503E1456304298AC9235A7C32EB53D32BA60B853B13ED4E715DDA314E5927D3E0BB89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327224, "uuid": "2ccf3c6f-437a-46af-a7a0-ca4c4adb2da7", "value": "768:5kXPBD+coyX7Pvy4kcLYcv3jNJtxEE8fT3JRr+Cbq/JgGlzDpbuR1JSq:5kXV+cbvy4kAf3lI3JRLbSVJucq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327224, "uuid": "e7b511cc-35c1-415d-a926-d36f1a25e52a", "value": 41192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327224, "uuid": "9160ad56-bafc-468b-ad10-b8fc624400f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327224, "uuid": "e8b67826-04e3-46fd-a8f0-0353b61f96e9", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c4e733-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770307455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307455, "uuid": "687be617-b02c-4285-8b10-b67e25590df3", "comment": "Malware payload (AgentTesla)", "value": "724947b7bd14a95ba4235ad18ab8ece4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307455, "uuid": "ab7bf823-63ae-4406-9ce9-83d7df662355", "comment": "Malware payload (AgentTesla)", "value": "5ab7c600781f7825dcc52226f3db6cbb75221847180cb0838c354e85027f5cf9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307455, "uuid": "fab122b0-c86a-4985-a979-7d96008e6623", "comment": "Malware payload (AgentTesla)", "value": "2e40565db08f721f34fecd9ddf50f00ce11f188c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307455, "uuid": "e90e62b8-55f6-43e6-a6ab-01d8639f1bd9", "comment": "Malware payload (AgentTesla)", "value": "300196e3e7121da9439a69a0137cc54bf91b5da845cfab9988e075480155b97f3c78312c5cdd1724a36ad49eedb97787", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307455, "uuid": "3b056361-3a76-4f67-adba-b2bd09885cbc", "value": "T1E565CF0273D5C036FFABA2739B66B24556BC79254133852F13982DB9BC701B2273E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307455, "uuid": "ea1e2e3b-1e1d-4cb8-91f6-2d4dea3f1c51", "value": "649f6ed9a4d576c154bbc0357156a4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307455, "uuid": "5b94963a-b358-49e0-b4c8-6342afb7e4c1", "value": "24576:IAHnh+eWsN3skA4RV1Hom2KXMmHadkeMnBrYNTe/WUopTZOaXLP5xoAaCkr5:Ph+ZkldoPK8YadkPBre7UgTlbP5xoAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307455, "uuid": "7c07ef9b-27d1-46c2-8876-00d48d8bd74c", "value": 1536512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307455, "uuid": "35a90782-5d3c-4ff7-8444-53aa7c6825f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307455, "uuid": "74adad4d-17bd-4ac4-8c3f-728082bf467b", "value": "5ab7c600781f7825dcc52226f3db6cbb75221847180cb0838c354e85027f5cf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844c99ec-0292-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770296373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770296373, "uuid": "7c395b6d-de81-45ca-8341-5312989af702", "comment": "Malware payload", "value": "7e104aa64d042fe09c080fe583d4a44e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770296373, "uuid": "887ef3b4-bd6e-4732-be89-b846ab7b8752", "comment": "Malware payload", "value": "5ab8b8ee8208745265bf714279396944efe031eb8ce646339112bf46a8da7486", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770296373, "uuid": "c21cdb0c-a927-40bd-8e77-353cdad37c67", "comment": "Malware payload", "value": "027da6f99d69f3c37feec2a9dc266d7908406393", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770296373, "uuid": "b150fee1-7791-4247-b5ed-37485d814b43", "comment": "Malware payload", "value": "c1e25e789c4e4a077133c8718eb77c5489f2c5d8325f24ec6ed18fd306bbc1c9cb226b703f7864a38e083a5d5caf0ef6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770296373, "uuid": "52be87cb-8709-45a8-8f3e-668ce1cd8fb5", "value": "T131762313B2CBE03EF55A0B3B05B2A16894FBB6616823BD56D6F4849CCF290501E3E757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770296373, "uuid": "186751a4-34b8-4eab-a78d-d2a2ae0663b1", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770296373, "uuid": "4b3dc1d5-cf47-491c-bd5f-bbae72fe4ef6", "value": "196608:B+euj7ILxyqlXdUalxGr82Q8E807sge6gdebVbtzJL/RqTh:BijKyqJZd8E8xoggbLRRqTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770296373, "uuid": "f39982ab-2379-4d64-9f0d-294b746e0499", "value": 7742320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770296373, "uuid": "dfd74ce7-5653-49aa-a847-c24b2f4f063a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770296373, "uuid": "9a3c9030-8012-48f1-be66-137dc4ec08ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d20c27-0229-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770251473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770251473, "uuid": "fe03884c-64e0-48dd-8019-bd949446c784", "comment": "Malware payload (SnakeKeylogger)", "value": "5881fc6933428e2f21e4c416f9ad7ce5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770251473, "uuid": "4ac2669d-0f8c-4497-879b-420614daa43e", "comment": "Malware payload (SnakeKeylogger)", "value": "5b9a6e28ab31574ef89c87a0baed9a86aab4317cc5905c1496c0a57d72b4da82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770251473, "uuid": "da03bf75-cdf0-4d07-bc5b-9bbf1a1bb787", "comment": "Malware payload (SnakeKeylogger)", "value": "482302394df283b08aaeb2ba59188952202b5b75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770251473, "uuid": "2d8d64b6-8399-4213-a22f-fa734f852810", "comment": "Malware payload (SnakeKeylogger)", "value": "7e45f1ca29927eda0a74b1a3bd92590f72864bc5499eb792cb0bf79b905a46192b402041a9b674e72be341e5b3287a8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770251473, "uuid": "77d89011-39a6-4afa-8c55-43eb99975d66", "value": "T15A35AE027391C062FFAB92734B5AF6115BBC79260123A62F13981D7AFD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770251473, "uuid": "b965f994-04ef-43a3-bc99-ce6853535493", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770251473, "uuid": "8ebbc640-11a0-4a2e-99b6-6dab55fb8e24", "value": "24576:W5EmXFtKaL4/oFe5T9yyXYfP1ijXdaZ8Oj4C4Z:WPVt/LZeJbInQRaZ94C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770251473, "uuid": "58f00c40-aab9-4651-bab7-0397d45145b3", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770251473, "uuid": "ec8162bb-9a5b-42af-9e1a-89821a4d98af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770251473, "uuid": "03ff3ecc-dfd4-4368-a4ea-93f5e1bb8dbf", "value": "rParcelnozto395241214095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e883cee-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770305275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305275, "uuid": "fcac802d-d747-49d6-adc6-73202c2509fb", "comment": "Malware payload (GuLoader)", "value": "c79f2f323943899c0f19a6ba54db569c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305275, "uuid": "7bcfeaab-3261-4a2a-aaec-247fd539aecb", "comment": "Malware payload (GuLoader)", "value": "5b9f81f49d46c692df2aef1af5c708324551d0ae5b6103148ccd8afb761c17d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305275, "uuid": "fb3ee0e7-b237-4894-8770-cccb85d02a4d", "comment": "Malware payload (GuLoader)", "value": "17de11ce5097c408db93ffc0a535cdb328e3baf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305275, "uuid": "36916752-6f79-4d8c-8105-8d62398c102e", "comment": "Malware payload (GuLoader)", "value": "cf6a144468f3fc498a5492606e401c5e3b991be42d2eccc429578110bf015dbdeb1ef59cc32388fb5045b1062c8bff33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305275, "uuid": "d9edb255-dfe5-4791-8212-c90313322bd5", "value": "T1A7F4F1827700D983E3851378CCB9FAF467667FACDB579727BB603E1AB8332425906452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305275, "uuid": "6947870c-6705-4d6b-9c61-72435d462a47", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305275, "uuid": "b6d0744f-3180-4d55-9c86-07a2b3cc1002", "value": "12288:oX4rQ/u9FAqLK7pB85pKT77HpBdvGa0thvgHOfsXGtZ1VpB06CXOBD/2xXy38C2g:a4rQ/uPAmK7L85AvbpBZorvXfnZ1VpBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305275, "uuid": "50177e72-c46f-49e9-a47c-1c4e165c7ad4", "value": 781808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305275, "uuid": "fb8ef224-10d4-4169-9383-bdbdb3160fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305275, "uuid": "bc78f9d3-a242-4765-8922-1add4829ddd6", "value": "5b9f81f49d46c692df2aef1af5c708324551d0ae5b6103148ccd8afb761c17d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d26a9e4-02e7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770332922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770332922, "uuid": "078c6e63-9073-4140-af11-d90779f6528f", "comment": "Malware payload (Mirai)", "value": "edfc22f9fa3ba8389aab63c9b135cde2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770332922, "uuid": "64e10432-eaa7-4d1b-9726-262d36a8c5b0", "comment": "Malware payload (Mirai)", "value": "5ca2b47cc1b1ea9fb0eb8bb68cc6b9030e9bdd7575fa5cd490b8c0fa6e7e9b8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770332922, "uuid": "17f5e1f6-7060-44e9-b2fd-c93cc9f8f34a", "comment": "Malware payload (Mirai)", "value": "ff45726bb2955a04d5d2023b9112e93f4b6fc3a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770332922, "uuid": "b065b020-38b0-4991-ba4e-fa8f8aa41a56", "comment": "Malware payload (Mirai)", "value": "67e1159b9ea8ca4bb20634e8d62be625766d2f2f96381c278b5e2b0f7b7e76cd1afaeffa6f37883d7d7c6bf9108ef1b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770332922, "uuid": "d03c0159-efaa-43ff-92ea-836bc41d1839", "value": "T123C2E1A3A4E98D05C863423B6E1F159B11386839134DEF1E363AEFEC63464B4A179D87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770332922, "uuid": "c8f81c13-7f68-4944-88f4-e92a1ae65c88", "value": "384:MRSQ19WXUx5+bkbRaliVErjrL9VD9jPwrSaf5dwapDyCTYHHJC8oytPFnAqV/LlH:u5+Kcrb9VDJe5FLTYTlPFnz/sPF9slj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770332922, "uuid": "71629f8f-e8ac-4eea-b532-532ef45b65f0", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770332922, "uuid": "9d87ac33-5248-40bf-9646-47d20dfc00dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770332922, "uuid": "7f2b4476-5038-4e6c-a79d-4776565987ff", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd8bca5-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305246, "uuid": "3512eba8-780b-4d75-a500-98dae774290e", "comment": "Malware payload", "value": "9b2d90d5d4bfb141e6f99bd6b8e985b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305246, "uuid": "682bf633-cb3f-43ea-80ef-9ffa72d92a91", "comment": "Malware payload", "value": "5ceb4554bc5195a2fdca7417ea892253a723e97c0b0d70f497b13cfc8414db0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305246, "uuid": "a4cb2f88-dad6-4da2-a0c0-9b45e9b1e395", "comment": "Malware payload", "value": "b9e2003f67a721b73d14723ee302b666d91b88d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305246, "uuid": "9a1a83f9-9255-4f29-9ae1-45b1b7ebc799", "comment": "Malware payload", "value": "55ec75f992307369962d2acd75c2dfaf1f6326a37df3d126ab8cc32823f018aee3950241f62fe5019381c4688ef799f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305246, "uuid": "dbfa420c-c327-4a4c-a468-03eb2274cdfe", "value": "T1F0A4D612E760B52AF95349713E78A647752C3C361581EC0BBB889F9A3A71983B0F471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305246, "uuid": "eae277b5-f8a5-4e4d-bef8-a4ed2f8a24b9", "value": "6271c807de773a39fc1eda4b911bd652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305246, "uuid": "11cad257-1ff2-4ae3-aceb-7a18ff27690f", "value": "12288:JPWPRtvQfS6OW5fFZS6mtgkap9lWAe4gEEtVTYzlw:kLJ6mqhp9lWAPEtVT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305246, "uuid": "49338bcf-4548-4d47-a2fd-5193638f27db", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305246, "uuid": "59c761da-4219-4b97-ad03-69ccf0a3e842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305246, "uuid": "f12e6375-ea93-435c-9282-d2007f7393e0", "value": "5ceb4554bc5195a2fdca7417ea892253a723e97c0b0d70f497b13cfc8414db0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0d0c9a-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770308068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308068, "uuid": "8b80a724-bd95-4907-ac75-5dbe86d851cc", "comment": "Malware payload (DarkTortilla)", "value": "5ba70ad23a0442ed2f623e5fdf3a6de9", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308068, "uuid": "93de698f-52ee-4225-a2ae-b787d5148910", "comment": "Malware payload (DarkTortilla)", "value": "5cf7d883f29fd1ef93f0f744413f97d419985587544d36b5326f7e8cd3828a66", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308068, "uuid": "7a7b066f-e847-4a37-bf5f-a0a929577729", "comment": "Malware payload (DarkTortilla)", "value": "7511da4b54f4fab7f9f274c9127df4b0ac58acd2", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308068, "uuid": "1c48644d-e8b8-4c7c-9850-0589d445f444", "comment": "Malware payload (DarkTortilla)", "value": "37a18175882b6710e7d234e2611790dd221eabc1f7655c1757607bdb858ea852bcb0df2a46389210458f1f758bbb1906", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308068, "uuid": "6b4550e0-85b5-4d6d-a541-8c1a93308ce5", "value": "T16255010A17E542A8F4FF8B34E2B8006593F0F5ABC634E7AFA54C51F49E21755EA12273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308068, "uuid": "988bdf5a-36f9-4d6c-8013-3de481ddfc8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308068, "uuid": "6bcaf4bd-c15d-41da-87fe-46f0b5b77266", "value": "24576:+FknRHGAWq6/p3ojZPvCnRveYepqMKDmfC4KOSSn2K6Joh:b5GAmOdPaRveYkqM3fC41p2be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308068, "uuid": "090d73f3-0163-4ad8-a3d7-b3295510514b", "value": 1378304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308068, "uuid": "506ab667-9890-43d9-9848-2bbc09c359fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308068, "uuid": "1d99ded9-2523-4f11-b4ec-90baac932ff6", "value": "5cf7d883f29fd1ef93f0f744413f97d419985587544d36b5326f7e8cd3828a66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb1eb34-022b-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770252335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770252335, "uuid": "8a079739-0c05-4704-ac42-3474224e7379", "comment": "Malware payload (QuasarRAT)", "value": "ecf8ce650cbe9fbfc6696f568cc817b8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770252335, "uuid": "0af9b599-301b-48fc-9261-74d937d0755b", "comment": "Malware payload (QuasarRAT)", "value": "5d3f6e64b57051bb8e3c6a540b46bafb98ff9274368b652b340f5071c664e421", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770252335, "uuid": "fb59c3ec-884a-4b71-8dbe-313ffed52212", "comment": "Malware payload (QuasarRAT)", "value": "6dcbb9974c95dde50aa82469db249c9fb4ec9f35", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770252335, "uuid": "8aa51ea3-59f6-442e-8fc6-bcb3587dfebb", "comment": "Malware payload (QuasarRAT)", "value": "05c45206f0451c4dbc8e13e4bc97d8e3e5b7b0a0d6e4d64f80a9cc6606a497266523a450cce1e52376ba7083d0a373d7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770252335, "uuid": "878c7ced-84d7-4ba7-9df0-05728aaa805c", "value": "T1D493C07EC5D0ECD0CB8B26B49DB6FBD600AFCE937D161B0DB188328526707486F69914", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770252335, "uuid": "11ef589b-c40b-4f2d-bf40-fa18fd0d5db3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770252335, "uuid": "53b70b56-addb-44b4-96d1-106c779d387e", "value": "1536:n3bh64ywT4nCh4q/AL0vbrc09BerseB+YzB1h91SjDviYIv0Qf266/ql2:n3bc4BT4y4q/A89BeF+YzB1hXeiYY0Ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770252335, "uuid": "b9ac3b19-181c-46b7-98e3-a07f9888c46a", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770252335, "uuid": "5d5b5f27-dffe-4744-a44f-9c7737cac262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770252335, "uuid": "9ba8c999-4e30-4d37-90d2-268148f91df0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965a8f99-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327327, "uuid": "c5ae0503-4538-40e8-a7dd-361312e925ab", "comment": "Malware payload (Mirai)", "value": "1bffa2bc1eaa3d6c38664ec2274bb0df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327327, "uuid": "98ef9665-7b36-4161-893d-e6759c23e722", "comment": "Malware payload (Mirai)", "value": "5d49e48d1c9ab7acdaf94265b205e5923c4efb43115151ed1eba42dd452d5f24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327327, "uuid": "a60b21b3-9af8-4e5c-b567-57b6cb9c44e8", "comment": "Malware payload (Mirai)", "value": "94e7d8c5f56f8d7b78457bf11143c17f9fb655b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327327, "uuid": "beb7073d-4c6b-49dc-8b82-0e6d81d3d499", "comment": "Malware payload (Mirai)", "value": "78365b111e2cdd03477e3df8c01ecbe485b43b9a25e42da1e9c8d6ab41825888e44ad565bb8dfdeae46b55a147785d18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327327, "uuid": "6bb7f277-27ab-4b96-850f-312b54ca7b42", "value": "T18A736CC6B6C3D4F5EC1305351176AB2B5AB7E13E32A9CB83C3E8E636DC12580E15625D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327327, "uuid": "b3721a35-79e6-49d0-a30e-48a241bdcfdd", "value": "1536:xZiUYW5HTvJOHZOppILbHowjz/HEDig3SEQUiBL:xZr5HzYMpiLbIwXfEvQBBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327327, "uuid": "478229f9-5052-4b59-b488-f4fb04a472a3", "value": 79860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327327, "uuid": "1483fa3a-da4c-466d-a012-50012802aa6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327327, "uuid": "0a50059c-c528-45fd-956f-9d46b2273db4", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104cedf3-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770306486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306486, "uuid": "600d47c0-b660-49ff-8e6b-27bd58dc16f0", "comment": "Malware payload (GuLoader)", "value": "a3d298cec1789cb9b3d3f22ff9b5b9ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306486, "uuid": "a20253b3-3d68-43c7-8df1-d3f2c3bfc150", "comment": "Malware payload (GuLoader)", "value": "5d591a75948b681ed5bfce020a53431b48aa5fe3ff761d28c8158759dc1c393e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306486, "uuid": "4e1c3050-5324-40f2-90cd-53e1bca1f751", "comment": "Malware payload (GuLoader)", "value": "220653fbcaf48ccd39fd0506d3bef36615dda70b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306486, "uuid": "ed85472b-0647-4272-a4c2-f2e73a1a2ce7", "comment": "Malware payload (GuLoader)", "value": "7cf2a0ca7db70d9a61891fe11e3b92838af3468fbc38fad6cd7802f423882cf039dbadf081aac44a55dcf5d68c241e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306486, "uuid": "9d9eaa8d-0267-4931-9237-c2b853448450", "value": "T19F05020F3278C06CCAF81EB0F46AADF1055E6C04ACA9548D6BD5B3DEA6F62F1531A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306486, "uuid": "4bf1bfe6-fe9c-4d33-8670-2917013548fa", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306486, "uuid": "ccbd8d66-b203-48e5-a747-06fbdf001eba", "value": "12288:3qNb6hgmWbp2Lxt8dJD0CvXime9zAlHCaaIk/Je5hgofKZECOJ:Gb6K5bpSxt+VvvSF9zc+cXg9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306486, "uuid": "09791394-40e0-449f-8b83-fe236630f0e4", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306486, "uuid": "4c5aa1f7-fc12-4381-96fa-06128bf0354d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306486, "uuid": "6c58e840-ff9a-460d-a5ee-87af271a3bb4", "value": "5d591a75948b681ed5bfce020a53431b48aa5fe3ff761d28c8158759dc1c393e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb85fc3-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770304445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304445, "uuid": "676bb447-648f-4b5b-99f1-1663df97e5ec", "comment": "Malware payload (MassLogger)", "value": "4826083468e5efa18ef2edf06d4d9fd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304445, "uuid": "961fad6d-d6a0-488c-8e89-b879dbaad717", "comment": "Malware payload (MassLogger)", "value": "5d67d216226094ebbc78b8c39e49b758e0b1624f904e2b6748bcfb39df8d6ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304445, "uuid": "4b5a7be6-51e4-4988-adc6-0a4daa5ae6fe", "comment": "Malware payload (MassLogger)", "value": "adc2848b388fb6caee6ce662a9fd9c5e85948d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304445, "uuid": "0681db07-cbd8-4a8e-a6e2-b3a03025aeb6", "comment": "Malware payload (MassLogger)", "value": "dc2d9b40e9eaae3d64144de0dde10f7ce901a3a9f9af05b080861c155d203b46b5629055881f70418fa4527fdff8c079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304445, "uuid": "2851ab01-a2d5-46b1-9b6c-a54db14e0241", "value": "T1D135F1482759D207C660D7B80AB1F2B81B6C6EE67810E3065FD9AEEF7C7AF064D54183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304445, "uuid": "e8969c53-6275-412d-87ae-4ca0b1364c1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304445, "uuid": "681472b6-2f45-4b5b-b405-da0f5b60f4a1", "value": "12288:3puidz05iya6tiQS4b0gz6HcMb68217PAkDb9okUqOeyo6lSGDyBQZb3ummvMksm:Zplutg4Qge+8yDAMxovqM+QZju9CDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304445, "uuid": "9c8dd409-b629-4a77-99bc-049686d6d390", "value": 1078784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304445, "uuid": "e00ecafc-7a2d-45f0-aff2-63fc26f10680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304445, "uuid": "691cb749-2679-47d2-9efe-6c1d451ecd36", "value": "5d67d216226094ebbc78b8c39e49b758e0b1624f904e2b6748bcfb39df8d6ed3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340d8851-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770307405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307405, "uuid": "c139d907-6ee8-4ed1-bdaa-c95d8868da84", "comment": "Malware payload (Formbook)", "value": "dfcf358102986d1f5f36019e7a1ce7cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307405, "uuid": "60f98d1d-1730-4f8b-860e-ce792ca253f1", "comment": "Malware payload (Formbook)", "value": "5da07462a347ae9bd580a35637af7ae16c7120970b1ca13bfb0516b07f8c8b09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307405, "uuid": "41a09268-7aa7-4f64-9568-cc2f80aa2f73", "comment": "Malware payload (Formbook)", "value": "ea807c831ea7ab2ec5a9810491c575b3a087a1ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307405, "uuid": "5e122cea-94c3-43da-a7e8-92535b0590a9", "comment": "Malware payload (Formbook)", "value": "437cf016a5a57c768128fda7d58913bb9deb7e503f0465d7fa81c4ffeb13856058cc39c3084861e70fcdcbc4a7ed5431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307405, "uuid": "8e9c8b47-b012-4b1f-b939-1f88f85c45ac", "value": "T10AF4239299C09C60C01663708832CD659A7534726E49B67A47ACE3BFF4B03C3F9A376D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307405, "uuid": "1ec3bab4-61e1-49b6-be46-e5a2cb99c8c3", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307405, "uuid": "4a41d20a-e218-431d-8b9b-5e1f308bc503", "value": "12288:gz7hU5I5yuNHIgzSFKxWltRohBfSTso93UKBFP7HDV5csJyl4vP1Ne0hjVk:gf+iN57Gtene3J7B5cIX1Ne4jVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307405, "uuid": "d3a33daf-deab-4065-8559-0a9e53c51fe0", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307405, "uuid": "74870171-362b-4ef7-826e-a00035429c9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307405, "uuid": "eff8f1cc-7903-4702-8cd8-1397af5c8366", "value": "5da07462a347ae9bd580a35637af7ae16c7120970b1ca13bfb0516b07f8c8b09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50642a61-0261-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770275240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275240, "uuid": "58982e98-083f-4513-910e-b573e778390e", "comment": "Malware payload (Mirai)", "value": "1dd1479468a0a9e996782529310ac640", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275240, "uuid": "9015373c-9163-43c2-b7bd-534c3767e488", "comment": "Malware payload (Mirai)", "value": "5dd275457b98106b6b2726b06e8f2e8bd6f11997303814c80f72700fea38a10b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275240, "uuid": "76ab2937-37cf-4f31-9d51-0513870e9269", "comment": "Malware payload (Mirai)", "value": "ace10f417cfa124b91eba62f06c483a192625a08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275240, "uuid": "212462d9-fdaa-4303-8a1e-c8875933f278", "comment": "Malware payload (Mirai)", "value": "276d63c84d2162570e4f4f4cba73955623be07fb7ab29daf41ad598b99a9ec69b76c1e495ac833b019458ad19d2c821f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275240, "uuid": "b0389d83-1d4d-4ea0-a2e2-ce61400c4b66", "value": "T17A84F96DF4809F7ACBD0617EFBA5028D33374F68EBD9720589356B3437E6A25953A200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275240, "uuid": "eb1d2efc-de61-4302-ae57-9fa1c8173dde", "value": "6144:S8R1+zNU2ksBRI/W9japvGfn3PsrUe6bogk7IXs4qQvh/8/80ChElHVSnPzeDpjE:Xoy7rUeaVH0Mz7eFjhUivLlC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770275240, "uuid": "6efdebab-564d-43aa-9e0b-40e31c48bc35", "value": 386564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770275240, "uuid": "574bc023-11e8-4bb6-84b0-4f60071cddf4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275240, "uuid": "398b3a7d-d0c7-4b3d-998e-666af77aea5e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7cab25-0282-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770289352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289352, "uuid": "2155a23e-8132-444a-87da-f10980a9bff7", "comment": "Malware payload (Formbook)", "value": "a0664b2bd30f52552ed129123f923de6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289352, "uuid": "d6be20f4-b1d9-4c3d-9f69-1823fd3b408a", "comment": "Malware payload (Formbook)", "value": "5de7c77bdb15d405f39a810f4b3ff472e4c1d61c94233efe2fab4917447aa6b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289352, "uuid": "9070ab2d-5771-48f1-90aa-c11c65532b5f", "comment": "Malware payload (Formbook)", "value": "00592ed827f2998d41b145a76335d9079b1bd2af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289352, "uuid": "c7a8440e-457f-47a4-82e4-a7b24f5a9bc3", "comment": "Malware payload (Formbook)", "value": "05266a34c366594cb2b3088970935c32c6693fe4f3dab62cba2584091b03210fb049ced918c10b6e946d244b0a9690cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289352, "uuid": "280ede03-7072-4439-b02f-6af6803814a0", "value": "T1D0452356773ACF26D0A517751531E77063B82D1AF012E22ACEEAADFF3659BE42448303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289352, "uuid": "50fdb9e3-23da-43c3-ae77-1f384814d660", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289352, "uuid": "44b6378f-21c0-4b1b-a87b-2b2f09c0d78d", "value": "24576:6guQ+NNTJ0bTIcpGVxbpVb/GN+kMa+wxG/NRsSXB6wlAVRfxpdHg7+:zuLabTIzRMpxGBUiA3fHlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770289352, "uuid": "ddd69ec7-6a55-41dd-b20c-27aec260397b", "value": 1222656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770289352, "uuid": "e109ec8d-2bfa-4b1a-b828-48649395e069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289352, "uuid": "afb8572d-f01e-4bfe-a1bd-a85e80a3c791", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73748d1-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770307679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307679, "uuid": "70460324-9596-40af-9813-ec9ca4b186af", "comment": "Malware payload (GuLoader)", "value": "b0f59f355aa0d29641382ca1844958e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307679, "uuid": "27991bf5-cbe3-4dba-bca1-5f1b7aa12a15", "comment": "Malware payload (GuLoader)", "value": "5e18deb065fd278ad4aaa9baf0dfd7d1d09f5a9b1af0d251ee9144591b3af182", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307679, "uuid": "6d1776cc-4a01-42d7-ae34-245c305f5e45", "comment": "Malware payload (GuLoader)", "value": "e26e48248d93bbec1e32ab5308e46162b0385dd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307679, "uuid": "ccae6693-b973-4a9d-8bed-8464a20c032e", "comment": "Malware payload (GuLoader)", "value": "b58c10b5cdd6d8c35c0bd33ddac96d8846249f6c387dd7d03eb31da3be49f3149730ce20479f4a8046571c6d9a5a336b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307679, "uuid": "1b31d686-16b9-42f3-a06a-e91e3463f539", "value": "T1CBD4237137E28873E663167044624EB769968D930864BA632342BD17FDB0BB1EE3D346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307679, "uuid": "3a193e18-ad54-4141-9abc-e7d2b14eed77", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307679, "uuid": "c8a382fd-ba45-4542-a7ab-f4816cf4d3aa", "value": "12288:XBNUq+qIZCfieFmgMmjYdvGRfuVOobvoE5j4RcWaKIyOiy3q:3BhMCfzmgjYd+RmkGoG421ey3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307679, "uuid": "2cc376cd-e8ba-4811-84a3-ea2c0546065a", "value": 651448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307679, "uuid": "2aa12e6e-56ae-480d-b0c5-1739220d45e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307679, "uuid": "5ab40b48-b16b-4adf-a97b-8ed5d9bb06e4", "value": "5e18deb065fd278ad4aaa9baf0dfd7d1d09f5a9b1af0d251ee9144591b3af182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a659b4d5-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305449, "uuid": "6846c8b7-ed7e-427f-9de7-be779d8ca6c5", "comment": "Malware payload", "value": "04c0322076c930144e76ff64b1d48069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305449, "uuid": "45e7e31e-9c00-4929-b886-7941819cdaf9", "comment": "Malware payload", "value": "5e5e949bca55a2bb5ce8a7338494e6ba8a0e792461d908c9503009ec2dae687f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305449, "uuid": "ab221470-6a90-4019-b620-851bf2b28ae7", "comment": "Malware payload", "value": "11d67235f43b271285d5c4ecf9e97ace5cd2d9ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305449, "uuid": "2a508d1c-9feb-4cac-ae78-fa6e3fc34fe1", "comment": "Malware payload", "value": "04cbb8e8169ee43171a9e86aee08f65341b3222d15d120de569debf4fa68ab9542623db360400fe178f3afb24b837dd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305449, "uuid": "27df4813-6bad-4f55-a2d6-4e18bfaa005b", "value": "T1CEB4C612E660B52AF99349703D78A65A2A1D3C7B1680DC0BF7899F973671983B0F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305449, "uuid": "a39517bc-1bdf-4a75-8ee3-a7759bb21b09", "value": "dda5390572a517db9130e93ae8b2318b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305449, "uuid": "0b67d7bc-0899-4e3a-9585-217cdc15ea89", "value": "6144:F6cbeGr1K2Y2OyxMuI9cvVym9DhsN+udUegn9FfkxsLL2pHIo480VPkeObYN:rberXvuI9cvVym9DhsCyxpHIo4Ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305449, "uuid": "008032ee-15af-4821-9198-52dd476e78e6", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305449, "uuid": "a8c98546-e542-4e1f-bf1a-75fbf2013d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305449, "uuid": "fd545ca5-a65c-4732-b4c2-676d8a3777c3", "value": "5e5e949bca55a2bb5ce8a7338494e6ba8a0e792461d908c9503009ec2dae687f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6567f18e-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770304481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304481, "uuid": "11df5933-7142-4497-881a-28b543c3d91f", "comment": "Malware payload (GuLoader)", "value": "d23be5897790b3539a1ca7a03dec35dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304481, "uuid": "169370fd-d83a-4c96-9bde-bb6a4ac874bf", "comment": "Malware payload (GuLoader)", "value": "5ea476d26130b4a56a393cc537dfd28f64987eb3d624cbdbf682e37e1c6526ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304481, "uuid": "5a9bc41c-b1d0-4b1e-a867-a333b7c00d96", "comment": "Malware payload (GuLoader)", "value": "8a367c0a3f0bc1e9145945d8769a093137a940bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304481, "uuid": "8e6c8b6c-1788-4adb-a36e-1b9c372055a4", "comment": "Malware payload (GuLoader)", "value": "93bcee77b68a0ed52c66e55f9cb90bb032ccf1e60b012726efd769cd9d65908633088cc4632030aa4bdac2542a7be51a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304481, "uuid": "b51332de-16c0-4a7c-8d4a-444dd903145b", "value": "T135F4234677D0C053E6B21AB1D9E9D3F92B91AC14D5A0A70F53843E8B3C79740EE673A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304481, "uuid": "567ef38a-881e-497c-93ec-d1e889508dd0", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304481, "uuid": "cd781f6a-1875-46ba-ad9c-a6f2c978eff4", "value": "12288:ckhhvJGrxiayCdthlbqLIVTj/3nDE8pBQGroqGUo/dDP1W1NcuXYLBasd9DuR3+z:cghUrsayCJlH1jfrpBQGHsBqUgsd9WhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304481, "uuid": "1455c54b-89c4-4a3f-ab11-37535fd82536", "value": 739296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304481, "uuid": "499d2675-aadb-4838-b1ac-0408c7df6e17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304481, "uuid": "a1391b38-6752-4ac9-8e2a-1c796430a671", "value": "5ea476d26130b4a56a393cc537dfd28f64987eb3d624cbdbf682e37e1c6526ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdcd41f-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770303715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303715, "uuid": "70312901-ddca-4581-baad-8be2e4370ef5", "comment": "Malware payload (Formbook)", "value": "8c3f825d19e4609222d33be84d64f2d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303715, "uuid": "3b601bf5-d664-40d0-bcbf-de88197a2a04", "comment": "Malware payload (Formbook)", "value": "5ecfb51ff907aa4ce061fc785d538dea834514b6eaa8e36d25e43c9fe906d089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303715, "uuid": "1dd8bbbe-3866-465e-8e33-cd5fb06daf33", "comment": "Malware payload (Formbook)", "value": "265b0a7a24476ce091e42451c7773e5607e58d95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303715, "uuid": "a582c965-92ff-487e-8712-760fba4a7444", "comment": "Malware payload (Formbook)", "value": "0bbe5bbb3b8872b1afaa87317f6bf9911b5e138cc59d41d73ff5ebee3088dd62c90662694aa135d3283fe9bf4b877036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303715, "uuid": "4b9c3be0-6eeb-4f4f-8402-b8c76be43ea7", "value": "T11B45CF0273D1D062FFAB91734B56F6115BBC7A260123A62F13981DB9BE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303715, "uuid": "fab79023-c84a-40f6-8f5a-282e12e5653c", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303715, "uuid": "1b6d0743-0f11-4240-a9d4-425b5447b94e", "value": "24576:F5EmXFtKaL4/oFe5T9yyXYfP1ijXdaZiY5kt7gSkcREHhhYs:FPVt/LZeJbInQRaZ1ktSGEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303715, "uuid": "4ca0c8fc-3df2-4986-a40b-5748bcc17f18", "value": 1251840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303715, "uuid": "52655ccc-bb84-4356-bf7b-0721b8a6cf52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303715, "uuid": "c0d00ae4-cc73-4062-b0fb-6efc3b4dcc05", "value": "5ecfb51ff907aa4ce061fc785d538dea834514b6eaa8e36d25e43c9fe906d089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3746ab4f-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304834, "uuid": "bf3bd441-db5b-42d6-9476-d9f4e6f92040", "comment": "Malware payload", "value": "b2a4215d756fbf60d605a284bb5d6b86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304834, "uuid": "d14c00af-d09f-4280-827a-a53a82d99693", "comment": "Malware payload", "value": "5f1454b656526752df4f393b86fd3fa41446cb486d7781fc96957c2849d69e8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304834, "uuid": "1597063d-53f6-4e74-b22a-3121c78c02cb", "comment": "Malware payload", "value": "001ca1cd8d6122a2f9205d44b194bb73d01f4b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304834, "uuid": "c9c8daeb-d74a-4648-b0d8-890ebf9fb545", "comment": "Malware payload", "value": "3a25259e71e6536acf418ac5ca17d0ff02c3e73a29b60f28737a36f475eccd09ba8eb8c9d1c8a657226448b2651dab86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304834, "uuid": "d87dba9d-6286-4359-9508-994b2da52edb", "value": "T10C351295BB4ECA03DDA5877509B0E33203B8AE69E921D3074EEC7CEB3874F445985792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304834, "uuid": "6e7e60b9-ffa8-4d89-994e-ad0be4d70ed9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304834, "uuid": "1a896f42-4622-4724-a1e0-24e23f846b67", "value": "24576:Cu2mI58EWn7LRog48yIwS66XkWgwHTR/lMSq3QWL1CwI:CHmIKVl7Bwtgf9zR/lMSZWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304834, "uuid": "4b378a3d-4d00-42df-939d-d9126f4741bb", "value": 1101824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304834, "uuid": "8d7fe809-5e36-499e-91aa-c3d19dcb1c97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304834, "uuid": "634016a9-c7c5-4c6b-a720-de7f311d7a29", "value": "5f1454b656526752df4f393b86fd3fa41446cb486d7781fc96957c2849d69e8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584e281d-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770307895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307895, "uuid": "52e9b7e8-851a-4114-a23a-db818d883ab6", "comment": "Malware payload (AgentTesla)", "value": "569f8864469b8af44686ed407955ee68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307895, "uuid": "4443b0c0-1bd5-4524-9cbf-382bbbddfc97", "comment": "Malware payload (AgentTesla)", "value": "5f5d0feaba317f0e06ab15d5a2378acb8ac9a8261ae1a002bc534e6b9b50795a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307895, "uuid": "534424d3-8dc2-4acf-9c32-2270b3925b30", "comment": "Malware payload (AgentTesla)", "value": "a88711b917f6cc9d2173b4a87c05dffceeeacd17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307895, "uuid": "e97069a1-c98d-4969-b888-11c4ea803dee", "comment": "Malware payload (AgentTesla)", "value": "f667d23ca293cbeffdae0314ad7a80c633935bf1010a09c5f56aa299697e2132a382c05ff28c7f20398251475783f396", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307895, "uuid": "e76b8c67-1fe1-43c8-9e58-c8299204ce9d", "value": "T19F3522AEF7869956CA4D0BB7D4134048E3F0E450F416F76E46CF98F20EA6F5C894BA42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307895, "uuid": "6783cbf3-d73e-4f2e-b4a3-d6051326ffbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307895, "uuid": "42247363-b4c3-4a45-bda9-22fd1b38b8b9", "value": "24576:p4Sfm9GzVEZexoLZ9y3naHuIzbxORIs4N:pf2Ga3Z90aHZbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307895, "uuid": "8686db34-f21f-4e36-96cf-306811917c19", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307895, "uuid": "f6c20cfa-0773-42c3-9013-e26efb408cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307895, "uuid": "75d9a449-dd11-44b9-a81b-eef1ea68962c", "value": "5f5d0feaba317f0e06ab15d5a2378acb8ac9a8261ae1a002bc534e6b9b50795a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568dd9be-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770307033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307033, "uuid": "8570d33b-d6d0-419c-b6f6-e36719cb98ff", "comment": "Malware payload (GCleaner)", "value": "5d749f83708b7d5ba92ea6e35d120d92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307033, "uuid": "1d51ee67-3e76-478f-a4b6-0abaca37612a", "comment": "Malware payload (GCleaner)", "value": "5f7327bd474d666dfdb74807a8c771dd5fcadf943cc796775f79e7765df00bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307033, "uuid": "e5632269-410c-4f92-a13d-12f89b6f954a", "comment": "Malware payload (GCleaner)", "value": "cda5808de96fe3f91d3b247ff2fe896cdb527984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307033, "uuid": "5f4e7e5d-f2fb-490d-aba7-373f5d40471d", "comment": "Malware payload (GCleaner)", "value": "1a243508acdd1b29c5bf261ccbe97965ca4f5991b0e4b463b010440c149f11305400cd67b93bd48b6f3459d5e2a2833f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307033, "uuid": "d122a327-0f4c-475c-aca0-c65be0695c50", "value": "T110056E22E2B18437E06F1B799C6BD76C54267F132938994A36E93FCC4F753426C26287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307033, "uuid": "d116d7b5-b991-40f6-ac32-a2a886838df0", "value": "421f57ebeade5946b16f0c3c541d2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307033, "uuid": "2093f775-94e2-4280-bbce-9c55dd108b2c", "value": "12288:f9eONBtJzhKJd6EPXNQyxbLSo+Z2ux8V/CcRn9RtAMVSG:vnzz04EGOz02PxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307033, "uuid": "508e2aca-1a66-4800-abea-1925cc3832ea", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307033, "uuid": "1d25d775-5df6-4de8-a179-becd3354cf25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307033, "uuid": "61d464c5-bf5b-4fd0-8bdc-5f0725c33559", "value": "5f7327bd474d666dfdb74807a8c771dd5fcadf943cc796775f79e7765df00bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80a0b59-02c0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770316297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770316297, "uuid": "420c3882-cb6e-4041-9da2-9465de5c28bb", "comment": "Malware payload", "value": "3d4ebdfc02146e6df1784a4ebd7621ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770316297, "uuid": "049264a9-acab-4d5d-bf95-7e5f98a8e9c4", "comment": "Malware payload", "value": "5fc6558327b1da231057b2658c6c8c02d5951569c7562fb8408846ebda111472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770316297, "uuid": "ef6a356b-66f0-4e28-90c5-fcf7d8a92396", "comment": "Malware payload", "value": "40c9c82aa302a2dc5e3c8d3cf91952f7d2f1926d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770316297, "uuid": "d56b5fb5-e472-449b-88a2-e53ae16e1523", "comment": "Malware payload", "value": "97faf5d8a0bbd307f3ce91e1f799192f6f9e888851b1a6deebbd296f1fc1d4dc7c6e83d5e51b25b530f0aee96b575d36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770316297, "uuid": "d1053668-d270-455d-bfb0-095194aaeda0", "value": "T1DDB5339D96FBC6C5901B624F3B7AB4EBF3096A6130C8DB49D74A46778C34508422F2CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770316297, "uuid": "df63cc13-ca38-416b-bdfc-e84fb57015f1", "value": "49152:smvH/IOTpHyeclIXn7ioOY9YAxbg5gQk53ZJMkwkW+yRs9xz:smvQOlHbcVOOpk5okYRaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770316297, "uuid": "f4e6b642-ed91-4b56-b301-08ce8573c9d5", "value": 2373616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770316297, "uuid": "f1f66474-f550-42e6-8f1b-4166ab30324e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770316297, "uuid": "62b40ca5-3725-4235-ae52-f818df781d80", "value": "sample2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33f6e04-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306733, "uuid": "6a81e93a-fd7b-4248-9d72-1907506283e8", "comment": "Malware payload", "value": "5cc4dae58b33eb0d6bb206b99e697cac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306733, "uuid": "5e7c1d2b-1313-4685-a7db-3e95fb801586", "comment": "Malware payload", "value": "609e1a546d994ba45958521278ca62027e1353d205987900a759cbda0579509f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306733, "uuid": "f7f5feea-b432-426f-8658-4a964ffe23a9", "comment": "Malware payload", "value": "4095b8a4d88b881171b26c55818c4d0dfcb1af84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306733, "uuid": "389fc0a2-cf87-4f49-a1bf-0894307d99fd", "comment": "Malware payload", "value": "d7373bbfe7b91cf347c43325b8a6ec07ae1dd0be04615da4e0b5a4441c5528ec3d3d4f019328d3a2aea8a20253da29dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306733, "uuid": "f0eb0095-a4fe-4f41-8fde-6ce2fe80d2f0", "value": "T1D9743A23E6607026F96345B06D78A26668293D391680ED0BB78EDF4A37719C3B4F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306733, "uuid": "9cc3ae75-b835-4503-bb52-99ee7e8b540b", "value": "e7e7f97c587cca897cb2a5d244260c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306733, "uuid": "0b5ae140-8d80-4c25-b435-e0e98db76854", "value": "6144:p83FUl8Qztznq1/WyvDzl2qGpCfmXfIYjRuODD67oX+//zS:p98QEMyvDzl2qG4fmXfIYwODmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306733, "uuid": "73b15893-b1f2-4c44-8a3e-500e989910ac", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306733, "uuid": "700a7732-17ea-4540-a261-01fa9a7e36ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306733, "uuid": "e878b5a9-7e38-4b86-81d7-aad09326ef2e", "value": "609e1a546d994ba45958521278ca62027e1353d205987900a759cbda0579509f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4534a17a-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770307434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307434, "uuid": "074e36d4-1e16-4437-ac7a-9d0df84fa370", "comment": "Malware payload (SnakeKeylogger)", "value": "47593a1f95e066bad3a2028cf1acd049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307434, "uuid": "ce89467e-0803-435b-b3a8-3d131f7dbd23", "comment": "Malware payload (SnakeKeylogger)", "value": "60b1aa5eab663f64ef439c93d01d5f32bc335118f5f86e01f2191212f0d0d2d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307434, "uuid": "4396a2eb-fd7d-4c7a-ba20-224da540cf16", "comment": "Malware payload (SnakeKeylogger)", "value": "de4599843d84612c4b0296c3ccbe8a8fa5d78ff6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307434, "uuid": "bf80d950-7962-4821-b9bf-179c252a7b82", "comment": "Malware payload (SnakeKeylogger)", "value": "092ccefcba6cbf91293efd0d600d0b0cee955e60fd8fe05ae6d83df9ac7bbb9efbd4b23603528578facb8590ad51471f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307434, "uuid": "2345111e-8dc1-4e77-a3f7-2d520b4fb9c9", "value": "T13725126E6681FA43CF5C0B37D403414D86B6CA25F922F7AA62D90AEB0CB7B54C44F553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307434, "uuid": "d159d1ea-cf29-4680-b84b-c87283fbbaaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307434, "uuid": "dff76fac-789d-4561-ba77-6ac2f91e01a6", "value": "24576:5Y+Tix0sFCggHMsHTSX8jxltaV9zVdCAXQT3Uj7ES:5Bds0HLbjTtaV9x8AXwUj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307434, "uuid": "fd4b9b2f-07fd-42b7-8797-1b74c1e02c12", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307434, "uuid": "5afe3068-bdb5-4960-95f7-48f623330bcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307434, "uuid": "578cdb3c-6c04-44a6-ab82-eb90fd300b93", "value": "60b1aa5eab663f64ef439c93d01d5f32bc335118f5f86e01f2191212f0d0d2d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473929fd-02e8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770333207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333207, "uuid": "571ddc73-ffe5-4462-8abb-9d8243769065", "comment": "Malware payload (Mirai)", "value": "e8fbbd87c68e52edc718d0c74a431820", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333207, "uuid": "995ee9ce-d7ea-4b13-b083-e52b037bb599", "comment": "Malware payload (Mirai)", "value": "60b4db4065ba84a1e137522b2f9525c16c458b70563f26b8ef1e220143a2d656", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333207, "uuid": "1b427136-f376-426b-b1ce-ea86897180c8", "comment": "Malware payload (Mirai)", "value": "bed066e0319781837500b316482a326dda6a0ff8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333207, "uuid": "71c70684-fb54-45d4-8b4d-2c5c00102a0c", "comment": "Malware payload (Mirai)", "value": "4710de565622fb1841c6fb9fd381bfb8ead9ac7ae871e04cfcca36d359c44de0cc72c4b886a14e4f0a7950a22ccf259a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333207, "uuid": "a81d9ebd-0138-4f01-943a-00efc8cbd667", "value": "T184D2D0AEE5B442C9FD4D5C3E80CC3FA10E59E581631BEB9167218C4D5B32C57F16A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333207, "uuid": "ad8c05a0-0add-40b6-a7b3-2380b1ff140c", "value": "384:e8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjvBa3S9RWGVCz0Nvk:jMYHb62x4ahQ3CfdwLjnIWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770333207, "uuid": "a83754ad-872a-42b2-93a4-5f3f1fecd5ec", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770333207, "uuid": "6606b5be-5b87-40fe-aec8-8e9c85a8920b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333207, "uuid": "9b082f10-2cc4-48a7-ba8c-715bd9b63ad7", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb3304d-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305059, "uuid": "2d63b065-b060-4b28-89d9-4214fbe0e1f6", "comment": "Malware payload (AgentTesla)", "value": "530305014893a26662328267cb3dab1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305059, "uuid": "1248f0a1-c30e-4c01-b121-8e45af4744db", "comment": "Malware payload (AgentTesla)", "value": "60ef1afae839bd774d59f78c2866dad57a397db6f1c3a8432d3daa39985e040c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305059, "uuid": "b291dd8b-4d52-4052-9b1c-b18b0ecd7dd2", "comment": "Malware payload (AgentTesla)", "value": "4b447b4b184ca4b04fb2884b30daacde1dcb5751", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305059, "uuid": "b1981959-3784-4498-a5da-090c70c24f36", "comment": "Malware payload (AgentTesla)", "value": "7d45f565ee0bd95d4073e11446a1a5b69287f149aff056cf23d19465852c3bab6947ff053aa31d6757e6cccc6ce09fc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305059, "uuid": "8b8e20fd-499e-4a35-b3b9-4c7723e9b2f8", "value": "T1CC15128426ADD712C5D51FF00A61E7B217B09EAEF520C3568FFEBCEB3060B652944693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305059, "uuid": "9b5c23bf-85c4-4fe8-ab23-63c3366d0518", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305059, "uuid": "37c1b1f7-d81c-48db-aa4e-6de07e008ff4", "value": "24576:7uVeQ0FO9UHJdwqZywMCDd1+eNxpHZh4BCH/yO:79BvZ9pD2eNPj4BCHaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305059, "uuid": "23118451-8676-40eb-afa9-3a5e84cbe6e7", "value": 938504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305059, "uuid": "8333f7ca-bfee-4a0e-9da9-05d5ffe924d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305059, "uuid": "8de54c00-a379-444f-b7f6-20e8b380b1e8", "value": "60ef1afae839bd774d59f78c2866dad57a397db6f1c3a8432d3daa39985e040c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f9395e-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770304585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304585, "uuid": "e92245f6-0b2b-443d-972f-be0906fceac8", "comment": "Malware payload (Formbook)", "value": "7a9e4607a89bb858b6dcf559a2c6fb8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304585, "uuid": "0e631b2d-c8c9-4fd9-9c90-162fe7b9f3b9", "comment": "Malware payload (Formbook)", "value": "61099a560e22642077a83120c7bdda1092f4040d7139e2ac03e030a329994266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304585, "uuid": "948bc017-3c86-4351-97d6-48b3fd3707d2", "comment": "Malware payload (Formbook)", "value": "7b143844543b153631edfe85ed26572d5b7d02fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304585, "uuid": "fa146b08-0ed3-4272-9295-d927f13139d8", "comment": "Malware payload (Formbook)", "value": "6b48bec4f7ecb048c5bdcfdaca23241de6a6b5ebfd1886935da9dfa77c9c56150eeace55d58971b14defd7e35c29fc37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304585, "uuid": "d10cba8e-e742-45f5-852a-6e715ae415ff", "value": "T18825F2582B06D117CE5197384AB1F7F86A5C5EEAB800E3135FDCBEAFB969D1A4C40092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304585, "uuid": "59a1f583-6fd9-4196-8bc7-73e5e5b968ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304585, "uuid": "093b1b27-ed88-4c1a-a90a-7df85c2ccca9", "value": "24576:KvW69ClNZdZDtn+VK7Jaj2zojQ+h2Pq01XtDmJ8WsovW:KQZZn3hEMPq0BtCJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304585, "uuid": "4933223d-7027-41fe-9a50-564a6dd154e4", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304585, "uuid": "06c54f6c-6bda-42f8-a6ee-ff0eaa4b9bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304585, "uuid": "5115fe21-b040-4d57-8e71-6a89464e5235", "value": "61099a560e22642077a83120c7bdda1092f4040d7139e2ac03e030a329994266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8eb437-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770304254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304254, "uuid": "1fce1aef-ee05-41a5-967c-450026fbefcc", "comment": "Malware payload (Formbook)", "value": "5a6b9de3c419133a29b6f668ad425e15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304254, "uuid": "903b8e6f-0d7a-45d7-8ae9-45ba8eefd550", "comment": "Malware payload (Formbook)", "value": "61faeb3857dc422b26292ff17b24a2ed3cb18415f8c0a6f64a707c51a0a9c147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304254, "uuid": "5c3f4ebd-5f83-4fde-a64d-4327e649db1b", "comment": "Malware payload (Formbook)", "value": "bd6aa916bfe5a9fda25cd8241afbf07dee076ce7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304254, "uuid": "bbb78d23-1544-4a00-8875-502c5cfce2a0", "comment": "Malware payload (Formbook)", "value": "bdbd34f025571ff634a4ba6057c83218f66849d06555fefc5af4508b6523090f184145e448e5c2c6f50b813cfaf38fa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304254, "uuid": "6248a651-95ef-430c-a7cd-68afc5540ffd", "value": "T1C935BEEF7544F453C9929A35F91BE1B50B2C0E8B9E808167D69CFD8F3CA411A98C63D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304254, "uuid": "229e440c-6171-43e4-baef-402c9e19b026", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304254, "uuid": "c014f785-3c31-4e3b-b229-b5675cc5661d", "value": "24576:GvpXPbhLTHCLlYYxY9ivPo08HkN0CtEoNepm1sbwHymo:GRXdDQqWPoPkj/ewsbGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304254, "uuid": "1c22d1a3-8551-46d2-9a06-c6e6549c7321", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304254, "uuid": "5a49f45a-9a2f-49cc-b8a1-ba25f1cbf9dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304254, "uuid": "bbd05c17-0b0a-4951-9e05-44f8ed5fe3fc", "value": "61faeb3857dc422b26292ff17b24a2ed3cb18415f8c0a6f64a707c51a0a9c147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f398e903-0264-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770276803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276803, "uuid": "e7b74967-0385-4944-88c9-a3af8c362154", "comment": "Malware payload (Mirai)", "value": "ac28390689135c829d4e6276194c2311", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276803, "uuid": "48437f62-1f2a-4ddd-a939-b856dc44ebd3", "comment": "Malware payload (Mirai)", "value": "625fa26f2d4a049e2d0f97cbcb3b5287d5196b49c7e9c3d73daf23fe3825b652", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276803, "uuid": "195c5baa-4e0c-4b77-96de-a8801d2b6558", "comment": "Malware payload (Mirai)", "value": "68715d3f88123ba08565c19fc9b3613172eff6a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276803, "uuid": "102336ef-f1ea-4d3b-a0ed-b328be883a44", "comment": "Malware payload (Mirai)", "value": "29d74e3e664d9bc2c53f061dc96516f9c30cd676b6f26c555d0e8bebc3f024bc1dbfd8badba8eef5db385038c8fc57e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276803, "uuid": "9cfbc22c-42b6-47f0-9057-6aedfbe93973", "value": "T17E657C2AB2B2F26DD007C0349BDBC6A14520B0B41A313D7F77849B352EB5DE95769B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276803, "uuid": "232fad3b-58c8-4ed7-8b1c-4cbe11c30250", "value": "24576:FuflhgNgc1JFOznlvcO7wpUx3S/VjNQhyG7j+L:FuthgNg9L+O7wpUcjEybL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770276803, "uuid": "61344fcc-81e4-4165-b0da-14c263191497", "value": 1424032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770276803, "uuid": "f32de4dd-5c9d-46e5-97f9-fc0e99315b67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276803, "uuid": "9d6192d3-5257-4b09-a16c-e44ca339de93", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41073c1-0283-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770289984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289984, "uuid": "6bd469c8-8c32-43f7-aadd-8c243b9ed91d", "comment": "Malware payload (Formbook)", "value": "0a75e5088659ea320e512ce63f60d7c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289984, "uuid": "2de84bef-d017-419a-a1bc-1c72385b2321", "comment": "Malware payload (Formbook)", "value": "626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289984, "uuid": "2e8b78f2-d5df-485b-a5cc-8f7b6f49a3ea", "comment": "Malware payload (Formbook)", "value": "ec0fc5dfb3788c7440705537715f12a6ff9d4386", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770289984, "uuid": "0e0139e4-8254-4bc5-b118-205b1bf66762", "comment": "Malware payload (Formbook)", "value": "caefbc5041bc99370f50e70fb39203e68a7c6b53c194b561d66cacd27812126ccc766c145d1f96273bec9be48c4545c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289984, "uuid": "54d1045d-d0e1-4d69-80e7-141cc68d5a78", "value": "T10E45BF0273C1C062FF9B92734B5AF6115BBD79260127A62F13981D7ABE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289984, "uuid": "a2d6afb0-218c-4dff-a5ec-f8e6a81a960c", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289984, "uuid": "da7c26ee-d5ce-42d8-9a60-529fa73ca759", "value": "24576:Q5EmXFtKaL4/oFe5T9yyXYfP1ijXda7/IhSCnT2jSxDQf:QPVt/LZeJbInQRa7/Ih1nyOxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770289984, "uuid": "0b64c7c7-8536-4aaf-8622-885bb0d799d9", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770289984, "uuid": "1c9a78ef-9166-44c0-969f-372f69013169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770289984, "uuid": "e993db88-29f1-4131-9d41-1e13d98f3768", "value": "626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73872df-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306739, "uuid": "dcb4b4d3-12c4-4902-b942-32fd4a562e36", "comment": "Malware payload", "value": "860a18e60c274f8ce30f1954c8e07a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306739, "uuid": "65ab5abe-0ebe-41c8-bab2-73dde8a2a33a", "comment": "Malware payload", "value": "6314c3c82acb165b93aa922ff379754ea29c321d7a757a5d55d72e537072d9c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306739, "uuid": "276c8aba-c39d-4d64-a324-a5b89919ef5b", "comment": "Malware payload", "value": "2e91413c551004af85c4dc9a14c5ac19e37bc55a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306739, "uuid": "8e73b4a8-9a00-47dd-b2c6-edee719750b6", "comment": "Malware payload", "value": "defe0a5d4f39f7c317966d01fda2567b0e974ec719a56cfa20d82b65230cc078824f845e999e0b5cbcee438d2db87f1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306739, "uuid": "6a4a715c-095e-438f-becc-c257c9c5b677", "value": "T1AD95010413D48A48F97DAB34817B3A1247F0B80AD97AEF9FA3C460BD1C357A59697723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306739, "uuid": "ee1654a3-410f-42c3-908a-5d0563da4947", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306739, "uuid": "f8b95a7b-9a79-4be2-b1ee-f9151521dd2a", "value": "24576:iCfMs1hsAdBen2pqp1IeB/eG9B6VjqIkcSAz9TmTT:iCfTfeNB/IV+I79TmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306739, "uuid": "731a108f-3074-4707-a85e-5e75205d01ef", "value": 1897472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306739, "uuid": "d3ec9a5f-a10b-430e-9289-da20b052d55f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306739, "uuid": "2268044f-05e4-49b6-b381-42389e1bf3fb", "value": "6314c3c82acb165b93aa922ff379754ea29c321d7a757a5d55d72e537072d9c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec773127-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770306856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306856, "uuid": "4d45b1b8-a802-4416-9a01-a2c6b8c50cbf", "comment": "Malware payload (GCleaner)", "value": "dcb6a36ccad2f409129973531c282b68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306856, "uuid": "34694df2-7643-42ce-924a-11303e6d3a28", "comment": "Malware payload (GCleaner)", "value": "6320215257349bf02c665543a15fdaf661e87947ef449816b5b2a6723bd5ba47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306856, "uuid": "e55362bf-d070-41cd-8154-dc1c85a921d2", "comment": "Malware payload (GCleaner)", "value": "b5464ae5dad3f904635f286e4be6d568d6af693b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306856, "uuid": "8befe688-32b0-40f6-952c-bff827f5b784", "comment": "Malware payload (GCleaner)", "value": "a29ad70683e140295a9a567d539a502bea1b12df05f420bf4a351373fc33bfeb4ab6e5509b63561d249f76252c43b452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306856, "uuid": "ec529ee9-6d10-420c-b5d2-8bef1e390d27", "value": "T14416E14153BDE0E4EA85253C1F36BF4A888AEE39657FB9091494BDC487DD2318709FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306856, "uuid": "8c95af9a-d566-4631-bfeb-5eff476095b9", "value": "fbd9744ea458801c15794b746fb79ba9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306856, "uuid": "70cf59d9-80ab-49a4-94b7-00fbdbcbff27", "value": "49152:hVQDsk0PNkRdsQYzCg35dQ4L+hpibY78EhVq35aTm++k/cxy086sgg7gaK1r3yNw:hVQFOIv9hhB75hg3IK+dUR/0bhY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306856, "uuid": "a5679827-dfad-4733-b2c1-be3652a22f1d", "value": 4110848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306856, "uuid": "1f832c34-ae63-4c1c-bd4e-0b5d6b9dec15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306856, "uuid": "b40a27d4-a1c6-47f2-8c77-159ee4b9f8e0", "value": "6320215257349bf02c665543a15fdaf661e87947ef449816b5b2a6723bd5ba47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8514aa01-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770303246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303246, "uuid": "d858597f-c150-467e-aba1-b941fe1cad17", "comment": "Malware payload (GCleaner)", "value": "fd34f638cf87030ae9cd96d1f21e2b2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303246, "uuid": "c993d622-fa20-4913-b375-a832d97a3744", "comment": "Malware payload (GCleaner)", "value": "632839cba799b7c7494a94ca3bfe409ec6980b8f47c04d2150de27b02cd323ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303246, "uuid": "baf5fce5-0043-48cb-95d5-fd75d642cf66", "comment": "Malware payload (GCleaner)", "value": "ff882a225b24819420f7ce8805e1b4d370c9f613", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303246, "uuid": "e1a2a841-5f76-4753-a6ec-1d77c7a7dd59", "comment": "Malware payload (GCleaner)", "value": "812d834378b05bf7e7dce465d2cfd9a4201fb76e445c8048684baea7f157040ad2f428a04608232a70042dd0a56556df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303246, "uuid": "3194119b-28d1-4f59-860a-c96a6dcab4d0", "value": "T11136F01EBADC9139E3D191B9AF0491664830EC01A6BE3E5216EC69D4DFF18B14F3D623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303246, "uuid": "88fe58fd-c1a7-40ee-b7f8-785432f68be0", "value": "359a8c5bc950b6001311c8866021ba3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303246, "uuid": "99f504a8-53cd-4cd8-aea4-2f0bfd9d12e6", "value": "98304:cQPItJGCYbmOVrfk+HNu5joTCjr/jONuqFX+wuLuMx0:DP3Jdfk4u5djjjONuMX+FuMx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303246, "uuid": "48fefee6-f97b-464f-a966-c989c589b017", "value": 4906768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303246, "uuid": "01ce4ad4-6c16-42cc-becf-9f119dd82fe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303246, "uuid": "e24753d7-6234-438e-86a9-1e68a2a7d888", "value": "632839cba799b7c7494a94ca3bfe409ec6980b8f47c04d2150de27b02cd323ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0142375b-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1770304313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304313, "uuid": "9929dc2b-58d0-4104-b2f3-3a9bf08accb5", "comment": "Malware payload (RustyStealer)", "value": "d1d78cd1436991adb9c005cc7c6b5b98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304313, "uuid": "586fb425-1377-44b2-a66d-1354ee500a7c", "comment": "Malware payload (RustyStealer)", "value": "638fe471d7ea29e45f7f08b34012331e18eaaebe5bdcae84768d942f45a72a6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304313, "uuid": "f1664969-e97b-4b70-b6d4-3091f7066f82", "comment": "Malware payload (RustyStealer)", "value": "538ce04beaac54463d5de3b59d1e934928130fbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304313, "uuid": "a1dc8780-dc7a-4731-8bf2-08237f165991", "comment": "Malware payload (RustyStealer)", "value": "d5f0a4a7ef28f5a41aa08226ec9834f54dca74df293c2b123d928c98f695590b0c6c9bf898c60732574c925daa54c1d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304313, "uuid": "aa0161ff-2d44-4c6c-9699-ace3344882d2", "value": "T1D184AE02F982A4F6C65B04B05D6EE37E963AA6041B14DEE7E3D05B24D9603F31AF075E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304313, "uuid": "39d2c648-b875-4a61-9c61-9dd535bc72e1", "value": "27238647874203e3cf15f64a12e93bcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304313, "uuid": "8ed4c224-871e-45eb-a430-fc62369a7380", "value": "6144:PQOCc9F2kEdEOUkJxUg5pHoVYy270Jw7rPe1Hg5sW2B0Fo0cMlYbc5EW:PQOCa2kzOUkgYK070JwrpsV8l2bc2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304313, "uuid": "5115bbaa-f6c5-4d84-b9d4-864a33e9c66f", "value": 395720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304313, "uuid": "7aa710a3-4963-4bbf-ac1b-9ad3f6483530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304313, "uuid": "1f0ae552-445e-488d-8ee5-42ab22fe0ca5", "value": "638fe471d7ea29e45f7f08b34012331e18eaaebe5bdcae84768d942f45a72a6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6712d2-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770304946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304946, "uuid": "54d5007a-53da-4b07-8a3b-c15925b2f5c7", "comment": "Malware payload (GuLoader)", "value": "682c8f7a8b5d10f741f3cfc531723ad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304946, "uuid": "b349c863-f03f-448d-996c-9c7571d9de9c", "comment": "Malware payload (GuLoader)", "value": "64a71a666cb2d5f2e8f64e2c55e366e4a49eb78ad77ac6fae8c196c38166bc4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304946, "uuid": "d8f8b88b-8703-499f-96f9-e49be03f22d8", "comment": "Malware payload (GuLoader)", "value": "24843ee0565868c183bad1cb478e5297b1c8fda6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304946, "uuid": "3b14ab09-51bb-4d84-9688-c0afc194205c", "comment": "Malware payload (GuLoader)", "value": "1ec2ffa5c3aa9e1b45e0a756b9fb184f0b0a4fb7ba1c5542182c2d6b3ccee3812c46e14d62678408d970eed7d178894e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304946, "uuid": "2b70f651-4d47-4110-89d6-92e3d1c3ae8e", "value": "T1CF1512C5A581D643CCB0D0B2C9034EF7055B6D6ADA95353327D5BF2F387B9A2A32A213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304946, "uuid": "99e169ec-0633-4a90-a927-e1b4a3f43ea1", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304946, "uuid": "c8357578-72cc-4d24-955b-10b0db179191", "value": "24576:hGEZ9wajuN8sz3SqqhafmF/Oyasbn9o1NDQCGP:42wYuN8sTSDa+F/Oy1Y5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304946, "uuid": "5df44c97-6a5f-427c-ae15-9c3b1f2a13df", "value": 951720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304946, "uuid": "41d45385-9173-430a-b152-06e04a933f27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304946, "uuid": "2a726400-69bf-4b69-9282-46d62c0b24c5", "value": "64a71a666cb2d5f2e8f64e2c55e366e4a49eb78ad77ac6fae8c196c38166bc4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92962538-026f-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770281364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770281364, "uuid": "01a40b0c-e569-4e3b-b20a-e68a0bd7a087", "comment": "Malware payload (SalatStealer)", "value": "5801e2e993fc0188c5d7e012fd3fca47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770281364, "uuid": "9028f999-b815-41f2-a2c7-a168991d4cd6", "comment": "Malware payload (SalatStealer)", "value": "64b1337452604bcd905c6a7878c1a2e90759b7bc5bfbd3a1b55ea799deb2c87d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770281364, "uuid": "a8111807-2334-4b39-9491-13919a00fdbd", "comment": "Malware payload (SalatStealer)", "value": "7717afc2df864d21f8a2dc2cb4f2d32b283bd887", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770281364, "uuid": "6dbd8387-7013-4bf7-ae97-a33b4cb4d8a4", "comment": "Malware payload (SalatStealer)", "value": "5ce109c36e44f922677107afba60b9a174281bb8fe6485f48864b0bcfbacf659792a402b24e91798aebdc61345623a5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770281364, "uuid": "ac34c8a1-bade-4afd-b610-eefdd6ba927a", "value": "T1ADC65A11FA8B54F5E9031831415BB23F33355E048B28DBEBEB547F6AFC7B681296A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770281364, "uuid": "1b80e442-69e0-4af0-8bc5-074962472721", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770281364, "uuid": "d6f11d5a-2d1e-4d3c-b592-cbfef86c728c", "value": "49152:4hx8jOyV+8jSrxlaZMmUrLfEjijBXGns0D3MAnkh0Nf+EaFE0tjkpsQ+bLEQD4DF:kGjOy4rMYOnkU+EMKS3Emz0awBel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770281364, "uuid": "97f825f5-e103-4afc-bfbc-3c70117793a8", "value": 11669504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770281364, "uuid": "bbe1c28d-9658-4f92-a7a9-a5f4739192f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770281364, "uuid": "7eab206e-1a84-4c8c-801b-8cfccdde1d3e", "value": "Prem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29ba4d5-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770306007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306007, "uuid": "82dc28e7-e057-4774-81cf-c01fafd88aeb", "comment": "Malware payload (Formbook)", "value": "b06d5556ff42fbe0fa85d85c5fae2eed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306007, "uuid": "e847cee3-fcb6-4d00-8815-26de361409d1", "comment": "Malware payload (Formbook)", "value": "64daab0d89a76fa8d31a1e7081ec94db16b9b32a075ae20740597e1a3a313a44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306007, "uuid": "7dfd5ee5-b168-4945-af1c-7de6b2de726a", "comment": "Malware payload (Formbook)", "value": "8d9016f78a910e45f02616da17f4c4ac407326da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306007, "uuid": "28e52a56-d35b-426b-80f0-983a6448d991", "comment": "Malware payload (Formbook)", "value": "e98d50500c952d302009d9458f5cc70681305141d630e5b4cd6a00b51b5845617e7cc5ec5cd2c4bbfbb1703779c6fa08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306007, "uuid": "7adab14c-e7c1-49ce-b7e4-01b2f352ece2", "value": "T13E45BF0273D1C062FFAB92334F5AF6115ABC69260123E61F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306007, "uuid": "8669dc18-22bc-4a44-b39d-6b12495b6cc2", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306007, "uuid": "930de210-1e15-4b96-894d-cc8cb83493db", "value": "24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8aVY7ZN+/ckf3Zs:DTvC/MTQYxsWR7aVY7j+Tf3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306007, "uuid": "61cfddf4-61dc-4e28-a333-22251cfb160f", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306007, "uuid": "3c2f3f77-5ca7-4cd2-a8ab-2cefdd2a0cb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306007, "uuid": "3a9a13cb-3e65-4970-8e24-d7769eae5fe3", "value": "64daab0d89a76fa8d31a1e7081ec94db16b9b32a075ae20740597e1a3a313a44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a70e450-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770303497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303497, "uuid": "04437ae1-a011-43a8-96a4-3752b6e60d3a", "comment": "Malware payload (RemcosRAT)", "value": "f4cde3214e8bbeda958685706ba2fe88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303497, "uuid": "019e61a0-f98c-434a-8cba-9bbf9125f74a", "comment": "Malware payload (RemcosRAT)", "value": "650fb8c1fe8462ddaee07df5613b4832965b8d029846255d46d131c251616823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303497, "uuid": "b64f1d31-888d-4a07-a92f-20d510562f1a", "comment": "Malware payload (RemcosRAT)", "value": "941abf06eea943eea75fdf52e2babb984972f15f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303497, "uuid": "a031bdf3-31d9-44c1-958f-1f4ddc5f9f6e", "comment": "Malware payload (RemcosRAT)", "value": "07bb20aaba1d9a06ee14972e354c923a741bc9f408b053d90638d95bec319b2eed4b13371d4afd35b9921c36d0c89739", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303497, "uuid": "fde8eedf-aecf-4aab-afee-2ea12d08bcad", "value": "T1F8157BF037689A07C5A6DAF30623CA7047B5EEC55612D2DADDE1FADF34B8B005A14227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303497, "uuid": "ce72922e-ae7d-48cf-8a7f-89e6620095de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303497, "uuid": "5fc73bc8-1205-44da-8495-5979e9ffb127", "value": "12288:/2y6VlZzuN2kx0A5ohanZ3R3JzOVCFnFeMFGxm8BSRx9ftucM4pfqC9T/kR:uyYZzrFAcapR5zmCFnFxtgKhucM4JW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303497, "uuid": "65ea6d65-4096-4c99-bbd8-9c5f18696fa0", "value": 955912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303497, "uuid": "d3327baa-f313-4c36-91bb-92db56997dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303497, "uuid": "645ade3a-b5bb-4d4a-88a5-910b70483245", "value": "650fb8c1fe8462ddaee07df5613b4832965b8d029846255d46d131c251616823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73ce7c2-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770306766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306766, "uuid": "9f6b96ca-44fa-4792-a5a4-5b4a4fb52675", "comment": "Malware payload (AgentTesla)", "value": "34b989e03e4d4dcc95d1406c089d3a1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306766, "uuid": "b3b3d90c-614e-4601-9c38-1f8d6e29277e", "comment": "Malware payload (AgentTesla)", "value": "655a41ef74254b11a2c3f4f8e868a5744c320c7a85f0404fa8cfb7137caf8442", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306766, "uuid": "e4b454a2-c03a-40e5-952b-9faa5286cf50", "comment": "Malware payload (AgentTesla)", "value": "ec45cd9fb57832cbcdef96956e69ea7bb7587e63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306766, "uuid": "8a2d8c18-0ca8-46e8-aae0-705a32b8669c", "comment": "Malware payload (AgentTesla)", "value": "fabef4e13e3093edd2c83f87a910b693f09dbc5f92a24dc77d3c4b5416f64a956a63f719c4cdb00669537bf4dfa3b39f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306766, "uuid": "30523672-c80f-4b00-ac35-8b0656efefbd", "value": "T146340E037E88EB15E1A93D3782EF6C2413B2B4C71633C60B6F49AF6518516825D7EB2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306766, "uuid": "ebbdd80c-cdf8-4aea-9c6d-0b271b4fe8ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306766, "uuid": "ec73b99b-761f-4460-ae35-1f35aa2e9f85", "value": "3072:Q7NklR1Zv5ggsPo7b6VudhBEe5TyCS3SX:Q7NklR1ZxgNPQb6wSVCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306766, "uuid": "2e61175b-72da-4537-8ace-e6c3e268f3a7", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306766, "uuid": "762eb926-6ebb-4d39-81b0-de226ed836e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306766, "uuid": "49ed5f60-a298-4412-a047-3890f9e85022", "value": "655a41ef74254b11a2c3f4f8e868a5744c320c7a85f0404fa8cfb7137caf8442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fa61c9-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305479, "uuid": "9839a41a-d98a-4f77-8f84-869b1d1251a6", "comment": "Malware payload", "value": "104e304a3baf5a826f1e02d5ceec5dd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305479, "uuid": "e3829859-708f-4157-b1a3-2321845c950b", "comment": "Malware payload", "value": "65e8cbe1ca243a8a01d6243fc7f5c7090cabe66ae4307ea67b1e7a6f8fcd2fd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305479, "uuid": "f9c6a5ce-2aba-4338-9f89-71522c0c399d", "comment": "Malware payload", "value": "9d5c4445fe74f2e45a7df6a6c495a01561728162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305479, "uuid": "a5c85fc3-8c57-4a14-a41e-f828b910c2ff", "comment": "Malware payload", "value": "bd22e3ad9372a416a74ddeea3ad115413bcb3c3f6e0ecc0199d179cdcd0cd90b79135c39fe5aa09ad9059ff2ad35298d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305479, "uuid": "76af17a1-33b2-4ed5-bbb4-f2c14ae3f5b9", "value": "T11B743B16E7607025F95345B03DB8A29629293D3A1681ED0BB78EDF4A3772A8370F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305479, "uuid": "3b744de9-a01d-4aff-b243-87b3c5a9e666", "value": "b5daef1c499ab5b5f06d239a101172cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305479, "uuid": "3fdb09cd-9b6f-4aaf-8902-7966d420a2a2", "value": "6144:BGaUzmBPeu2/gkhA4uklVTh8GhTGVVJ8zyIUXeslK92xctd5:GnikhA4uklVThDGVVJOyIYRK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305479, "uuid": "2e912d45-8cbc-4d50-931b-092eb62f88fc", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305479, "uuid": "9ef80592-2885-4bec-a3aa-57607a995acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305479, "uuid": "75251450-d70e-4c98-bd3e-aaf1392c11eb", "value": "65e8cbe1ca243a8a01d6243fc7f5c7090cabe66ae4307ea67b1e7a6f8fcd2fd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f020c707-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770303426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303426, "uuid": "892baa40-be2f-4a14-bc6a-4fbcdf42dae4", "comment": "Malware payload (Formbook)", "value": "06e4a844cef94de8cfcc1bb321e7235a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303426, "uuid": "ac7b3382-fcc3-4177-89e9-11f58ac1e4cd", "comment": "Malware payload (Formbook)", "value": "6658826b71e07fdea4fef8408e67ce50851783d8a6d9bfa3285c0279f108c64b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303426, "uuid": "c7e47122-eff5-4249-86ad-685262dcba2f", "comment": "Malware payload (Formbook)", "value": "e13d86bc0403d60dcfeff289639c0ad0179d5039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303426, "uuid": "a9b28f5e-e7c3-4f0f-9265-5bba1efd5834", "comment": "Malware payload (Formbook)", "value": "ba9bab51ea80c183ef0a841719208bbba297dcf4ba0aa59175d16805dc92f799ec877757221a1c6938c1e874d1bc7190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303426, "uuid": "93249019-d281-4970-9a13-11234850170c", "value": "T165F4F14823A9DF06D0A29BF509B0D77447BD6E99E820D3079DEABDEB7539B002D40793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303426, "uuid": "d752c09a-6d0a-4893-b57f-29b6715a8e91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303426, "uuid": "ccacdac4-be03-4aba-b686-9c0e1ccc39ec", "value": "12288:jluW5hrJDLiYsWVqt75nWIn+obKWMSUtsPGvNLcQ4I7nU6tl9Pr+0uN2kx:4WTrNUaFeFKWsYOLcX8NtlFy0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303426, "uuid": "ef70cc1e-975b-47bf-b28c-0c17880c078d", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303426, "uuid": "63fd7478-1607-416a-8407-ef8e24976d07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303426, "uuid": "a7f38386-cde8-4df1-9d1a-1488c68b0065", "value": "6658826b71e07fdea4fef8408e67ce50851783d8a6d9bfa3285c0279f108c64b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3beaba80-025b-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770272629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770272629, "uuid": "017e2206-ea98-4fc1-acfa-f098eeb5a944", "comment": "Malware payload (AsyncRAT)", "value": "355335afa1eaf3f85e973ea876c420b8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770272629, "uuid": "a5b79808-d605-4d25-b798-a91f4973c005", "comment": "Malware payload (AsyncRAT)", "value": "66aa9497263b8177bfb97c36ec08f63219c8f6a49ec3db3719ba4cfa429df48c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770272629, "uuid": "274f4560-2e7c-4f25-8022-3ef31b86bad7", "comment": "Malware payload (AsyncRAT)", "value": "76dbe3574cbfab528818646cd472a86b6f31763c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770272629, "uuid": "8c81cffa-fc7c-476a-994b-fbfc2c58b4ff", "comment": "Malware payload (AsyncRAT)", "value": "bedaeaff6ec2e74e2a8e2acf57666f77abddcde53aee93b36a263020ed5c37909d9e2b2d21b250ee826c45018d350006", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770272629, "uuid": "459e1a8f-9349-4411-bc98-85d4c022a7f3", "value": "T112D24B08B3D88561E1FD57B94D7293048771EA5B9973DB9E1FC440AE2623B88CF25BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770272629, "uuid": "a25180a5-03f9-437b-ad6b-bf60d98f544d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770272629, "uuid": "bba687c4-ad6f-40ec-b391-84e57b01d43a", "value": "768:KMARXV643iqBkgg/cIRGqom/Rb7fB/dTj/+:tARXT3iqBk51i4RbN/Z/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770272629, "uuid": "7ca5580a-a060-4504-a2f4-9abdc4fd371c", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770272629, "uuid": "dc7b2dfe-4da9-4136-a6e3-d3391bfdab4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770272629, "uuid": "b6b3a05d-6f9a-4718-a2f0-5173e634b033", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f007e090-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770304285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304285, "uuid": "8d63c102-afd9-4785-8f04-8a0700c5ff69", "comment": "Malware payload (Formbook)", "value": "fb5830e3ea12e398db4fe1c57defc780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304285, "uuid": "092602a3-be01-4840-8a28-093954806bd8", "comment": "Malware payload (Formbook)", "value": "66d0c643f5aa03a5b4303caf17c128e0dc030530f22da3af6ed927cbc9e4f1d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304285, "uuid": "643f3d30-65cf-4815-9859-c4de8e0ba074", "comment": "Malware payload (Formbook)", "value": "6769355d985bf2f96c4970b054407a464fcf51bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304285, "uuid": "0f437b59-dfe7-426a-8668-5c9d3f529440", "comment": "Malware payload (Formbook)", "value": "540882591f2c7c2fc0668fe07cf907feaff2e680765f995433e58ccd7848070639422f8b46748b1a1d304db8e55960b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304285, "uuid": "bf294477-79a0-4066-afe3-399524da9fb4", "value": "T1A525020CFA76BA26CA8D0FBB9203211C84F79597E773F7675D9E09D20C25744885EA83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304285, "uuid": "72ab9639-b354-4ee8-a83d-2e43449cd507", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304285, "uuid": "103661d1-be5c-48e3-919c-821f1fa24884", "value": "12288:F1dbIAepSwPwriwNP9a4V+REPOi5+eyPtOzfiM159D7r9T8/yZYB9zU5D1CeN2Es:F19ZxwQidDZ+YUH9lHZ49zCT2/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304285, "uuid": "99f141c0-b908-41f7-90c6-f672904e2a12", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304285, "uuid": "1e0ee23c-e4ea-49ed-adf4-55f80f2a96f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304285, "uuid": "67efedb9-6223-47ad-ad71-56408bf6716e", "value": "66d0c643f5aa03a5b4303caf17c128e0dc030530f22da3af6ed927cbc9e4f1d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b08274-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770305524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305524, "uuid": "e8da35b1-817e-4cbe-8ec0-cd135de86337", "comment": "Malware payload (SnakeKeylogger)", "value": "8d0f35e0c0133c83fa294f4796613355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305524, "uuid": "f5e2ca78-c248-451b-b44f-9541dea2487f", "comment": "Malware payload (SnakeKeylogger)", "value": "677e17dbef308984f2dd543cdb461377829871b9b958f4963636a51fefd53108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305524, "uuid": "6fc3dcc1-5d2b-4931-8c72-f8bec13048ef", "comment": "Malware payload (SnakeKeylogger)", "value": "0349a4aafa7f6317c53bbdb1a1021a4946f35aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305524, "uuid": "1c307ecd-015a-4c6d-a5d8-d2191e404380", "comment": "Malware payload (SnakeKeylogger)", "value": "c4b88b95dcb1ab2d9bb6141fcca07b4035349331d5f78d52d9cf0be10924e97708940c2b26c8d64c759693bb051fff2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305524, "uuid": "68fb743a-d61f-4403-bbfe-72c8cdd28358", "value": "T1D835DF38EA3EF701D161BA70C829D6F61724FEC89815C31ABFE5AE9FB831551173A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305524, "uuid": "1841732d-9bdb-4cb9-8f70-1a16ec1ff9bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305524, "uuid": "60167baa-12d9-40ec-a1a5-b7f7342985bb", "value": "24576:ys40tZH4lfAJtJpKWeIL+NZif/qyOG827:940PwMteWeoQifCu827", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305524, "uuid": "9528a410-0bf9-4bc4-8d9b-8cf66b9479b0", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305524, "uuid": "21a566c4-3ab4-4690-8d19-9ae634b653a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305524, "uuid": "005b176c-441e-4c37-b198-0d77235f5cbc", "value": "677e17dbef308984f2dd543cdb461377829871b9b958f4963636a51fefd53108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198fd5a8-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770306931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306931, "uuid": "5ac37796-36b3-43fb-8a17-a4c3f4f43031", "comment": "Malware payload (RemcosRAT)", "value": "6a020622e9e8a8d9d604232474ab92fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306931, "uuid": "83f17226-a077-4578-98b9-b7c5dee00129", "comment": "Malware payload (RemcosRAT)", "value": "67be85e1d864a272c3ee117128c696d12e0528fe8d58a5a5749a7c157f525f08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306931, "uuid": "13bf3cfd-8ed5-4795-bef6-c20be722aaab", "comment": "Malware payload (RemcosRAT)", "value": "128386464f51edfebc64b2088ccf0375089eee6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306931, "uuid": "c4cd9aa9-8fcd-44e5-9c4c-4f6e01a4dab3", "comment": "Malware payload (RemcosRAT)", "value": "dada2df2fa3ed4ae27347d9b095bd72f94f8632215932d9bddd42969e0526d88e962c17330de2b50da525ce7e3674902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306931, "uuid": "827f7b2e-b643-4563-8237-e71230e9c5a7", "value": "T1C365F00917E58288F4B9DB30A2BB361547F0B51BC826EFAFA38411FD9C25799A543733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306931, "uuid": "003a29d6-8dc9-47b5-aa2d-3062e2ec43b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306931, "uuid": "8242f12e-3fc4-428c-86d6-6a44d05dda19", "value": "24576:McfMs1hsAdBen2pqpICnRveYepqMKDmfC4KOSSn2i6vKimsOD:McfTfeZRveYkqM3fC41p29KP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306931, "uuid": "d8d142d6-3b6f-4c27-b5e7-ce1df03c71e6", "value": 1475584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306931, "uuid": "7da226a3-44ee-4420-99ec-5de591619bf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306931, "uuid": "7c0f15c7-eb2f-427e-86dd-1215b4c91c99", "value": "67be85e1d864a272c3ee117128c696d12e0528fe8d58a5a5749a7c157f525f08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca1a936-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327284, "uuid": "1a0173d5-8877-4984-aca2-1eb095c3ed92", "comment": "Malware payload (Mirai)", "value": "4dacc8b2c4d7e582056d45ab64d53072", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327284, "uuid": "c2cad456-c7cf-447b-a7a2-9a410dfc8861", "comment": "Malware payload (Mirai)", "value": "68697a637fb928ec8a21f64cedcc40cff5e63a2fc76108bb8a5f6bc5f258af83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327284, "uuid": "2d43f8c7-cefa-442e-82ca-04c93f753a72", "comment": "Malware payload (Mirai)", "value": "bb4105df5f9e8b7de766ce39761ef142462f8df1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327284, "uuid": "310ffd70-3d05-4149-9e6e-a1b7892911f8", "comment": "Malware payload (Mirai)", "value": "642b7625054ab0eddfe7d77a581ff1e9972ab67f06e74bc586385640b1faa57768fb0dcbcb1568381183c33522a175c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327284, "uuid": "fd383d95-3f75-47eb-8317-ec466457d99a", "value": "T1BE932A46FC818B21D9C512BEFE1E118E331357B8E2DE72229E186F35738A56B0E7B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327284, "uuid": "506007b2-e9b1-4a0c-945b-93ae8d776235", "value": "1536:EAna1OyWP5rX2OHB/x9LGVQ3Rr5TAasLHzXoDARif1UjcCrH7fP52YX:UOt/uoF5TAaseUjcCrHbPQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327284, "uuid": "65235281-6765-490d-ace7-39ffb18d5646", "value": 95708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327284, "uuid": "d24ce99a-68be-4198-91c1-f29ecc7c4361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327284, "uuid": "81daca20-ef05-450d-b928-e8a7dce68664", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c447f163-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770307647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307647, "uuid": "1d2ccd3d-ef0b-465c-96ff-d7061fc0f362", "comment": "Malware payload (AsyncRAT)", "value": "1063e27b6e864740cb76fb9976a88382", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307647, "uuid": "80ef5122-5fe3-4c90-987d-004fa52fd38c", "comment": "Malware payload (AsyncRAT)", "value": "689f43633c2240b6fdd84c5968500734cc6d9d68d3bdf46431ba4612617e0524", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307647, "uuid": "f15fb60a-e8cd-4fc2-bd09-3c8d5f53be13", "comment": "Malware payload (AsyncRAT)", "value": "09086c82f6b043d1573e85c7f84cfe636f377407", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307647, "uuid": "9b1bae3d-1967-47b8-bba6-e64740cbe7de", "comment": "Malware payload (AsyncRAT)", "value": "7e4ff8a6ff97ca4a77f35f87d02f9d4da8e4b5d46285e9bd08485574ab7c601fa5645841aa22a07674f9bb9401d9902c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307647, "uuid": "6a51476b-78dd-44bc-bafe-f46d57fa3794", "value": "T1EBF24A48BBE04212D9FE6FF52AB361150274A607D823EB5E0CD885DA2F67BC0CD517D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307647, "uuid": "8da5a543-887f-45f4-ab11-16bb55fede55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307647, "uuid": "94bc21b8-6b1e-44fa-a06b-236e5623803e", "value": "384:qa9sTd9Tv1/ejhajcx+S64LdHbenHE0mMImR8kRwpkFTBLTt9JZwYGuVvNkVisXL:redEY8d7UHcpUXxFL9nE6pOjho/uVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307647, "uuid": "f89f32bd-e017-46db-bd6d-08996b999d95", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307647, "uuid": "f5e6ad6e-73aa-4b0f-b8cf-306176663c95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307647, "uuid": "5ee98273-8c38-4de2-971f-9953a221f31c", "value": "689f43633c2240b6fdd84c5968500734cc6d9d68d3bdf46431ba4612617e0524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c883bd4-02b1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770309594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309594, "uuid": "cbeab098-efb2-488d-b40d-e2933591478b", "comment": "Malware payload (Mirai)", "value": "8ee3ef8666a8eb910b14dd706b52a83a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309594, "uuid": "29ad9245-e8cb-400c-9c70-179585661199", "comment": "Malware payload (Mirai)", "value": "68b810ea130c08f22d0cf0e13086c5b3d83f3af24ce9c3dce44ccf39f62e6780", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309594, "uuid": "e2b04ca2-591a-4ec2-b5b6-52a4555b46ee", "comment": "Malware payload (Mirai)", "value": "1b0ee680ba4382442d065e7e40aeae61f8249a35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309594, "uuid": "a0320c65-8d79-46eb-be80-538ad888f2cc", "comment": "Malware payload (Mirai)", "value": "8746681c0890c10ef5deec2dec3df99f6fa4592f32b6a8ad02135b5442eefba8e0eea4aa6ec199d5ead38f8c10240ec5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309594, "uuid": "7be25427-bfac-499d-8abb-5dd3bf6036ff", "value": "T190A3121562C4CDF5D34AFA36B39ACAA87641D038263B30CAD738EB656CD26F5D4C5700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309594, "uuid": "7005a03d-53ed-41b1-9b39-4fcb180ef37e", "value": "1536:Qbt/6WaKBHAAeWa05FiliyYgpHCa43S6aimPSvVCliVCRrkavx7mtzPvWmyLH6w1:etiEgAtD5SSgpHb4itKvYqCEZX+Lr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770309594, "uuid": "38b0d946-cd83-4f3c-9808-d518d0c61e49", "value": 99012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770309594, "uuid": "b52cb2d4-7847-4a78-86f6-6d13972fc352", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309594, "uuid": "82ee6ca7-5697-4f28-9b13-a5cfc372acd2", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b3e12b-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770304269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304269, "uuid": "4798cab2-19d4-4ed2-bf07-501ab29ccace", "comment": "Malware payload (MassLogger)", "value": "cf8dae9e0cf931d593f1e8e2959b5431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304269, "uuid": "c82c1814-7726-4cd2-97e0-b145cb485e97", "comment": "Malware payload (MassLogger)", "value": "68d311ac923f8a0854dbfa4d1401c84db61a2c530ec3fb6e1994a690fdfdd38d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304269, "uuid": "8d4e16f4-4c13-452e-a82c-a4f780d54925", "comment": "Malware payload (MassLogger)", "value": "2781d26265da86f2f6462b4c4a4879e79904b4d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304269, "uuid": "7301bd35-1922-4ac0-9530-18c53699ecc9", "comment": "Malware payload (MassLogger)", "value": "8525f42b49c2c893b1a64ba114b7cad9a84f9d179ecf904300f9b316e79c1cc11e054c68d9350f8e2f5a4f1a58563583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304269, "uuid": "c396a854-d056-4ad6-8ec7-a5b83c349e5b", "value": "T1CF25020CBAAABE25C74A4FB7C203911841FB985AD522F36B1DD80DE05E9D7D0C94FA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304269, "uuid": "0d04e130-63a5-4c9e-95c4-ce5254309a19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304269, "uuid": "72d0edb5-c981-4ffc-abf2-5284e916ce31", "value": "12288:97AyRz4RRLYBBJ2GGsn70d0CWenfytiNPi5C08+6X3Sk52X7i60wVeTpsyzkFd0h:muByGF0VzvNLN3SqOOOeTSFFuM5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304269, "uuid": "f8f2537d-6e58-4b15-877f-bc87262d60f0", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304269, "uuid": "7715036a-7e19-40dc-b932-10c40375ae75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304269, "uuid": "e61a1e0d-103f-4085-a3c7-49a0a212e2e8", "value": "68d311ac923f8a0854dbfa4d1401c84db61a2c530ec3fb6e1994a690fdfdd38d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892d4323-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304541, "uuid": "ac0f6986-eeaf-41d7-accc-96cb6b935946", "comment": "Malware payload (AgentTesla)", "value": "edc436613154994840943edeb33d6c0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304541, "uuid": "8c71ccc2-cf30-4512-a52b-4464427ecde5", "comment": "Malware payload (AgentTesla)", "value": "6902bcc5bcd8de3b1fa8b2947c8e088319254d2904707a5296e115029e179ee0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304541, "uuid": "e8a9f4ce-7347-45d6-9c1b-ce80f7869df1", "comment": "Malware payload (AgentTesla)", "value": "66b6434e633acbb753198f7baef91b6f3ba164ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304541, "uuid": "1197e6ba-aaf3-47a6-904e-f0ac2c3fa284", "comment": "Malware payload (AgentTesla)", "value": "4d723cba90bc0674c775831835133845248a9acde1db71aa506632cdf85e2750cec7a88b4d3c59a45e30873fd6d2f045", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304541, "uuid": "8d173f3d-8052-4e17-9815-3aa1b7fa46e2", "value": "T1CD84F127FA39604FD978ECB06D126A7D6AB01D303077E2073A52FB2BD9316611B4F259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304541, "uuid": "a484fbac-115f-40cf-b1d7-0043989898fa", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304541, "uuid": "494c9a0b-cd7e-430c-89cf-1368761286bd", "value": "6144:VDf4hQtprHEev6SCbqshwzqQFTat1NjbkQ03NuTWh:J4y7rHRjCushuq/NjwDXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304541, "uuid": "e5b8c721-8318-45b5-b49a-dc2985d05ff4", "value": 377752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304541, "uuid": "e3e858b7-94ed-4168-9228-cc02085e3c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304541, "uuid": "3cffaf96-a9d0-433f-a28b-f98938af9f0c", "value": "6902bcc5bcd8de3b1fa8b2947c8e088319254d2904707a5296e115029e179ee0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8615eb-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304975, "uuid": "8bb53589-1d53-4257-ad8b-9eb6d4f3caaa", "comment": "Malware payload", "value": "3523bed1a9a44c6635d79089bb17ddd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304975, "uuid": "4b7a68c3-2612-4b41-9bbf-ddd8ce196640", "comment": "Malware payload", "value": "6977899b07c0c789fd516de82f436698fde6b53060404905dca561a41cd59290", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304975, "uuid": "059292f0-91ef-4849-b379-b7de0794029e", "comment": "Malware payload", "value": "016962010ec7bf51d3235ba51108d18e2a8ea778", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304975, "uuid": "1d5994a4-cae0-4f35-be7e-dcf47cb3d8d3", "comment": "Malware payload", "value": "ab3daf0e7edb55e450f956cb39d88751612b31aa191ba6a756221d5a01cdead42823130821d5b55ac504521befaaeaa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304975, "uuid": "c72acea5-2e84-4844-80a6-5f2940f6f4eb", "value": "T1C0B5339DAD872872CC64CB3049CA667DF333BE9D1C100D0F6B48E89259B55CB6EEC664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304975, "uuid": "084105df-bd01-423b-998a-44f050387563", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304975, "uuid": "d4cd9a95-9191-46b4-b808-fc04274fe715", "value": "49152:ada5IVioI/ss4zQqJea2PQGCxWaFkUihqeTMrVUCNVVpJ:ZeiSsqJf2WxtXreTMRUC1pJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304975, "uuid": "413c8908-a8e4-46a0-ac33-0803846ba301", "value": 2312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304975, "uuid": "a94edcc4-d6f1-4f5e-9e02-e4eb7f50c944", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304975, "uuid": "891b988d-c921-4435-afa0-1f4ee7ce9ba7", "value": "6977899b07c0c789fd516de82f436698fde6b53060404905dca561a41cd59290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defbb271-026b-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770279775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279775, "uuid": "ad890573-8492-40dc-809d-4cf1e1922200", "comment": "Malware payload (RemcosRAT)", "value": "19a0186fe8a24133875b7ed5f587c98f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279775, "uuid": "bb7dd898-61b7-452f-a3d5-047c28981bfd", "comment": "Malware payload (RemcosRAT)", "value": "6a248fb4bc5f02ab995fe521a9585c5362a8bba831058b3fa6a95fb98f9e154a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279775, "uuid": "8c48aa38-e65b-4890-a96d-a16e88cb0dd6", "comment": "Malware payload (RemcosRAT)", "value": "a3041bde129b0dfefe2e71be0e9aadd5e66720e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279775, "uuid": "431b6dac-d7ce-43e3-80f8-2ab9a283ffb2", "comment": "Malware payload (RemcosRAT)", "value": "6cb1e3a08317ad8c964f443ca54a765b4855edeeef5088311b74c4fadbac3f497ca8ad2617b4590c3d9faec84ed6df00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279775, "uuid": "afe3d571-c9f8-4a0c-9614-3695a16d4727", "value": "T1F784AE51227ADC62E39443B48256E77D8AB1FA8A2931C33726F1ED9FB518F363C18351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279775, "uuid": "391fe93e-5923-4b67-9f94-d55e4ea243e8", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279775, "uuid": "1f1eb930-c4f3-4513-8deb-6b7f03a406c2", "value": "6144:rB+pgU1Kl8Ga/j4jO3mvABRp0mP+YCgv/UihJrdsSdOVn9R/ao/3gj4gNDbm+N1:rgn7hCuUiRsW8yQ3gj4gRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770279775, "uuid": "47e3c3ac-8ba8-4c9d-98b7-f36da4ab531d", "value": 404896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770279775, "uuid": "0e09a6fa-b374-4ebd-b25b-9edc9bcf1ebf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279775, "uuid": "c3c3d677-0f31-4703-9290-fc8b6aafdb6c", "value": "RFQ N\u00b0 150VOL INTECH2026 SUPPLY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f3764e-0264-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770276397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276397, "uuid": "944ebbed-3124-4804-97c5-33212caeb4a4", "comment": "Malware payload (PhantomStealer)", "value": "aba0c0fbb068b32fd941aaf904d693e7", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276397, "uuid": "74eb2ca6-4fda-4d5f-bd8a-c6b8799deb93", "comment": "Malware payload (PhantomStealer)", "value": "6a2ad4bf1ce6762ef84004adb6fad86c07da1e4e6142fcecff7e1ab68a6de799", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276397, "uuid": "9780828b-c082-41d7-8e62-73c5272f8f83", "comment": "Malware payload (PhantomStealer)", "value": "8fbfefefa5b5a3050c31cb9b0ed2cd15b105440c", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770276397, "uuid": "e2915b43-b7d6-413d-a2ba-54f06f061f47", "comment": "Malware payload (PhantomStealer)", "value": "146b338a7f907ba2f812d29eae843a6a1b48a8f19a17af03572ae29e2d877d1f6a2fc5e2abbdbf399315d571da7a16eb", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276397, "uuid": "4791d1a0-3179-4e42-ab28-0896c6a6cac6", "value": "T1A9F51111D9198DA40A6C802428AA0DC72A814EA74D9877793F9F5F8E1F0F65FC07A7FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276397, "uuid": "1750d8eb-b62f-497a-a2f3-4984e1eeb8a6", "value": "49152:MlcMFwocRDzZQ2sxq4QoKtDCP/cqEiz5vSkEDm:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770276397, "uuid": "f1d6b44b-0a8f-4ff0-8958-1fa13e1ff0b1", "value": 3591441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770276397, "uuid": "92ccf95a-18dd-4dc0-b943-8853a56becc1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770276397, "uuid": "3b5801ba-14f7-45ec-8470-0aa6ec4314ef", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd35e8fe-028c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770293999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770293999, "uuid": "b48674ff-5cac-44fc-9495-a5530a685b84", "comment": "Malware payload (Mirai)", "value": "885e5c9141a4a988df67166c4a66173e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770293999, "uuid": "18d8de8e-ecdf-4f97-ac1a-d4000f431575", "comment": "Malware payload (Mirai)", "value": "6a878f64c541f29affab51a61b2116a07cb42fb1bb2a71f9416178b766d3ab9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770293999, "uuid": "4f672176-ce81-478a-af1e-f34ec7970140", "comment": "Malware payload (Mirai)", "value": "eda4a4f6cc0aff05ea54474fc9c290831f10ae59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770293999, "uuid": "e1a27e0b-bcc1-4f1a-ac6a-14f4e75bb6bc", "comment": "Malware payload (Mirai)", "value": "74f3cd6d2993caa190780dd8c6ee879e48313d11c478698444381120e14fe76ee54d794c96293577e99fd0e1c0c428ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770293999, "uuid": "fa4ed8c9-b3cb-4aac-9305-e05818447701", "value": "T17F73022B918F4AB3C1E99C3370077B34AF79A063D8E53B05FC91D045F91DDA2628467A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770293999, "uuid": "5371a5ea-75a3-4787-a7e4-3552cef3eda7", "value": "1536:mOlDJ9nqHLw+ZQeuFvQfPbYGiNw7VI/rW0wvnEJ3gzE94e/ohAkNor7:9pn40+ZsvaTYbeO/VwP/zE99/ohrNS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770293999, "uuid": "82a1bddc-e216-4cd2-a780-45cdec3c323f", "value": 74732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770293999, "uuid": "94521769-5571-47ef-91d0-a26f8c7ad411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770293999, "uuid": "1461ce19-2c5f-4999-8b88-a0af059fde87", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b43177-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (DattoRMM)", "timestamp": 1770305935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305935, "uuid": "913e5af9-3bf0-4795-a369-2c8c3e91ef8c", "comment": "Malware payload (DattoRMM)", "value": "e5b3caa9f21b67f75df53828b30cd8ae", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305935, "uuid": "ff136e11-8be2-4fc1-b6ce-771423e507f6", "comment": "Malware payload (DattoRMM)", "value": "6aa193961f68da30506276492b0a0c632cd9a05ebbe9d6b43812504e367cdaa7", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305935, "uuid": "cbab8524-b09a-47c3-8e03-fad4a284dc60", "comment": "Malware payload (DattoRMM)", "value": "7adcbd53084f5227bf6ffd1580a6805719993a2a", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305935, "uuid": "2afd661b-10e1-426a-b105-aa9e13404072", "comment": "Malware payload (DattoRMM)", "value": "00b509c003b403967fe939fe5b1c235b7ac8c7003624d8099eff5597a22e200aa41331a98fa1a9123b2c650e6b21c01e", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305935, "uuid": "01431abf-ef45-4129-80f8-917325c1d119", "value": "T10FB63313C57BCCE4CB234678D6E10A46BB4A058A9C5AB8D4F584633E55D34ADEF38B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305935, "uuid": "de49394f-ff1b-4288-bf60-f2b4289af70f", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305935, "uuid": "5eef8709-fa2b-4d26-bacc-c7bd1c9dd9dd", "value": "196608:HaZk+wj0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8m:/nj04RT9R4PkE7Ap84p29qIT0Z6rXr8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305935, "uuid": "efeb1236-c92d-4ed2-b021-197bf58bf0f3", "value": 11055784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305935, "uuid": "9664b959-e8cb-45c8-ad78-599dc615113a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305935, "uuid": "a35c1b10-232c-4f54-a0d9-e4b5d0c63931", "value": "ZoomWorkspace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9fda6f-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305725, "uuid": "afd75f6f-75ad-4077-847a-dd7eb947b706", "comment": "Malware payload", "value": "313fe79b74d0f75f07379fd287ab36b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305725, "uuid": "73fec4aa-2d5a-4a4f-92a4-88c93a177b60", "comment": "Malware payload", "value": "6ac3949cf0ae8924babf05276a5b8005d1b1eb1d86822cf46a9d9e9de201905a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305725, "uuid": "4fe570e9-59ea-47c2-8415-e01cd95ecffd", "comment": "Malware payload", "value": "d36aac291f27a692f44b58f65d8be06670e00e05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305725, "uuid": "200e2fed-ed53-4e90-bc7d-a267bd11bb16", "comment": "Malware payload", "value": "44c0b3c2e703eeef342b1f5615abfe86c8f4bf7feaa23216cc4e2c933eab4e1c74eaef4bb8adcc8fb6ef94b5d3fbfa66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305725, "uuid": "90e1a578-c42e-42d4-b41d-467ae67f1d3b", "value": "T137B4F712E660B62AF99319703D78A256392C3C362641EC0BFB899F9B367158370F571F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305725, "uuid": "5e8aacab-000b-4192-9738-22bb2a4e28b3", "value": "5c2c8df24a8732caccbd0b719078af6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305725, "uuid": "4d70f7cd-1114-4cf0-8664-073177ce09ea", "value": "12288:x2Nbbty1b94rA3D1XGZBbuw1zFhio8ynW5bMoBS:8y12BKw1zcwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305725, "uuid": "7cc85055-fb24-4d6e-914f-fe97acb26a47", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305725, "uuid": "53f6809a-6b01-4d53-b918-e30d000c8283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305725, "uuid": "685ac2ee-0704-448a-8579-8f5f65c3a3c0", "value": "6ac3949cf0ae8924babf05276a5b8005d1b1eb1d86822cf46a9d9e9de201905a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a055cd4-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770307496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307496, "uuid": "9b9bc822-ae70-4350-9fbe-702a4774f111", "comment": "Malware payload (AgentTesla)", "value": "04235afb84f1f562f28ebdc899463d08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307496, "uuid": "94bd9ae5-96e7-4c60-8d61-e3230a2728cd", "comment": "Malware payload (AgentTesla)", "value": "6aff0cf624113e7006b6c7659408e125933f3be2511f50e87009ef6604faa7dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307496, "uuid": "ad096643-4e66-4d14-893a-6c575896b368", "comment": "Malware payload (AgentTesla)", "value": "c09d468d2656604799017ab79effbd4c6363d96f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307496, "uuid": "ac2c3ca8-86a4-4287-90b2-d9a56dd99036", "comment": "Malware payload (AgentTesla)", "value": "8eeb36a11f418e282473ff25c7039905c4d146bd99a0338fb5ecad1e18b03ab20c443ad2eac52686d3a173eee51783ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307496, "uuid": "5c77cff3-5709-4201-8aea-b497c14675e4", "value": "T1D635BE0273D1C062FFAB92734B5AF6115BBC79260123A61F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307496, "uuid": "705b8eda-65e9-4a04-b939-1b87b08c98d3", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307496, "uuid": "8d97e634-de18-4326-95dd-a1cbc7d3214a", "value": "24576:g5EmXFtKaL4/oFe5T9yyXYfP1ijXdaeMj8jFLU:gPVt/LZeJbInQRaecyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307496, "uuid": "e445edd6-2ae9-4434-b079-a2b879f33eff", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307496, "uuid": "7923137a-d483-4419-b424-d811a8f5a91c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307496, "uuid": "5f1fe91a-0d1f-41e2-b69f-64e9531f0d6e", "value": "6aff0cf624113e7006b6c7659408e125933f3be2511f50e87009ef6604faa7dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6b1c19-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770307980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307980, "uuid": "cedb9f3e-d70b-47ad-8727-64a740c1f1f4", "comment": "Malware payload (DarkTortilla)", "value": "3ea51641b56d2a47561ea7a7fa2de06d", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307980, "uuid": "28e4002d-5e64-43f8-9043-7d35c287af36", "comment": "Malware payload (DarkTortilla)", "value": "6b914bd021edae8935e2f9b5a9dd2a43aaf656e45d8b7ba3c751b863c8e9f636", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307980, "uuid": "a1df46a0-305c-4790-ae8e-c40c833b30a5", "comment": "Malware payload (DarkTortilla)", "value": "bce7183484e4787dfc2a6eb8528395b38f4fc963", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307980, "uuid": "cc7117cb-a4e3-4570-82dd-2b02c41e1461", "comment": "Malware payload (DarkTortilla)", "value": "b40b6644cfd89eacef5f72410fff02de3ff429939c908f3fb1569b78838af1ca3bd367387bd67de5ee54da03d3b6a64e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307980, "uuid": "a07ffaa6-eb06-4d3b-8a6b-f73f2be538d9", "value": "T1C465F10A17D585A8F4BDDB30A27A361543F0B11BD926EFEFA38010F98D3579AA543363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307980, "uuid": "45d50bb7-e19a-447c-afbf-d0650ae9f227", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307980, "uuid": "9d4e1367-bcff-4602-ab11-80122c1c498e", "value": "24576:iyhfMs1hsAdBen2pqp2kNFs5JRkgju18xTC:iyhfTfeZF2JKcXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307980, "uuid": "19458a32-3109-4ddf-bb24-bf43e2cb404f", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307980, "uuid": "77a2dd7b-f0e9-42e5-9900-08a1c429bdc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307980, "uuid": "46a53aa3-2af3-42a0-913d-2aec3edf29a3", "value": "6b914bd021edae8935e2f9b5a9dd2a43aaf656e45d8b7ba3c751b863c8e9f636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68d5058-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305128, "uuid": "5f881668-1956-4edd-8481-b5892419999e", "comment": "Malware payload", "value": "f8d37d0e0ecfe3421e5d9aae81e453b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305128, "uuid": "a9edeb31-90df-4efa-89cf-3db67709df57", "comment": "Malware payload", "value": "6b927904f7e7d7a115bc0bb6984f54578ad9541dbd6c7f2e6e2d72796d2418fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305128, "uuid": "ccef3f42-2aa4-48c3-b5a0-102c68adbdcf", "comment": "Malware payload", "value": "5e58029d83d785b5dd0eead91b649242c1481cb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305128, "uuid": "6d0fde9b-1a92-450d-afba-f39161108446", "comment": "Malware payload", "value": "5b8642dfb4750b40ececef1c222c2513dc759cddf911c81961752ad9cec5ba68ffd1f91776e77c8ef4b0863ef6495c7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305128, "uuid": "edd143b0-1349-4979-9e42-e11d417cd0eb", "value": "T137E6331C53A005F3FEE9C63E9962D4B086776D6317A6C19F83A851E06D63BC2253BB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305128, "uuid": "3c53d5f5-57b3-4a2d-9ee0-1713bff566aa", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305128, "uuid": "217fda02-8965-4169-b102-3c65ffa9f48f", "value": "393216:enAu1wGaa5wEMiuHClcuC9XA4C7yiV6ILi:haGziuilJCNA4C7tVBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305128, "uuid": "6b51697c-bbde-45f3-8b8b-1e2564db5230", "value": 14833207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305128, "uuid": "7f7677f1-2ad0-4f05-8d0b-3365c205f845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305128, "uuid": "1a14a8e3-7f66-4d68-97b7-ee7cd5309ac7", "value": "6b927904f7e7d7a115bc0bb6984f54578ad9541dbd6c7f2e6e2d72796d2418fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9485da11-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303701, "uuid": "29b4d09c-f6f0-4899-b56d-d195119d2e37", "comment": "Malware payload (AgentTesla)", "value": "e46e8a92009c14a0763074882ba76c2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303701, "uuid": "12265953-10bd-4767-97ce-db99c3e8b97c", "comment": "Malware payload (AgentTesla)", "value": "6bbb277e6ab41b1434f72142a6e8f9130a4eb3618305a9a379197da0b17dd26c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303701, "uuid": "967d97b4-85da-4a14-98e0-973b1a519295", "comment": "Malware payload (AgentTesla)", "value": "cb2716d57143e00dd3bca4a4893f9bd630bbef1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303701, "uuid": "9ba52040-9bc9-44f9-8def-fecacec7123f", "comment": "Malware payload (AgentTesla)", "value": "cc5ecfca6cffaa31bdba15c10cc73937ed8094a8196d6bb12b3c48222105640ebce632cc0ad626e70292a9c54a535475", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303701, "uuid": "7707a468-f99a-4a32-911e-2446f1f0d15c", "value": "T15274F12AFA34148FE935EDB06E2356BE56B41C75203792473F13FB6B98752614B0F20A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303701, "uuid": "27ec1023-f2db-49d6-8669-2a29bfc2a358", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303701, "uuid": "142c0f8e-ef5a-489a-94fb-7c9d7ffc258f", "value": "6144:PDf4hQtpjxev7ghvwFDJk/UB62920XNmNg3HRladTCGc:b4y7jAUohG/q6309I46Js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303701, "uuid": "72d9091d-b97d-488c-93d0-5fae1db382ad", "value": 350944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303701, "uuid": "a4877ef2-1ddf-4407-88f9-cfd7a780c9ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303701, "uuid": "41ee63b3-ea35-4bab-9c6f-6e7034e893a7", "value": "6bbb277e6ab41b1434f72142a6e8f9130a4eb3618305a9a379197da0b17dd26c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e526c26-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770306563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306563, "uuid": "7f2fb945-3318-4028-9421-1664bebe7349", "comment": "Malware payload (GuLoader)", "value": "1cc32abe81f7a3699b2766d48cd5f99f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306563, "uuid": "15c35288-06c4-4c51-91a9-7efe89df3661", "comment": "Malware payload (GuLoader)", "value": "6be7b82e4bcf39cedf4fcf1beee5659998b27764012fea32f40780ec6608072e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306563, "uuid": "5b080a8c-921f-4871-bc98-edc66959a231", "comment": "Malware payload (GuLoader)", "value": "305e3556a32b14ea2aa0f85fecda116ea0380be8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306563, "uuid": "01f6aed7-8b62-47e2-acaa-10d342704c18", "comment": "Malware payload (GuLoader)", "value": "aea624a0f8945de155585a9ebe87df257bf3b9db8acd6fd7912561a5f2b0376f47311b77616ca88e2adbb342dd16a352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306563, "uuid": "41b2ade4-905e-432a-9a40-8c6d7f26fa67", "value": "T1AAF4F10F7158C06ECDF91EB0F8596CF5164DAC059CA6608E76D973EE65F22F1832A20B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306563, "uuid": "4fa48eb4-431d-4690-93ad-e7a9f1deba40", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306563, "uuid": "86db548c-8e4a-4233-9b4b-4049aab4926e", "value": "12288:iqNba6jFx4Vbh4hu9Zs21/VVtldZCdy0lwdUa4k:rba6jX4VlTZd1/XTOdy0ydv4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306563, "uuid": "e34d049c-a6f7-4466-9a92-966ffe54b2f4", "value": 794208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306563, "uuid": "4e99825e-2286-4ed8-b1b1-16d5e8bc47d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306563, "uuid": "02003542-fc3d-4c1c-bb37-bf1a1f360466", "value": "6be7b82e4bcf39cedf4fcf1beee5659998b27764012fea32f40780ec6608072e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d5b8fe-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327188, "uuid": "67088e24-f60b-4e72-a174-8b6f97bb7b95", "comment": "Malware payload (Mirai)", "value": "2bd4d530f96945d90cc93220e9677455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327188, "uuid": "0c296d3e-5b2b-41aa-b3be-ba8548062387", "comment": "Malware payload (Mirai)", "value": "6c8404ba7aed2d2be6c21cbd2a2b49d89fa09c14278fad49c80ef1088300382c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327188, "uuid": "d90dda68-a4be-4275-80b8-999234d2ff8e", "comment": "Malware payload (Mirai)", "value": "c53511ea1632c616a7779270a48559b575a31f45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327188, "uuid": "43917d8f-886b-402e-98df-ab45f98cec23", "comment": "Malware payload (Mirai)", "value": "104a6637ef5ef72956b48f2084f21dc19527b75aa4d8d1b8da97b0775a68122be84bb7a1b2986ebd5f19754cb5eb6cd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327188, "uuid": "038a11f5-455b-4800-9dd8-1852510d1404", "value": "T18403F2B8212DC523D9316C7BDDB203D76D5806B8D1E7A507DD7B8A6CC726384B28938B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327188, "uuid": "da8cb57a-084a-4c0e-ba58-4bde0be8f28b", "value": "768:DGPjXBOTsh1aqh3kosh+IkLpFw71qB7IuszFKwMKBJhkTkY7U9q3UELyh:WLYptVh0whqFIlQ/ZA4Ly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327188, "uuid": "1f7cfb16-346d-41de-9224-99c060f65097", "value": 40340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327188, "uuid": "1027ec12-a199-44e1-8f2d-8001db5a50c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327188, "uuid": "d0ff5257-0e66-40ad-9dee-0ebeffde32ba", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f74ef5-02b0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770309099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309099, "uuid": "57365a85-9d73-4717-8004-3c9c5c65a727", "comment": "Malware payload", "value": "b75540e7ca4ed6b7d33735071f676ead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309099, "uuid": "db6d1eb6-8b43-497c-bb84-9669c6ab1d18", "comment": "Malware payload", "value": "6c8930b5d3168902e080afe5fad0adaeb89975f706ba08e738d1ee1fbae06e8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309099, "uuid": "b8e19c7c-135b-4be4-a370-9f17b4af5cb4", "comment": "Malware payload", "value": "5b12b095acbd1db83026eb4efadf4ec63ad18515", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309099, "uuid": "01a93356-8d11-42bd-bf09-e328f119590d", "comment": "Malware payload", "value": "b38eaf44300beb2e922223f8d95553f1e07e6b3285d5e057544e9337474fd848c014688849159d166c85d8eda33b63e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309099, "uuid": "97c335db-7ec3-4962-96ca-5e3ba626898d", "value": "T109A4AD03BAD100BED8BE813948675615A77AF4218B62EBEB139405FD0F277C69D38F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309099, "uuid": "54175550-153e-4bb1-864e-397a6a01869c", "value": "6144:Zy9wz4ZoeETEW1gbpJA3KpSL0pDpTpWEdMppLOGPHGx+Rf3VtDybX:Zy9ULePJA3KY0pNYEdYGx+Rf3Da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770309099, "uuid": "3588db85-84a9-4665-ac3b-30a361c58ee1", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770309099, "uuid": "cb620c1a-897d-46d0-bffe-296a7ad39fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309099, "uuid": "e855612f-a93a-42b6-8634-c764f8b3a2ca", "value": "ZeninDLC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2f3b74-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327281, "uuid": "0ec7f580-acb3-4308-b4bf-f6e30e346489", "comment": "Malware payload (Mirai)", "value": "92433945674422a2eeee2ff139ae4d76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327281, "uuid": "2fd3f72f-bba5-4d5f-90c8-185942961806", "comment": "Malware payload (Mirai)", "value": "6d420f7de803a3bdf61dc30df230406cb85f4445ec1cdd86c2be8ca066f9b810", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327281, "uuid": "ff426918-8132-4992-a002-b48efe752d87", "comment": "Malware payload (Mirai)", "value": "dc4eb9e48986c59f3e62d4577ae2c31984124286", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327281, "uuid": "5bd5039c-8b5d-45fa-a69a-a08c05ef929c", "comment": "Malware payload (Mirai)", "value": "c85d3031581b99eeb757f5d49af1135d085c7ec62f8a7b8a92775b2ef29121b8e848f6594ad11f6f5d48b7e7103e36a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327281, "uuid": "524ec05e-ecff-482a-9ced-af01e874eea5", "value": "T19DB3D709BF611EFBE85FDC370AE9070524CD696A22A93B797534D818F24F24F16E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327281, "uuid": "fc215375-8a37-4a74-be94-31510e19f3f4", "value": "1536:05tnyQpqfd33r2A7ML7ZJL8BXyTWr1AbtIbJa2RS9ZzAGGzGhb9vrXaAm8N:ytPSd33r2A7kC4ObJa2I9gGHw8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327281, "uuid": "d72e7650-72f4-4f13-8ead-930cf9d11649", "value": 113860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327281, "uuid": "02bf3309-9236-4a27-9d6c-ba5fa6b35c71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327281, "uuid": "56ed9d3f-6f0c-46a6-9df0-bb49fcdf6a15", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bf7651-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770305712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305712, "uuid": "c6a0bcd5-8863-44b2-b80b-0e4785676752", "comment": "Malware payload (Formbook)", "value": "d14f066d3bc3d4896895111d5f02ce1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305712, "uuid": "ee7f9371-db9f-4e22-a3e7-8f7d3f4e5503", "comment": "Malware payload (Formbook)", "value": "6d4e2a6f3e50faf1f75898a65f63755dc5e2093e4bbbbb0cf17c505b14ba7f56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305712, "uuid": "d7d2617a-f219-44af-9c16-9b717c4226b4", "comment": "Malware payload (Formbook)", "value": "ad07339bbc955869ef5ca7ce747817dbc688fe74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305712, "uuid": "cbda229e-43a4-4159-bb2c-77e4e899b317", "comment": "Malware payload (Formbook)", "value": "8bbd11945776b36501494062df17ed67a4133b0b76c51403eff4d46bd3c73f446aebed5992af2fb20f6ab72fd06d3408", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305712, "uuid": "4f8ca8a6-8e36-4f2e-bbb4-696ccc53f809", "value": "T14AA4D083FAC0D5D2D828483299B3873512BF7C796A8D9383A34471613A731C6663BE67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305712, "uuid": "6944a3e4-1603-4a12-9ea4-bae91a9312a0", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305712, "uuid": "45d6c45c-3237-467b-910c-b74dd1728adb", "value": "12288:XcODb7v0o8JvG5UFP+ibiucOTjjjjcjzjcjcjjYX1mi/9Idwi1CyaD0qg8+qnM6:sO4njjjjcjzjcjcjjg1mi/2SqCXtg8XM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305712, "uuid": "73a3937f-33f4-4113-9ea9-316a0cd8184c", "value": 457942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305712, "uuid": "b4cd2eca-6fe7-461f-8c03-9416dc38dab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305712, "uuid": "022a863e-9020-412d-abcc-20d7a6f53fd8", "value": "6d4e2a6f3e50faf1f75898a65f63755dc5e2093e4bbbbb0cf17c505b14ba7f56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b8be38-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770305989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305989, "uuid": "d9efffff-7cd4-42a2-9832-6819aea9bb78", "comment": "Malware payload (PhantomStealer)", "value": "a5a4627942bcc14f663712f8197ee91b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305989, "uuid": "6d5f193c-ce8d-470e-b2c8-dded5f1f0eff", "comment": "Malware payload (PhantomStealer)", "value": "6dace0f7083a35801d24de5fbc5ea3eed463d65155545c04ac911ed67d2af8b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305989, "uuid": "857abc86-1d5f-4ce9-b3ef-8806f4dad03a", "comment": "Malware payload (PhantomStealer)", "value": "6ce86d27037876603075f1e242491dbe1919bc4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305989, "uuid": "04744eb6-1d6b-46a0-a6c4-4f4f6e5af5b2", "comment": "Malware payload (PhantomStealer)", "value": "b813470f9c7bebb2bb03621967400c4bdcd705745d289bb72c093cf7806b7de7a55310e981fca74df875e399ad4cba44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305989, "uuid": "c925057d-b982-4370-9162-4bf72684db28", "value": "T1AE75E00273D1C062FFAB96734B5AF6215BBC79260123AA1F13981D79BD701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305989, "uuid": "b018f974-c780-41c0-a183-f57f76dbdb36", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305989, "uuid": "03c81c40-bbac-4c45-afb5-cc73369c5350", "value": "49152:mPVt/LZeJbInQRa/ypKIftJjOIjsyRODc0vBxkhdlCdhN:cTYbInQftJO/vBWhd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305989, "uuid": "641a3f9f-0743-4c8d-b53b-e6be08364446", "value": 1693184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305989, "uuid": "0499ddb1-33dd-4b50-9e51-47eaa5612395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305989, "uuid": "f9f090fa-23dd-4305-9b00-631474142690", "value": "6dace0f7083a35801d24de5fbc5ea3eed463d65155545c04ac911ed67d2af8b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4962e98f-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307441, "uuid": "69e9a710-f22d-4ca4-8c18-569148151d8f", "comment": "Malware payload", "value": "7d92aa00aa6d1fd6a7d330f060fe9fc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307441, "uuid": "6b45dc0e-c9a7-49f9-aa21-96506bb4d853", "comment": "Malware payload", "value": "6de1ebfef3f0e53a3b188fba78271ffccdc0bbfd95fdf29637f81117570331b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307441, "uuid": "5b6670c7-3572-4750-91bc-372a3d64f658", "comment": "Malware payload", "value": "dad375ab4a00a489d8c77756e9f869c396625381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307441, "uuid": "cf27ea9c-aa70-4baa-8b26-c7fd3c9e54f7", "comment": "Malware payload", "value": "fa7ff6dc31793c45705785c5b7ab1faf01c463944a845879f5657ee10d4fd64e8865c13b9768eb3cd49918a93828f37b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307441, "uuid": "55be1232-7738-403b-9483-ea1bca66a87b", "value": "T18505CF34ADD800E2F86390F0063D3ADE99629EE397F5D3BF02C58D252AB32754E52D95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307441, "uuid": "674b6992-8152-4621-986a-d4655f0b4a29", "value": "b6ba9dcce507b12663ce8b3e83b96cf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307441, "uuid": "d0c931a0-4053-4c1a-aaf9-492f54f7336a", "value": "24576:rcoqnJxFc34zhZlSGCXuRJ1sJaZZeCRbAMJ7qw:rcpnJvi4zIoJOI7ekbBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307441, "uuid": "9616f6b8-d807-432e-8a84-f0e57c224da0", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307441, "uuid": "2e027594-a5e0-4e40-aa8f-4220b33f144b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307441, "uuid": "4d037d62-cca1-48bd-93c8-cdf1fcaf6f89", "value": "6de1ebfef3f0e53a3b188fba78271ffccdc0bbfd95fdf29637f81117570331b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c56c93-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770304722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304722, "uuid": "ebb60692-51ea-4732-b8f2-c1498a0333d1", "comment": "Malware payload (GuLoader)", "value": "fb0775c3045b1686ae37418656fb84a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304722, "uuid": "74df90b1-e4f9-44c4-95e3-dc3b62395e19", "comment": "Malware payload (GuLoader)", "value": "6e19cdeb6b68b60c686e9ca4d6e6bf55fd3d9a2127c60f8ecc822cc4dfb1a0bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304722, "uuid": "253ea415-5a73-4171-942b-cfc1f0cf4ec0", "comment": "Malware payload (GuLoader)", "value": "7596535ecd0d9a2f2478b6cfe454cd384f94516b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304722, "uuid": "5a403831-91b3-4ad6-b9fb-90b5e92b8469", "comment": "Malware payload (GuLoader)", "value": "46d2e63688500e05c3189f417ea8fecc468cabf6cd3843597c1fa633aefafccab7d603959b0eb0525a21bdf39b9b2866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304722, "uuid": "5d8372e0-62ae-4127-a09e-50a042ff3dc9", "value": "T1C0F412407774DE77E97B12719CAB4B356672CF5823E9938A3340BA64BCB3989050B31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304722, "uuid": "a128fa6b-f9ad-4cf4-b6e1-54fc2b64b717", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304722, "uuid": "10d8b9b1-dc90-4789-969d-3fb23cd13bd9", "value": "12288:xMmSlOJB99x6mYGdd1CRx+P+8lRFOkJzx+pTe9YevcDi+SfNOf:xEwPzwRx+PxlHFF2ev2mk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304722, "uuid": "022a8ebe-06f5-4c36-9723-2ae03693904e", "value": 736144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304722, "uuid": "97ae8faf-e965-46a6-8528-a9aa3c703eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304722, "uuid": "56d5f145-9697-4326-87c0-2836c5eb9fb7", "value": "6e19cdeb6b68b60c686e9ca4d6e6bf55fd3d9a2127c60f8ecc822cc4dfb1a0bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d97a8cf-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307341, "uuid": "a0aeb2a3-4b23-4f85-93a0-60a8617ce1b4", "comment": "Malware payload", "value": "33d2738fa36b164ba88b625dbc839f1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307341, "uuid": "5ef3ff46-de88-40c9-ad67-6bc2a1d14fa8", "comment": "Malware payload", "value": "6e5664430ceaf12c264321c149a743a4a120a88e0f1e98cedcaf9c8b229ce1ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307341, "uuid": "268d8851-5f87-4d6f-90e6-0be287aab5d8", "comment": "Malware payload", "value": "da54af8d8fa44525af3a8b69c71d55e2f490ee29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307341, "uuid": "b8e33f25-a16b-4e21-8fb8-122c4c831ad9", "comment": "Malware payload", "value": "07d830ae53fdafcbd3c28ca78fae6a31d3e4a5b169c769d8608f6f2a2f5de3ba7e5c6c53fc5f65036b0a61d91e120a60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307341, "uuid": "8db7c6c3-3c0a-4825-b81d-7ffad1092c0d", "value": "T131644A163748CB12C56915B4C0EB652067F0A9C73737E6892FAD2EDC19133E25DAE28F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307341, "uuid": "a94aa85e-3802-45b7-a766-619f657aee27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307341, "uuid": "5d479adb-e4d4-4734-bc9f-5cd757794b6e", "value": "3072:K3YPOrQ065wgn9BEtTK51gSWztLcoGyw2Lqa1cohl38A+RgXCbBxPszs3dn0l0:K3Wp0aw81gSgtLczWz1coj8ANEP7dnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307341, "uuid": "7daf07c9-2129-48d8-844d-8168d23ac7aa", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307341, "uuid": "f3469e78-82c2-4b86-8452-f44fb260a050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307341, "uuid": "781b2dd1-fad2-4ca9-a78f-101a407a6cc6", "value": "6e5664430ceaf12c264321c149a743a4a120a88e0f1e98cedcaf9c8b229ce1ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbf6dbd-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770307364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307364, "uuid": "06616864-e7e5-43c3-a35d-5dc27c889e78", "comment": "Malware payload (AgentTesla)", "value": "df69c4ddb924c939b53ca5aa0a2bd3cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307364, "uuid": "ab9550bc-af2d-428e-8fe1-6fec7e867f6d", "comment": "Malware payload (AgentTesla)", "value": "6e9d5d9edbcb669ae34a6ef13823a399992bdf4f15c2e8abeadb95fd2a33f7a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307364, "uuid": "728e7ee8-d320-466d-bef7-ef4dde8eca37", "comment": "Malware payload (AgentTesla)", "value": "4bbacc05d7454638a3b9775ad1c0a88a18fc2061", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307364, "uuid": "8d5ab1e2-934a-4dbf-b986-a7150a7efa34", "comment": "Malware payload (AgentTesla)", "value": "4229389dfe3ce390862487e5522c5d13cc370f476fc286faf0ae494c0e5ed9af2a518c2b797789482e7ced4816491746", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307364, "uuid": "0f6ab7af-1261-4bc2-852f-6db9de1e9a80", "value": "T19235AE0273C1C062FFAB91734B5AF6115BBC79260127AA1F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307364, "uuid": "bf59c554-c4de-4a19-951b-b67b3876a438", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307364, "uuid": "284af1c5-dde9-4f3a-a70e-9e0a6ff6fc1c", "value": "24576:25EmXFtKaL4/oFe5T9yyXYfP1MAXDzWr3K7RpoO:2PVt/LZeJbInGizWr67R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307364, "uuid": "d666808e-8d12-4c9d-aeb9-893decba1009", "value": 1136640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307364, "uuid": "187e391c-8eb6-4c13-97ad-76ec9513b378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307364, "uuid": "044b620f-15a2-4f5d-9607-06f16aa146de", "value": "17406103af81a1e9978c42905c1da9fb3be734fb3bccc1864b60d15a693b205d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214da2b0-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770304797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304797, "uuid": "cbaa7db7-6c58-471d-a68c-c65e751d1ec4", "comment": "Malware payload (a310Logger)", "value": "da9dbe26a78d741af23600915cd1f168", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304797, "uuid": "bc9509ec-b956-4cd8-b4ec-8192cfe1b94a", "comment": "Malware payload (a310Logger)", "value": "6f382c7975bfaf3a388253063a39ee7f45ccdb29f1d68c9ece1326a396b5ed04", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304797, "uuid": "acb8d6e8-9304-4c26-8e3d-41cae645a24b", "comment": "Malware payload (a310Logger)", "value": "274f7ec479bdc5de2890dbeba89fe47991167f95", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304797, "uuid": "277a3767-92b7-436b-86a3-10bd846790c3", "comment": "Malware payload (a310Logger)", "value": "36ebda241cca2d25e51bd83394c72539b9e23dedbb96a43be48d5141536b008677eff5a8505b069ffd3822f434cf8c79", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304797, "uuid": "52246e14-2ac3-4b29-b570-06552eeb5784", "value": "T192845B13EA50A11EF1A3C9F1E9B4929668693D351AE8ECABB7415F5834301D3E8F131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304797, "uuid": "cc6e009b-ba47-42e6-8cef-c457e7f3a420", "value": "4e88637d5094cca5de1556f3666ec73c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304797, "uuid": "d1f77da7-f914-4b7f-bbcd-94c089d4948e", "value": "6144:e8d1/w5KA81IJ8GpF6nuTmOOUWTOxHHJzn68qdIYFEw0wyuvmPSHE/9tRZZt8TR7:tjYKkJj6GmZUWYHg8sowyzPc9TR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304797, "uuid": "a8f61d20-01a8-4adf-8f4c-405b399227e8", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304797, "uuid": "f07ab80d-b375-4456-89f5-1a4479e925a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304797, "uuid": "33f81c66-5443-4f56-a4dd-d78b756aa5c3", "value": "6f382c7975bfaf3a388253063a39ee7f45ccdb29f1d68c9ece1326a396b5ed04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57609978-02d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770326792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326792, "uuid": "4b8ec985-a731-49df-9bf0-e66a3076b659", "comment": "Malware payload (Gafgyt)", "value": "8869cab95cf1733a0af297d59aa374b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326792, "uuid": "293bb7a4-4ff1-4c8b-b0b1-9af001cbd3e8", "comment": "Malware payload (Gafgyt)", "value": "6f99399162d46e121b780ab610e6bb1e6833aea5f27989c48d244d1f0e773944", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326792, "uuid": "98d0b826-ad56-4507-ab3b-7908ff240518", "comment": "Malware payload (Gafgyt)", "value": "694b1350ce9febba7c5748b4eb55ece1567dbc9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326792, "uuid": "aaf8ad85-aa7f-468d-9600-ee002443fc36", "comment": "Malware payload (Gafgyt)", "value": "49396b8bbab5a2c873147cb2957999ab877dced8be4e17fa74bafdfc04b5338cb31b6ef2d9bfd25caa772a4b3a5ffe64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326792, "uuid": "d01b1025-5f44-48bf-b074-0c6313ec6381", "value": "T106A3F896F800DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326792, "uuid": "7d473490-ac8f-49a0-88b6-5d0b83aba7db", "value": "3072:Vgdr2vIBAxMyAOLRcftshOemuxVqDr78fz1e:Vgdr2vIRyAYcehOemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770326792, "uuid": "02400120-9f7b-4b82-ad7c-304fd1a87e4e", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770326792, "uuid": "de8fecd2-1d6e-4c51-bcb5-369afdcf6357", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326792, "uuid": "2d186471-bf9e-4248-9668-23b5dd027008", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60be20b2-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770307910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307910, "uuid": "d906b11d-a5f0-42a8-a770-7ca7f5e696e7", "comment": "Malware payload (SnakeKeylogger)", "value": "733cb7ff431963989396f322edf46780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307910, "uuid": "99917197-183f-4de3-9872-2e7033a79451", "comment": "Malware payload (SnakeKeylogger)", "value": "704216de193fbf464e6af6c663b8bf0a5b65633c066339ee1f030779ded7ae05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307910, "uuid": "c866fdee-6f20-4c51-98a2-47e38943eafd", "comment": "Malware payload (SnakeKeylogger)", "value": "81334483e19ccdd07b9e9b90977fbd1852d3e168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307910, "uuid": "2c73dda9-3f55-4d37-b3f1-a834ae0b3e1a", "comment": "Malware payload (SnakeKeylogger)", "value": "881110e1a4ca16c00ab9b7d6354f18869209f9030ee498155490838cbd35172451ce7243f3f368f578c91d346300b315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307910, "uuid": "2c811d7f-e307-4b66-934e-9431c7ceebda", "value": "T17406120273829062FFABA1734B56F6214BBD79260127A61F13981DBDFD701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307910, "uuid": "b03d4ffd-3429-43ff-9729-460c4d4ab5e2", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307910, "uuid": "eb7c5c12-8648-4a08-97ee-602c30475732", "value": "98304:0TYbInQ/iuZxHYFhUDzBpB5vMvUnXfoQu245qAu:0cb2oZZO/UXBpfvTnXfoQu2UBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307910, "uuid": "a124a8c0-b941-447b-99a2-716a4a2072af", "value": 3745792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307910, "uuid": "d97d8c9a-1d88-4ce3-9681-28f465a4632c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307910, "uuid": "1deba9ab-be09-49a4-afb4-4053aa70bf0d", "value": "704216de193fbf464e6af6c663b8bf0a5b65633c066339ee1f030779ded7ae05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739377f3-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770305794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305794, "uuid": "0f956fc8-0abb-4646-9a8a-457f6f25fcbb", "comment": "Malware payload (RemcosRAT)", "value": "dbd22cac31fb76681ea1ebe475701139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305794, "uuid": "7afb898f-7fbc-4aba-a783-621692190642", "comment": "Malware payload (RemcosRAT)", "value": "70922729b97c0c5d372b02a37927dfaeaae90678a583fd95c3c8b483e1a57e31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305794, "uuid": "eb11a9e9-3a2f-407e-839d-09b6d6ad4395", "comment": "Malware payload (RemcosRAT)", "value": "40fdb25f30ee0890085d95a34756b22788b73975", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305794, "uuid": "465e1553-e3ef-4552-bbe3-081b3e113e94", "comment": "Malware payload (RemcosRAT)", "value": "d6060120c37378a73c45b4593c20fea12199d5867d413565a727e4bc266cc558ebcc2dea7c00027551c60e1a5d8806a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305794, "uuid": "3ee4f15f-4d57-4107-97d5-ee3c117b828d", "value": "T1D4F412A87B08C943C5958BB408A0E7B623B09ED9F514C3D29FFEADD774907843E18687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305794, "uuid": "4c3cb708-d794-404e-9dbf-10f8638d6da6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305794, "uuid": "3443cb38-6cb3-4004-b06d-91ffaaeb3a01", "value": "12288:5239y7hq7WHujD2VWAiuBmRlEkC+AW/SMnAPfVjmpne/YFqhSbDgkgTKKQjkQjz4:m8ujDdnvrC+QMoftm9eaoulGKDPzHpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305794, "uuid": "52ad4031-a0b5-4350-af93-151120bc8fb1", "value": 777224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305794, "uuid": "01585ca2-b90b-4611-9221-c517d8bce523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305794, "uuid": "647733d9-b78e-4552-8b0c-300b7021bfe4", "value": "70922729b97c0c5d372b02a37927dfaeaae90678a583fd95c3c8b483e1a57e31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465ee555-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770307865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307865, "uuid": "f64b4126-03a8-4760-91b6-700ff9eb7953", "comment": "Malware payload (Formbook)", "value": "25c0b16ef4d494589894c46afdc47427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307865, "uuid": "83a8f9a5-8b6d-471d-ae15-6c093e4557a9", "comment": "Malware payload (Formbook)", "value": "70d8514111e5cc88f48497cf63189a942c363cd0077fe79313141a3238aab8f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307865, "uuid": "0047dd2d-da79-437b-91e8-5472582daa9f", "comment": "Malware payload (Formbook)", "value": "435947f89c546d7c72eebb5cd5a5febfd1e4f3e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307865, "uuid": "80ae890c-7c4d-4334-98f8-8afa39cbd20b", "comment": "Malware payload (Formbook)", "value": "02df2580fdc9b5c5e1de6d1b4074a532af91d4c07d8a3195b77d33827b638cf9b8806650cd4b7156fd572ccba8dab7ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307865, "uuid": "2ba53332-915c-4528-9be9-6eeff3c73004", "value": "T13A45BF0273C1D062FFAB92334B5AF6215ABC79260123A62F13981D79FD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307865, "uuid": "7621ba50-c949-4576-b132-266783f355e0", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307865, "uuid": "2d12741d-ab18-4f60-a150-8c8a99ec66f5", "value": "24576:25EmXFtKaL4/oFe5T9yyXYfP1ijXdatPHpVOu8D7Z:2PVt/LZeJbInQRathJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307865, "uuid": "8ea9e286-8a2e-43c3-8ffe-0f9853fb9435", "value": 1249792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307865, "uuid": "ebb8186e-c0e1-4186-8b11-dc85097def14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307865, "uuid": "90d3d5e8-110a-45a4-8fe2-0dc1d4ec29e0", "value": "70d8514111e5cc88f48497cf63189a942c363cd0077fe79313141a3238aab8f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e74746-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305286, "uuid": "4b68c05e-e9a0-4f8b-b4db-3dc5dda240d0", "comment": "Malware payload", "value": "3ff91a95a47288b1b002fc87cfc6ea99", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305286, "uuid": "0f6854c3-590d-49ea-a449-8d6bc63cec00", "comment": "Malware payload", "value": "71aba23b18fd91b1fa4b9844b86d6818343a0799e7f99b75ea64de48c21688f8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305286, "uuid": "8524f3ec-c3c0-4add-a4af-ab1b0433009d", "comment": "Malware payload", "value": "300438d01a6e9e105ccd1c1d1b91b3575d654760", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305286, "uuid": "3eb79b11-e711-46e3-953c-4b2fc2dd9492", "comment": "Malware payload", "value": "1c806c275483f5445fbea8fa93464696b2c83cb0e2bbcad96ddfd913ceef2abb0f7d7834b38a919f2111d19b99f238be", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305286, "uuid": "96bacf50-9bc8-456b-a389-87f91ce5db1c", "value": "T1A1E502BB98B269536E504563EA0F2C1E335B19D53B64D342DA0191AC7F3B1D38E92B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305286, "uuid": "ae0f64ab-9ecc-49cb-8811-f8268ef1063c", "value": "49152:BOc2yD4lTP/ITZq0W1Dy2hc6UQlcySQ7qrnfEEE5uzFGC/0gbYvEH:BoyEFP/ITIS2+Ql2Q7qAEE5Gw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305286, "uuid": "c0416c22-9a51-402d-bc5e-9dcf4ccb8c1c", "value": 3030988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305286, "uuid": "a789f799-c3ad-44eb-9175-c24bab4d00bd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305286, "uuid": "3d14bff7-8807-4009-904c-9c109867a2d3", "value": "COSU6437565950- LBR Charges-Tax invoice.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cd45f9-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770305398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305398, "uuid": "e9f01a7f-9892-4549-910c-8b2305a1d7eb", "comment": "Malware payload (Formbook)", "value": "a077da5a799ad538faf621af1c3796bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305398, "uuid": "2bc76d26-0006-40d8-ab19-65d27a68dbd7", "comment": "Malware payload (Formbook)", "value": "72003989a5979b2652dd9a3e4ba6f0db4ffe1b99496a5c00d97dd360ec79cbf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305398, "uuid": "ab8f6bd7-7ba3-4791-89cb-da5f012eac57", "comment": "Malware payload (Formbook)", "value": "a2cc7dbc80d99fa46ee9506305deccb02934cdba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305398, "uuid": "b359ad87-2871-43b5-8bc8-1a5ade1b3ab7", "comment": "Malware payload (Formbook)", "value": "bb77fe275237a2440f97d1bcdb388ceb2dc4cb0fb5deef55960d52589d78c9e40267e8d1a6c492af80acf2260451fb74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305398, "uuid": "ec8c628f-dec1-4955-80e1-f99d0ee8a3ba", "value": "T13345BF0273D1C062FF9B92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305398, "uuid": "06d021e7-c0ec-45d1-9c22-21cf0059f1d8", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305398, "uuid": "5dfe510f-f848-4b67-92df-5d77a6f42a21", "value": "24576:IqDEvCTbMWu7rQYlBQcBiT6rprG8a3n5R6MZnFsGt4O6TnauUB:ITvC/MTQYxsWR7a35gMxlt4bQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305398, "uuid": "c91e61ad-c219-4581-b2f7-c6bed3b14a8a", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305398, "uuid": "d10584dc-2a4d-4040-b53e-d6cf79194fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305398, "uuid": "f51cf404-7ff0-44f7-8ddc-f774b11cc720", "value": "72003989a5979b2652dd9a3e4ba6f0db4ffe1b99496a5c00d97dd360ec79cbf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e68b5e6-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770303987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303987, "uuid": "a61627eb-40e4-431c-ab20-517700ed1b50", "comment": "Malware payload", "value": "4e28c592d9e4a05fc40a838f308ac09d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303987, "uuid": "88257adb-e890-45c7-be5a-1abfc6a05ff5", "comment": "Malware payload", "value": "7224aa6e238143afbd792bf5ebc694fd401b041c38987080f23ca7f6bacad265", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303987, "uuid": "7ee991d3-e939-43ac-bc28-31872561155c", "comment": "Malware payload", "value": "75da149aba672a0394a412ea2739e034eacf7425", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303987, "uuid": "0a106116-6b72-4def-8559-93ede589d728", "comment": "Malware payload", "value": "e427c39d02a23436ce787b9182873652a9ef401b702e7ebce4bcb3a7f39cd5cfe78b51aa9cb33f4a05ab5b4bf0b86d7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303987, "uuid": "eabcf96a-70dc-4f47-bc4d-5d8462796c40", "value": "T1DF25238EBE285E37E35C1FB1C80B260249B4DA72D105F5738DEC4EF50E6A6D9414DEA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303987, "uuid": "ae54402e-af9b-4ef7-8be2-5f97112950d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303987, "uuid": "fe07d10a-2d04-4866-a840-473fa8efd58b", "value": "12288:IvwXLhWt7IZYcPyqDQJqFCY6QoaO+OHWN8A9rGq3qMe108NJhKc89gwnzHBGjd/:iwbQ02cPyugYQaevARRGTqzwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303987, "uuid": "69a4dbe6-c6a8-4ff6-af2c-0818d7edaa5a", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303987, "uuid": "24031cfc-2186-441a-83a3-866a6077522a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303987, "uuid": "18fd7ae3-2a91-4152-9d9f-50e34791152a", "value": "7224aa6e238143afbd792bf5ebc694fd401b041c38987080f23ca7f6bacad265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fa7e44-02d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770326789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326789, "uuid": "bc60ca9b-9766-4ea0-9921-7a53145304ba", "comment": "Malware payload (Gafgyt)", "value": "0d10e4b8c72efa3e84e49ac7d1b91f8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326789, "uuid": "c7ea2a98-bd15-4959-9688-eb312f88350d", "comment": "Malware payload (Gafgyt)", "value": "724d35f371bda8b87e60b6dae8578acbdc5a1d1b7470161adb39f5675c532216", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326789, "uuid": "66c4f268-f04c-475c-9a26-d6911683700e", "comment": "Malware payload (Gafgyt)", "value": "45815d385163fce75f169216d41886391d79a2d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326789, "uuid": "56b3ba60-dd5a-4d90-8cad-0bdcf2a2fac2", "comment": "Malware payload (Gafgyt)", "value": "3a96da2fa0787dc0e067fd2574097da0b8b314abe968ebebe82c754b33320e889f62f599523a4cdf7b22502cbc683565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326789, "uuid": "3283ab00-4e9f-493b-bb0c-342ead54f5a0", "value": "T146A31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326789, "uuid": "11d6eec4-d869-4647-b864-b7132ff32277", "value": "3072:VSx+i6mqaObhN/nPNKV+qKmZuqQ4DPwXXtse:y6mRObn/nP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770326789, "uuid": "b63021db-0b62-4511-8680-ee821476a0fe", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770326789, "uuid": "1bf35805-6b9b-47b4-aa62-1a9bb8dd409b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326789, "uuid": "b7d32e89-0f58-42b2-aace-89f6825ed51e", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd633cf-0235-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770256338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770256338, "uuid": "9943f964-bda4-4a1b-aee5-1166e715eb2e", "comment": "Malware payload (Mirai)", "value": "de75a374117b2f843d9af52f631758fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770256338, "uuid": "7b6b9e44-e88d-4ddf-a2b2-bd51066aee09", "comment": "Malware payload (Mirai)", "value": "724eba3324d17db4e0de6d9756d22b1cbfc49dada33d988ebf236bd210d6452a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770256338, "uuid": "c79d1d1e-3239-4ff8-8f74-4d94d52c31d5", "comment": "Malware payload (Mirai)", "value": "bc54356dc725c78be2f565d6372d2fcf7d9bb75a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770256338, "uuid": "10f66ea9-4046-430a-998f-fec274783ad6", "comment": "Malware payload (Mirai)", "value": "fee37462711dfc04ae24d5cf6a2abc16e69781238ca0e08816087590ef67cb40022f6d517c1fb7c15c8b97c4267fa61f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770256338, "uuid": "693227df-9ff6-431f-98a2-4859bafa84ed", "value": "T137634BC9F983D5B6F897093010BAFF639DB3D6BE21A8DA43C3A455369D12502F412E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770256338, "uuid": "aff2b0ca-0806-478e-a243-e4df50d34fba", "value": "1536:TtWvgqA8qj4PfWjF7lOvZOWsIyq3XkZSQB:TtDqArj4HWBJOvwfIyq8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770256338, "uuid": "5baa11d8-6380-4e22-952f-6ff3cf4e5428", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770256338, "uuid": "1b1d5068-667a-44fc-b7c1-27ba46a40c40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770256338, "uuid": "9ac80018-3e40-41c6-9644-d8f9f7afa564", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487a122e-02e8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770333209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333209, "uuid": "017d30a0-9474-4930-93d9-cc4a4a631299", "comment": "Malware payload (Mirai)", "value": "157e258e8ea2a510dc19ee4e5d77e1c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333209, "uuid": "f381ccce-07a4-4b30-b85d-8b13482b40e2", "comment": "Malware payload (Mirai)", "value": "726921f004008043fb8c9d78dde13031e25ffdf7c2247d51b2c02e3cc48b59f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333209, "uuid": "3fa32de0-70ce-4cc0-be5c-fb151793bc8e", "comment": "Malware payload (Mirai)", "value": "6acceaa8ba752014d8e02a988275d58b6c71c5b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333209, "uuid": "128b57c5-c630-44c2-a92a-72943f12c886", "comment": "Malware payload (Mirai)", "value": "f6e1b3c69b14ff295dc1e89b4564bd682fa2fec318c368e406fabdaec6e58a4e75f4f6f91e551c31980a9bbf5049edd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333209, "uuid": "f50fbf44-51d6-47d6-b906-84d75e17e6c5", "value": "T187732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333209, "uuid": "9d0262d8-0e97-4728-ba93-02ff5c6a6fe3", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WH:927jqCt8v3GI/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770333209, "uuid": "aa36d6bd-9dc8-4e0c-ac30-01f7e1650da5", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770333209, "uuid": "b5534ed9-09d1-4ae9-a173-5e0dcb36e286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333209, "uuid": "416d33e9-1d28-4c25-beb9-ff80784e993c", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94063f46-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770303271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303271, "uuid": "13a79c54-d752-47ad-b282-95282c36173b", "comment": "Malware payload (GCleaner)", "value": "9b97d3e1e379c495e745d32858e1e10a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303271, "uuid": "ed8c9df7-38f0-4831-8048-4fe12103ceb4", "comment": "Malware payload (GCleaner)", "value": "72f244a1b7ad3c5bf140dd9becc1d1b70f46a8ea4a72ecebb582c7db66e39932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303271, "uuid": "cc2023fa-a99b-4322-a390-79b04a982982", "comment": "Malware payload (GCleaner)", "value": "254fcf52bb6aa4ece5e81df20cdb050a935544d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303271, "uuid": "3cde6732-48a8-46b2-86d3-480506f38f52", "comment": "Malware payload (GCleaner)", "value": "d6110d535dbe58d1e03356840fbbdf2160796a593643356dbe8182f1d3f127cd650bdb9fd007378b6233aba5dba15593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303271, "uuid": "78e26ecf-3c7a-44f7-947b-59dc2f867d04", "value": "T1E926E029F23289EDE397D67CC27A706B274C6846DC9416C7159019CFBBDB2423F086DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303271, "uuid": "d3a3b943-6a95-478e-ad86-f80be4ab5f99", "value": "47a71adfa27f235be83d38d946a32453", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303271, "uuid": "7a79340c-4fc9-48ba-9cf2-29c6cb6ad743", "value": "49152:i6YFCXLGSfUNIcSA8XpeZkM38XvkxsQklWY4SGjqn4LGooCMapH16RE0CC3hBtfQ:i6msBcIci5gyBH4SGWSMab6RZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303271, "uuid": "636a24c6-1ffc-402c-a98c-a450a320cc4d", "value": 4434704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303271, "uuid": "03157d5b-5680-4845-ae85-820d2a9f691c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303271, "uuid": "c5c524eb-d216-4978-8e6e-2063fa17526f", "value": "72f244a1b7ad3c5bf140dd9becc1d1b70f46a8ea4a72ecebb582c7db66e39932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b462f85f-026d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770280562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280562, "uuid": "f464c257-cc9e-4592-b338-637f7308639f", "comment": "Malware payload", "value": "9cff129197113da8a44d8e54723d339c", "object_relation": "md5", "Tag": [ { "name": "ftp-diesel-turbo-gr", "colour": "#062EE5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280562, "uuid": "96137c40-3cc6-4734-8a3c-35ad22d6ca77", "comment": "Malware payload", "value": "72ffca936653aa074abface6030f16c7a25aeb532ad3cd3b04420c1c564020a8", "object_relation": "sha256", "Tag": [ { "name": "ftp-diesel-turbo-gr", "colour": "#062EE5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280562, "uuid": "fcece85b-751d-4a00-a6f6-6aa0db8f3ff0", "comment": "Malware payload", "value": "c06798ec7bd890efe6e2e704441fd9c4c2f932b1", "object_relation": "sha1", "Tag": [ { "name": "ftp-diesel-turbo-gr", "colour": "#062EE5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280562, "uuid": "c03b623a-ed2e-4cd2-bea1-895f9f663f26", "comment": "Malware payload", "value": "f1d2bed5ca0bdb1b06e6f9f69714f54c65342a588361b4e4e19abfc5cc379316b4b3aef34ac035ebe7e5afa6525bc647", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-diesel-turbo-gr", "colour": "#062EE5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280562, "uuid": "8e9da42b-e411-4275-a4fa-2b1cdf15dc92", "value": "T1E8713289F8AB22E1157370B92F7F920476B2490F4D48CE40746D7984AF5CF1AB57A2CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280562, "uuid": "d45d9036-b048-4b37-b113-eee7bdc03ec5", "value": "48:Y0yWfbmjj1C/sO/T1GLOFusTe+6THub0271r87Vp2xOq6YCT7HtW:/mjj1CUU1GILII04QOxOq6FT7NW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280562, "uuid": "8372929f-cdc3-4145-a06a-2f2bda85ce59", "value": 3775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280562, "uuid": "b557c093-2948-41ad-a31b-6c3c1bc76e36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280562, "uuid": "ab16dd19-a07e-417b-8a81-71255acae887", "value": "72ffca936653aa074abface6030f16c7a25aeb532ad3cd3b04420c1c564020a8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a7081a-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770306951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306951, "uuid": "2545a5b8-ace2-4726-af41-eb56283f1e59", "comment": "Malware payload (AgentTesla)", "value": "86936198aee722b4cbe673f7f25c7d14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306951, "uuid": "a7ec39ac-d2cd-4303-8bd8-730620e7f5e1", "comment": "Malware payload (AgentTesla)", "value": "732bc614a265b34c4f34c20668213ab795354c3b89f618d720a011be6bb47dbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306951, "uuid": "3dfd5f36-7a2b-417c-ae2f-9448e1fc64f6", "comment": "Malware payload (AgentTesla)", "value": "cfb41cc36c06e456fc1ae8490f82c71317cab61d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306951, "uuid": "148f91a1-eb85-42f7-a2cb-5e2e05b79758", "comment": "Malware payload (AgentTesla)", "value": "55ffadb2117b8071c6c19242352330ccba3cf8fea0df62f5a60a5e23ae7c902c30baa8f20bcbddbe0d5a75a24c800009", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306951, "uuid": "590fea22-eea5-4eea-9841-01e58d66619b", "value": "T159D4228269D049A1C19167718036CC29453978B0AD12772E873DF5AFBC713C3EA3BB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306951, "uuid": "91557399-ee32-4528-8bd8-09fa9d619af5", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306951, "uuid": "99668a7c-3dd9-4d45-9562-a37510638e22", "value": "12288:uz7hU5I5yuNHIgzSFKxWltRohBfSTso93UwDoupsYc9dejiQDDo1Uormcn6k0:uf+iN57Gtene3lcmjiQDUvrR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306951, "uuid": "c3822204-28ca-489c-bee2-b374d3563d75", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306951, "uuid": "954d5317-dced-4411-be7b-f5fede8ee7b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306951, "uuid": "ae76a67f-fd53-407b-b851-610b61e1eb5b", "value": "732bc614a265b34c4f34c20668213ab795354c3b89f618d720a011be6bb47dbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c393f391-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770306787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306787, "uuid": "2fb04090-5e01-4253-bfaa-c9b077dbc18f", "comment": "Malware payload (GuLoader)", "value": "a687e573372f16208da837a88bec3136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306787, "uuid": "02fb8eaf-a921-4c17-a976-83b4ec76e779", "comment": "Malware payload (GuLoader)", "value": "73549caadb314a120df1890da643b0350a516f3f830fa8a10cf353f6f5e84c2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306787, "uuid": "3bf11354-1b7f-4638-a14a-57b480d3c0ab", "comment": "Malware payload (GuLoader)", "value": "fd8ddfa27ec0b02a37da3c16e0723c97a993dc97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306787, "uuid": "21cf35cf-af4d-43e0-80c0-fd55de6523c7", "comment": "Malware payload (GuLoader)", "value": "90d1f02e76e09fa4b7a45669fef95deded4c53eb188accff6153f3de2f86732eed92e8616a53a47791b7b4396d60ec08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306787, "uuid": "f3b42ad0-3e01-47e5-9115-26efc2303e1e", "value": "T1FD05010F3168C06DC9F92FB0F566ADF4491CAD219CA9404E66D873DE66F22F2531E24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306787, "uuid": "fdcf6a9e-771b-4b21-9851-2bd89bc9f63a", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306787, "uuid": "cd180a6b-8270-4677-ab5b-2dba15b6e2d2", "value": "24576:BbmyknD7KDcdZ/x6X302GyPr+cQ3VhM1Q6A5B2sO4:ImId36H02GSSci/2t4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306787, "uuid": "4d94ea1a-872b-45d2-83f3-652a1a705720", "value": 805768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306787, "uuid": "b42aecd3-6b03-4895-b068-b9e23fedc0f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306787, "uuid": "bdd7c285-fb93-4619-9f31-db82d562ea09", "value": "73549caadb314a120df1890da643b0350a516f3f830fa8a10cf353f6f5e84c2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15626dc7-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770306924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306924, "uuid": "106fe98c-a0eb-46d5-90ce-300bc3da8e14", "comment": "Malware payload (DarkTortilla)", "value": "01e32e7aaa7633cfc2e8868c8028b011", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306924, "uuid": "0bb55b01-83fc-408b-bab4-94532d0a3178", "comment": "Malware payload (DarkTortilla)", "value": "7419b292f77e62623a70a50d129c225c4d26fb53282f573f4e7f57242bbf946f", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306924, "uuid": "495a94d7-9d4a-4cf3-a4bc-6b7350ba89f7", "comment": "Malware payload (DarkTortilla)", "value": "f9dc0ff0a3de6c0cd265e02e4d90f289abc44e90", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306924, "uuid": "4af072ca-40b4-4238-828d-3b166a0c5fbf", "comment": "Malware payload (DarkTortilla)", "value": "a69d741bd66112aacf5e19fcd749f939c8637701ce392f9a3277481c8e8b15812e78f63641ac8c8b27e11c849ffced89", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306924, "uuid": "383f3084-0107-443c-a96c-4c14b118be87", "value": "T13365F00913E58198F4BD9B34A27B361547F0B41BC836EFAFA38421F98D2579AA153373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306924, "uuid": "1e89ed69-6b72-47f8-a042-38640ff73ee3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306924, "uuid": "de3578ff-94b1-4b85-a0cd-1c51f07762ac", "value": "24576:Y1gtfMs1hsAdBen2pqpCCnRveYepqMKDmfC4KOSSn2z6LIG8kA:7tfTfezRveYkqM3fC41p2zG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306924, "uuid": "6209dafd-6a4d-4023-b025-6e13f4115ad3", "value": 1475584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306924, "uuid": "c9d9fe51-6301-4f2b-9600-ea67bafe4899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306924, "uuid": "0bfc5292-1c66-4ac5-8e92-60dbc30d9d0b", "value": "7419b292f77e62623a70a50d129c225c4d26fb53282f573f4e7f57242bbf946f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a7403c-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770306493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306493, "uuid": "e290d6cc-89b7-4742-af56-369c60ef2aa1", "comment": "Malware payload (PhantomStealer)", "value": "0c47f90a8bbb62c0bcff585f4ed081f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306493, "uuid": "41255ea0-cf1d-443c-bfc4-b5e8c667ffd2", "comment": "Malware payload (PhantomStealer)", "value": "746aadf4c2e94942240b4ba544d6981bbbb3b8d68d8ef7c8a8ec9b1e962e34d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306493, "uuid": "28e24319-f031-40e4-8f9a-266c7d633bb1", "comment": "Malware payload (PhantomStealer)", "value": "e6b9e705ba6738581e92496a31c5f70b84cbcbb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306493, "uuid": "0d62f8e1-d9d2-4df2-98e3-3770083a736a", "comment": "Malware payload (PhantomStealer)", "value": "73b8a2b1822692b15d0b1e83a893b732a0cdef26afb120906ece33362bdd708eacda5d7e53602e7a3e87838cc0e749cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306493, "uuid": "609651ed-cab1-4abc-9d37-18db52ae0926", "value": "T19385D00273C19062FFAB91334B5AF6115BBC79660123AA1F13981DB9FE705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306493, "uuid": "1bcc50e8-ded4-45bf-85d9-91c37e9da04c", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306493, "uuid": "4d40cf95-20a5-4aae-86eb-cfddb5c145a6", "value": "49152:6PVt/LZeJbInQRaXhMrI2xuVeN0/QRaf:oTYbInQ5/xuVeN0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306493, "uuid": "25073eb1-b110-496f-becd-f6801fc58c94", "value": 1717248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306493, "uuid": "6e779b08-9cd6-4cb1-8aef-e303f170fceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306493, "uuid": "59a0cb4e-d3c3-4034-8cb2-5ccf477d633b", "value": "746aadf4c2e94942240b4ba544d6981bbbb3b8d68d8ef7c8a8ec9b1e962e34d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b2a5bb-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305440, "uuid": "3dc3c250-0021-4c4d-b9c6-eccbd806e85a", "comment": "Malware payload", "value": "9820ffdad869602c64e978afba3891a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305440, "uuid": "c6549f06-2aeb-4046-822e-f1094cbe00a3", "comment": "Malware payload", "value": "74a423df1d8bb9b47d7e7525fa6a5f240eda3156ea5372000f8ebc1d207cfcb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305440, "uuid": "20ca15b8-f30e-40d4-b41a-17d047ff6421", "comment": "Malware payload", "value": "bad6188d018ffab19d68aa78e9dfe02217b099ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305440, "uuid": "c00ef957-fe27-445f-bc1c-c5f54ed3f5f2", "comment": "Malware payload", "value": "00868e09cd908ca400e28f0afe11966d430c18528fce34306817c5154ba3ed1058b89dc88ec5d32ae44941fd66cbc306", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305440, "uuid": "9ff3a109-cb68-4778-8bb1-19c5567cb870", "value": "T1E194F626E750B0A9F89349702D79A246282D3C3A2681EC4BF78D9F463771987B1F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305440, "uuid": "3bff01ee-5f2b-4b49-a6fd-2bfc1bc2b92d", "value": "cac019c92f96e07dea0e750fdb856107", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305440, "uuid": "4abd9a43-956a-45a6-999e-b26f99029b88", "value": "6144:C5i2FoxUmTtIJw8mjUcOOcmp9hmWUytuNTOnNhTfdtwOMauC6kjwSoAQEUbGyGM3:C5i2FNmjUcOOcmpGWUJTIhtwOMtUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305440, "uuid": "901e4569-f821-4b92-a348-9e9e5b38f466", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305440, "uuid": "8228b493-0f9c-495a-9fdc-1f87c7e66a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305440, "uuid": "c6477394-86e6-401c-b280-0b923c96e588", "value": "74a423df1d8bb9b47d7e7525fa6a5f240eda3156ea5372000f8ebc1d207cfcb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81bb403-027b-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770286581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286581, "uuid": "1a7c119c-5afe-473f-84d9-2257611ccc2e", "comment": "Malware payload (ValleyRAT)", "value": "4e3fadc852be3ec243ba56a0976abf12", "object_relation": "md5", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286581, "uuid": "da8f2ea4-f625-48c0-9e78-06ea935f9141", "comment": "Malware payload (ValleyRAT)", "value": "74bee981edd3316032cae86dde78b3d57dae950302f70d154b3d746495b1ab7a", "object_relation": "sha256", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286581, "uuid": "7f83ea2d-751a-43ae-9560-cd89b0047e6b", "comment": "Malware payload (ValleyRAT)", "value": "adb1c3bc8d462842289b8024f3fad54a03095915", "object_relation": "sha1", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286581, "uuid": "c42225a3-bc53-436e-953f-824e4687fdb8", "comment": "Malware payload (ValleyRAT)", "value": "507899c00aecedb155823f6789777b018978abced03c358359e3a628c52278a4f978811f6b3db2377d80285235993216", "object_relation": "sha3-384", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286581, "uuid": "bbb7076f-3db5-4d10-a534-5906ec242a63", "value": "T1E9183321B56AA9B5EB2F937FA0A4EF9940317DE13337D5D713783F964AB058220B1903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286581, "uuid": "7938f80f-d042-4ae5-8dcc-86245c7ebe1f", "value": "1572864:VyGuijRz386aZyGUQq1oTP+O6z2mm6Y4jUi0+slZFGaOiI22uMncLrzGBcy:jP9zsZ8GrTWP3YiynFG+fKncrccy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770286581, "uuid": "844bca2b-eaef-49ba-80e9-3ef8838c0a49", "value": 87636480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770286581, "uuid": "47635aff-fe6d-4da5-86dc-050970bdf66e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286581, "uuid": "2fa7b855-e1f1-4a75-91f1-8966bceddc0c", "value": "chromasj.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c7ea68-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303885, "uuid": "a9987105-5200-4e20-ae15-fc9792223dd5", "comment": "Malware payload (AgentTesla)", "value": "8cd303403c1155402118c87e35f0c182", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303885, "uuid": "489a92c4-a5f9-421f-b84d-c8649b5cf463", "comment": "Malware payload (AgentTesla)", "value": "75bf9f33aad410dae222ddd9030dea8db2d382dbf167e3cf8dac50d4ff434a3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303885, "uuid": "237faee7-6e1f-4b15-b480-48059264fed0", "comment": "Malware payload (AgentTesla)", "value": "64496a0fce218a3f91c6379c7607168b16379704", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303885, "uuid": "48d4bcd8-a225-45cb-b924-3ffa7d4ce371", "comment": "Malware payload (AgentTesla)", "value": "edf28526f4c5e7a826d426cc50eb4142988e4910115b9e04918f03415822188c9fc34bfbbe642d52cfa35fadf7960dd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303885, "uuid": "84f047d5-dee1-4445-bd8f-dbd2ac4d0170", "value": "T14E250148276DDF02D5A65BF55A31E3B467796EDEE820D38B8FDEADEB74667000800207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303885, "uuid": "ad473264-7ef7-4ec8-a962-608ba6064f78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303885, "uuid": "de9177cd-0298-44e2-ac0b-cb26740b0013", "value": "24576:TOlwrCtqvB4xnyF3liOrME3otN0v3DfVN:TxExc3lHb3oX0vjVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303885, "uuid": "0b1fabae-aabb-4cd2-8a09-2fc689fbb6d2", "value": 1045000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303885, "uuid": "147257ce-8642-4360-a415-8e9f7d5fff54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303885, "uuid": "db65ec59-a34f-4a67-bfae-932a1be8a4e1", "value": "75bf9f33aad410dae222ddd9030dea8db2d382dbf167e3cf8dac50d4ff434a3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ed3bf3-02bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770315621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315621, "uuid": "41f6d3d1-a166-4bcc-85c7-b4368871b0cc", "comment": "Malware payload (Mirai)", "value": "0cfef52ecb67130e9aa5a629906369a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315621, "uuid": "33c6c3b4-fd78-4910-89ee-29b627cc99dd", "comment": "Malware payload (Mirai)", "value": "7656f72632945fa810795183930644565f770cfb4255328092f19b3ea1b0c0e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315621, "uuid": "36dc1693-b679-4462-844d-c1f471790767", "comment": "Malware payload (Mirai)", "value": "d3e9c07ca0218edf38f36cfc5587f35a757ff219", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315621, "uuid": "45e04a1a-36b9-4b7e-b14d-28141cfa4ee5", "comment": "Malware payload (Mirai)", "value": "c736b2dc81a7b96d84556d038b4ab4bdccc702dcfe8aad9396bd4969024ce5b8e94dcb22bda92c2963eb683fc7846969", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315621, "uuid": "0c82afc0-e3d0-4ba6-ae7f-fb7c0e22db50", "value": "T1A1333BD3B900EE3EF84BE3BA81530D05B5307BAA549316327672FCF759321D4A926E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315621, "uuid": "380576f3-9f93-422e-9383-95393c3a8d46", "value": "1536:SrZ9tiwEaUET9dwD6jyZ8U2rcuQfUJbMdo/k:SFtdwD6+0cWgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770315621, "uuid": "0acc9e81-da32-433a-8248-89e30e1fb367", "value": 54761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770315621, "uuid": "91759569-7916-44fa-a6bd-bcde20ee7628", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315621, "uuid": "ce213980-c30a-4775-a40a-11e6844dcd94", "value": "Hilix.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c86416-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306472, "uuid": "e5c8d6ec-e666-4368-b3c8-f4951610026d", "comment": "Malware payload", "value": "7806af3491ad088849a75bb239947ff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306472, "uuid": "55ce3be4-9dd1-4c77-a857-989d8459a90a", "comment": "Malware payload", "value": "76c49872fd52577f94c6328584e8e5106b113311d4c7bb6c8d83d4e19d694048", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306472, "uuid": "84dea1e6-f5fc-49cc-9b80-cb953b13ac81", "comment": "Malware payload", "value": "47770aabe6ce01ca2130d82cad9a23d8c1af7278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306472, "uuid": "a01dbe00-12e3-4230-8ccd-aa54758348f6", "comment": "Malware payload", "value": "7f45c561d6c094dca11669a800c7396d9a7bce8c3af88d1ee000387cc9b32b37451a58a5ec29140574facd26e8b31f1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306472, "uuid": "67b39b51-4d19-4355-ac42-0c7133657048", "value": "T1B8F6332C53A005F7FEE5D63DA962D4F092B7685327A6C28F83A941D06D63BC12637723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306472, "uuid": "344a3147-2fa5-4563-86df-907db31955b7", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306472, "uuid": "2f697e74-a6e8-491b-a789-bca705887e29", "value": "393216:xnnAuquTwGaa5wEMiuHClcuC9Xp4C7yiV6ILi:x2uyaGziuilJCNp4C7tVBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306472, "uuid": "d1816d02-7c67-4799-a909-e8adf52c7484", "value": 16023920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306472, "uuid": "f566e3e4-351f-449e-b1a8-c6cb7999ceaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306472, "uuid": "7984b862-a45d-4bea-8825-80a65fb240cb", "value": "76c49872fd52577f94c6328584e8e5106b113311d4c7bb6c8d83d4e19d694048", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315ba0ee-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303965, "uuid": "a56d9e66-2d28-4ae8-8e01-67bdf84fba43", "comment": "Malware payload (AgentTesla)", "value": "5025d8acc38dcb428ec2742f87987655", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303965, "uuid": "d5a761e4-6632-486e-9b28-d9bb29de2565", "comment": "Malware payload (AgentTesla)", "value": "76f762eb047d0d10398cbb7ae345988ff147fbf7816f16a328ac909b441df8aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303965, "uuid": "ac795efe-b2a1-434c-a606-7068d210b9f2", "comment": "Malware payload (AgentTesla)", "value": "63ae1bf27c74b80cfabdd5f018a2ca7dd37a98b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303965, "uuid": "8e4228e1-ed0b-46b9-b6f4-cc3c5862fc9e", "comment": "Malware payload (AgentTesla)", "value": "57ee5008d9d1a1bece4d734713930ddac3c4d3e77765dafa67941ed49f60689aa1f4261e471dca3fa4dbeaba2dbcca77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303965, "uuid": "1c5d48bc-a6e0-4601-9146-628733d9acd5", "value": "T17B5512186249CB02E6A61FF45871E7B017709ECEE8A1D35BCFE9BEEB7425B804954343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303965, "uuid": "40d5c7ec-765e-4e11-b67e-dc1cbd78fddd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303965, "uuid": "8d6cf842-871d-4cf5-974c-61ff2c54cdf6", "value": "24576:/gHgn3zzzVZ5gqOUQqMKtkQt6KP4saAwMwYO1tc2wJ4+0:/jDz5bRkk6KRaAwMwYOjc2wJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303965, "uuid": "a5a01f66-1926-4105-bb0a-dc8e7009db44", "value": 1306112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303965, "uuid": "d820e091-e2b7-49a3-8dff-de31c4830d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303965, "uuid": "298c02dd-5431-4cb4-af6e-82ac2207d5f0", "value": "76f762eb047d0d10398cbb7ae345988ff147fbf7816f16a328ac909b441df8aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0165c267-026d-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770280262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280262, "uuid": "5b69ad0c-5e03-490e-80d2-21cce2e2e69e", "comment": "Malware payload (AgentTesla)", "value": "740870f89c961c0b6ce6cc292909a2a9", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sales-thesignscentre-com", "colour": "#85B3FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280262, "uuid": "5b7b2de8-683c-476a-bec1-23c204eb0e48", "comment": "Malware payload (AgentTesla)", "value": "77352a0a3ccbba6dcdafc60a48d7269f7625c1414a5c35d2d192fffd4893202c", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sales-thesignscentre-com", "colour": "#85B3FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280262, "uuid": "3b07d0de-292c-45a9-b673-e781b0fec5f4", "comment": "Malware payload (AgentTesla)", "value": "b27eddafa1d7c596afe9a4bca50f30b88b0a34b0", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sales-thesignscentre-com", "colour": "#85B3FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280262, "uuid": "88bb48ec-e8e1-406d-ab9f-4044a63cf732", "comment": "Malware payload (AgentTesla)", "value": "8fe3806190c67c91172e08a1eb1d7475b5a2fe53d93f688be7d3fdb67e28a09536485a6df7dac0110b6b4db943af03c4", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sales-thesignscentre-com", "colour": "#85B3FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280262, "uuid": "350e01d1-6de0-4211-8909-e5f89504308d", "value": "T1EF451210CA69CD6A015C526020991EC69A914E770D18BBBA3F9F1E8E4F1F28FD0757FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280262, "uuid": "d46b53d8-2785-445d-8003-94b00bcaa6dd", "value": "24576:FYWFxmJpVHIyD9H1WLDYYOcotfG2AGWKsYipzA9rafBN9RU:FUTZG/Aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280262, "uuid": "ef350f9a-d655-4dcc-9fe4-b3932bac56a8", "value": 1198829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280262, "uuid": "dbf7cd8f-b99a-4960-89ba-257616ede66f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280262, "uuid": "151fdb06-4cd5-460b-8841-7bfcef40c492", "value": "AIRFF.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c27ca33-02e8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770333215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333215, "uuid": "f621ab02-1c10-4b92-9dea-1c01687e0a5a", "comment": "Malware payload (Mirai)", "value": "30e23bca857b8ef0bced40e5b3370e54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333215, "uuid": "1b4e278c-4334-45d8-a4d8-7158b055d2d3", "comment": "Malware payload (Mirai)", "value": "776b321e038ad64092853252a59c6dd8a7798b4b65a76796cbe2810b104f3df9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333215, "uuid": "4d95b3d3-d312-42c2-ae21-cd8bed0c7ecf", "comment": "Malware payload (Mirai)", "value": "70b66623e1f7dd75fd5af90015a8a415e233af55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333215, "uuid": "f33e0ad6-99df-4ace-9f60-a38bc0860188", "comment": "Malware payload (Mirai)", "value": "a4fe76c33780d19adca618e2fc76bc653301ec2857a16424316e3b7583159af58c67672168aaf61e8dd808194b6454e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333215, "uuid": "144d3be8-98f7-4571-9b15-23b2f0e56c9d", "value": "T18BC2E091E1F62E85F77A7EA01B79C2C177B00E9EA777CCD225999F0404A711B07057C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333215, "uuid": "a5788882-a3a7-4105-bf26-9b7436f20ef1", "value": "384:lNez9/6Jgn9yMGEGHV4u/DT8HgPEt6seDYc/OGWM4uVcqgw05VxJc0Q:TG959yM0HWubJsWDYcGA4uVcqgw09S0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770333215, "uuid": "b6c287c6-904a-4e55-a748-2e3f4e4c6411", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770333215, "uuid": "c6d2c82c-ae35-481b-9d3b-286d401f6a5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333215, "uuid": "de6e6b71-3751-4f43-8f90-51b6ede2cbbd", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18335b25-029d-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770300916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300916, "uuid": "538296e0-fc9d-44bb-b742-ff0583d24f6f", "comment": "Malware payload (SalatStealer)", "value": "467975d87cf6db7f21490f5a90b7f7c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300916, "uuid": "be37d9ea-8e1a-4cef-9a96-b7c242697259", "comment": "Malware payload (SalatStealer)", "value": "7770d0a0305f1f2d42de88ae793a6bd09b780b43313a432678fb13566c7d69f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300916, "uuid": "edee9bfb-a57a-4590-9b97-a7874fd239ab", "comment": "Malware payload (SalatStealer)", "value": "cde38d390ca6bd5ecdb97b09db26bb03a637b79d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300916, "uuid": "9f843e0d-403e-46d8-b4ec-72f2c2c56cd6", "comment": "Malware payload (SalatStealer)", "value": "a7abecc9f280ebaa40418cf5c0ec54cf6a79be8c9ac86bda117974b0e520dffaa5dd813deaeaeecbf48a66aac93e5136", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300916, "uuid": "bb114576-f156-4aed-af87-ada5202f7e73", "value": "T14CE53336CF4DA83FC45643325D459642FE9CE1A149CEAEAE096EEC0E581284F9DEF074", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300916, "uuid": "43b1c772-36e1-4973-a300-6a75f5820bd4", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300916, "uuid": "f4c1d5e0-076d-4180-b406-4e9df0706460", "value": "98304:lbkWmn+28T7oGzfje2lEgHc47WwFyq0E5b3HeG:VkWh2K73lEgHcqn0q0+r+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770300916, "uuid": "440483b0-0923-4784-b824-a72c157ad757", "value": 3297280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770300916, "uuid": "06836182-90f7-4b1a-9961-884b719d64d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300916, "uuid": "3ae7256e-ae76-44ad-9b22-d27c022390ed", "value": "fontdrvhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af6ed5d-02d6-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770325563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770325563, "uuid": "36707b01-c805-426e-b73d-5339ea6e9e41", "comment": "Malware payload (ConnectWise)", "value": "e4254b2457a03176f85f09ff44117609", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770325563, "uuid": "c235bdaa-73c7-4448-ab3a-840e86967994", "comment": "Malware payload (ConnectWise)", "value": "777f899f3bf7a2a7aa21b43ba64d779cdf6d66e944b60366f0c774008b4f6a54", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770325563, "uuid": "ebe721d6-0b51-4311-bf84-f33dfebed366", "comment": "Malware payload (ConnectWise)", "value": "da43faba1b07f9ab8669d55e71a5d5de45cae949", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770325563, "uuid": "2caedea0-9fbb-4d74-b3c2-e1ee91c184f5", "comment": "Malware payload (ConnectWise)", "value": "7080dc670881066219a3d22124463869a151bd73efc547f09fc1cc2bc6b91a50f39466e74161a34b972e23450840a529", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770325563, "uuid": "ed229ec7-134f-47b3-9b2d-bd92270938b3", "value": "T1D7A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770325563, "uuid": "9d13cf8f-03e2-4be6-9d9b-96b1117a0ae9", "value": "196608:DKaLNkbgGi4QPKaLNkbgRKaLNkbgNKaLNkbg:bWgGiHnWg1WghWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770325563, "uuid": "e739d201-cf8e-4f0c-9c9f-9ee2085f8ca3", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770325563, "uuid": "d791fcef-0daf-4bed-92d0-dbad0051330e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770325563, "uuid": "ffffee8b-f47a-4780-bd43-457185b52ede", "value": "SpecialGuest_RSVP.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b0f337-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307940, "uuid": "4d540792-d04d-45a6-8180-731ca9748a98", "comment": "Malware payload", "value": "f09fc97318c7d8ce5c853db0b3c41c27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307940, "uuid": "71882ddd-369e-4ebe-b23c-30fea964d28d", "comment": "Malware payload", "value": "77a8395bb44a410a542b621ac827eca8dd0dfffe66219287f4139450585765cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307940, "uuid": "cd46254e-5539-424d-a013-fd3990632001", "comment": "Malware payload", "value": "9794e476e83e756c920e615e3122980cc1a187b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307940, "uuid": "034b36cb-0f4d-4d92-b99e-dc1874a82f9d", "comment": "Malware payload", "value": "69223c7a78a8bb975bbcb6db39d9536a2bc250ea4bd8aa8d9f456ea82ba6b196dbabef51938b98fc516d09237a050d43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307940, "uuid": "a12a13fc-5c7a-4b99-b2da-9a72665907e8", "value": "T195742B13EB507426F95345B12EB8A656252D3C391680ED0BBB8C9F8A3771683B4F532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307940, "uuid": "7393acd3-9160-422d-8d06-c5ad66adc3de", "value": "054b1f015815d64c366680a5dd68604d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307940, "uuid": "ea3696bd-9367-4f82-ba1f-53e389b7adcf", "value": "6144:eKsI2BhreNCvBC1MNfgdNAhQjAQGkIyQ9UlMfHjss:eKsI2tC1MNfgdNAhQbHIpUlMfHjss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307940, "uuid": "eb648387-3189-4829-96de-11e23c84089e", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307940, "uuid": "bb2f1321-0012-49f0-a8cd-c30f5eec6685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307940, "uuid": "d25fff3f-f467-4d00-bb74-07704917f004", "value": "77a8395bb44a410a542b621ac827eca8dd0dfffe66219287f4139450585765cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45d3732-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770304292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304292, "uuid": "8cf2a4ca-5356-4152-89b1-6bf4827e2682", "comment": "Malware payload (RemcosRAT)", "value": "bfef0d5d754bd786b84a29912226b0ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304292, "uuid": "0a3ecea2-e167-4045-b6e9-5848ce4420b8", "comment": "Malware payload (RemcosRAT)", "value": "77d8ed5b84c1ad1ed17f1f51b6bca57ee8a76e1279f9e5385b269d95bf81b400", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304292, "uuid": "ad0e8add-bc08-4dba-af6a-d4de7df98aa4", "comment": "Malware payload (RemcosRAT)", "value": "33b6596796fe7dd1141eedb1749e33d3186dd63b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304292, "uuid": "c0855493-a512-4ef2-8240-da33637508e2", "comment": "Malware payload (RemcosRAT)", "value": "ecc071dbf126b55f7d7d81e5ad15b98b630660e7bcda1ca1e6744899dbefb73133f20f5e7b840ed6f53669821071ee96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304292, "uuid": "39e9f99f-7377-40de-8b7d-7fa37c2b6169", "value": "T14B05011DBB29EB15CE0C0FBBD513460881F29557EA75F6BB09D9ECE61E6AB00844F903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304292, "uuid": "97d8491d-a55a-4951-83be-1251977a288d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304292, "uuid": "bd39c70e-6934-4595-aa29-8c8f127eed3b", "value": "12288:q+k/RazFCUi0SDdEMaMNzVoSw5Qy+vyYJ37YV1hOsSnhlT9O4LWT9hjHZikR:lFrS5/NVoT55mR7K1d+LMeWT9h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304292, "uuid": "aff8272d-4874-4bae-a807-4827ad773529", "value": 857096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304292, "uuid": "17debecf-acd1-42ba-aa0e-b55189d43785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304292, "uuid": "6b8b6d16-7289-4cfa-8ee6-9d67922d5f81", "value": "77d8ed5b84c1ad1ed17f1f51b6bca57ee8a76e1279f9e5385b269d95bf81b400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f22b48-026b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770279516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279516, "uuid": "bd160ff6-23a1-4426-8204-fdd02912ea54", "comment": "Malware payload", "value": "9d91d76705dd7daae3109c6e87721659", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279516, "uuid": "408d4a9d-683c-428c-b23c-f15065f02fab", "comment": "Malware payload", "value": "77f2a9c23c253354e660f475641ebe7a6e01288528ea2d16ed8575b40b70e3db", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279516, "uuid": "42dba40a-18ac-49d1-a3e3-5cf985288ab2", "comment": "Malware payload", "value": "c5fad8e807f2b5c5c01f5153c503a712033a6913", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279516, "uuid": "3a914449-3093-49a0-a817-11b9417a9a56", "comment": "Malware payload", "value": "0f625ff12c546aea70440134604453e58daaf9f4eec97585a3056ebc56b07e5bf4be4c87a5199eb5a128814cef157f95", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279516, "uuid": "4d906a69-94ef-4f63-9c93-e396278eae00", "value": "T16B6503B8D1D78FC70F56FD709A98BA588E65064C1231F15E375B40CB8E448AE279BF28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279516, "uuid": "fc59137d-07e6-486c-9206-416a0fa90051", "value": "96:B44444444444444444444444444444444444444444444444444444444444444M:Lq09ftT1GrsPhr5yHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770279516, "uuid": "d81b7cf2-2fd6-4346-ae21-6ee042602dac", "value": 1435497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770279516, "uuid": "8c8df2a4-d6d7-4bc3-afce-149db2109435", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279516, "uuid": "a24fc6fc-f4a7-484c-851b-c7a9c5778318", "value": "purchase order 39904058859.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355a04f1-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770305260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305260, "uuid": "db4cf0fb-6272-4a15-99be-4be128fc9d67", "comment": "Malware payload (Formbook)", "value": "565e80321ef4afe146b849284b7c1977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305260, "uuid": "47a638d9-f7ca-425c-ad55-2070e538482b", "comment": "Malware payload (Formbook)", "value": "785b0ccf655723dd52136a60a8389adfa5445bd1cbd53d5e80e7be26124e54a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305260, "uuid": "81741811-1227-4999-879a-fb97f61a8192", "comment": "Malware payload (Formbook)", "value": "e60879dfdc4d8cb26d7abcc70a3ed8725a4a64ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305260, "uuid": "a888f21f-1799-4172-be59-ca8fdfc2fc02", "comment": "Malware payload (Formbook)", "value": "7b5525f7c62dea121066630694243dfaf5938d2e2514753e5759de6bb55531c964b893a5a5bbdcbb550d1493fc244e73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305260, "uuid": "76b944c2-038c-447c-b9fe-e0eb932261c7", "value": "T173551212BBC4C073D4B129325AB5D760153C79606F728A8F53D43AAE6B319D2D632FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305260, "uuid": "a8517f6a-ad9d-4fa7-b938-dbe6c6a0a53f", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305260, "uuid": "459cd28c-5f5f-4239-8ec2-f207c5e20017", "value": "24576:bN/BUBb+tYjBFHNuuNVaydTowwvo6vdlN2YrXiM0hD6di/A+y:JpUlRhNV7aydVanEYrXiM0hDTjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305260, "uuid": "68ef9e5d-e4db-48da-b96f-69cb6f25cd43", "value": 1283210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305260, "uuid": "b5a31b61-dc52-40ed-821c-d93646967574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305260, "uuid": "966e3e96-e72e-4e4f-ad93-96d4202cbdaa", "value": "785b0ccf655723dd52136a60a8389adfa5445bd1cbd53d5e80e7be26124e54a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51432ae-026c-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770280107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280107, "uuid": "48cb4b73-3f36-43ab-97c7-70349c563e01", "comment": "Malware payload (a310Logger)", "value": "08a8a19856bf110671a7f443b4b9bf55", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280107, "uuid": "206e9976-154f-43bb-a45d-05d38b2740f8", "comment": "Malware payload (a310Logger)", "value": "7868d1f155fb7d471cd1a5b1e44784fc5e432e4aabebafc5391c98cd8c85cf83", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280107, "uuid": "9353cab3-fcd6-4bc7-9030-aec367733f3b", "comment": "Malware payload (a310Logger)", "value": "c064e2e06f5deed2bb0ad0b787b32f2b866cebb1", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280107, "uuid": "74307aa7-6175-4ef9-9b78-44abce4384d0", "comment": "Malware payload (a310Logger)", "value": "5b171f40c4f02b863b91eb573d1f3f7d8a195c141123866c0404b8af0012b6f7931cf1cfc0e37963209622f21e2f0a71", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280107, "uuid": "f7975873-5a39-4fee-a555-e17149211230", "value": "T1E6A51241D916DDA5022C8120252AAD832A000DB76D48377A7F9E6F8D1F0FA1FD57A7FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280107, "uuid": "1188dc3b-c501-4890-bc9c-4dcf75843689", "value": "49152:ZnkjEXLBE5JUWNbB5sGeoa7No2P3q6VYu:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280107, "uuid": "3e37e425-d4e6-4c91-b67e-22a22ae50fa0", "value": 2243625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280107, "uuid": "5e8b4721-4f51-4966-9da3-181a02abe118", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280107, "uuid": "17edc6b1-b101-4c47-9a08-902fdef9236e", "value": "grain.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbd4bbc-0228-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770250698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770250698, "uuid": "0d25fe0f-7e6f-4d41-99ef-e4d8edfaf50e", "comment": "Malware payload (Mirai)", "value": "a99aa3bd29b210f70b43e134aa4fa7c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770250698, "uuid": "5573940c-e215-4251-b127-e9df0abcb142", "comment": "Malware payload (Mirai)", "value": "786b60bd0ec72ddd6b6a5b3862941f60ad4a57283430d4f6e31d334e3c3071e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770250698, "uuid": "c2c74d95-1de0-4509-b91c-052d3bbfaa83", "comment": "Malware payload (Mirai)", "value": "2f588da2fbc21606b4cba5ba21abda1e123be69a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770250698, "uuid": "87490161-194b-4788-82ab-e12c3355b942", "comment": "Malware payload (Mirai)", "value": "7a02acdf8c79f3b8643a7e51e36440d7163a051054e5ff66683cd60ae319e0fb09e51a3aa734d2f00b786e05d9c364e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770250698, "uuid": "b1fec86a-cda3-42a7-9446-9427ef1d89a3", "value": "T17D63821A7E218F6DF76DC73487B74E219749338227E1C605E16CE9001F6438EA85FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770250698, "uuid": "26fb226a-e454-447f-a87a-281e3ec56832", "value": "768:t2Z1MhWdVT/kXSKl4sIMl4+059QwBsyPXxdfpwVSQl9bL7GAR+tBJ0U+0n0xl0Di:tIMhWvMSZHQjDNLbL6A4Tnl/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770250698, "uuid": "ec06e7f3-9b92-4167-b0a7-87264e278e90", "value": 67152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770250698, "uuid": "216620a6-387a-43ec-ac26-4efb91d01227", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770250698, "uuid": "1d7e7383-ca43-4d87-a067-d946a4e33e7b", "value": "Hilix.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5ca357-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306184, "uuid": "cd89dae7-c9b5-4164-b6ef-e079e1cb380f", "comment": "Malware payload", "value": "c58cb67d696d403fe1ac067c4f17da67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306184, "uuid": "72e7882d-266e-4186-b511-5deb58c09ea0", "comment": "Malware payload", "value": "79667d7503c24a8be01daa1403c15abacdee7d60d414648f73363a5ed785f6fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306184, "uuid": "f4e99108-6540-47db-87e9-d0c97722b85b", "comment": "Malware payload", "value": "88232108e47d366ad2aa074036b437b45db9a543", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306184, "uuid": "900017b6-3a24-41e8-8ea6-5a5b44cabd29", "comment": "Malware payload", "value": "80a47af8b4a70b5e916089b65d6214f86a253046b4c6724144223670705da33f17c7cc912a84df524027f7e3ca9f467c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306184, "uuid": "a3dd962b-518c-47cd-9096-cd7c95ee59b9", "value": "T153247A67A42CA79FDEDA2F32ADDE8A3353A65FC4CA91103E0C14730E3C671095E39656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306184, "uuid": "3d1b3d94-9d14-401d-9bd0-df7261e9a382", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306184, "uuid": "15773d53-955f-45db-a56e-a95a86c41880", "value": "6144:6ynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g3S:5nO56dyO7Wc8oNrRHwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306184, "uuid": "50931481-77b9-4d87-bbed-f8a6abca45fa", "value": 226018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306184, "uuid": "385eb690-7206-475f-8605-a318e4556f7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306184, "uuid": "5f43ab78-251f-4f8d-bb83-2147e4c1084f", "value": "79667d7503c24a8be01daa1403c15abacdee7d60d414648f73363a5ed785f6fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259afde1-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306522, "uuid": "07e62ac7-bc33-403a-b790-09fee9a187f8", "comment": "Malware payload", "value": "fb800fd60c46905a83c2166670183e6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306522, "uuid": "47dabcce-ff30-4c1b-ba7b-278130480506", "comment": "Malware payload", "value": "799eec0c602719be4c562da21e1fd7de789dfc4e9323c07d0286bd619409c161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306522, "uuid": "975c4525-f18f-4845-bd93-a0a2a903bcad", "comment": "Malware payload", "value": "a3a1dcedb05e391adbcc9abf470d4ec8f7e7bebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306522, "uuid": "5be81186-6f13-4893-9822-126154c9e035", "comment": "Malware payload", "value": "6fda45211f1c01721bb577f65b2e4200fd0b382e04359c1787ee08c76a057fcb415ca714344c091328f709da1c7a87db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306522, "uuid": "e37a850f-3554-4aa8-b07b-8a9644a8a829", "value": "T1B626E0D55050C0E3F03A6FBDA82A7D48DC5DBBA62A6311BE394475CAB921F5F1CC42E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306522, "uuid": "b97f22d5-b08d-46dd-a2d6-630b2ae27613", "value": "90d3d45c4128e324bab07310ba2c236a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306522, "uuid": "fefac5c8-1198-4248-8a13-4df3c3188cbc", "value": "98304:idW0UJPqLbR1Lpz6GCDaX1eK6ERvnI8UzUK:idKPq/Lpz6El17R/I8Y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306522, "uuid": "f15c2a57-926c-423a-9494-cc0f375f3275", "value": 4431872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306522, "uuid": "31a42f40-1cdd-45f6-bb24-9dd2ed5cd14c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306522, "uuid": "c348d997-6f6f-4948-9493-83b9e94baab2", "value": "799eec0c602719be4c562da21e1fd7de789dfc4e9323c07d0286bd619409c161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b844c6e-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327201, "uuid": "0d379718-6512-4352-9497-94c682ac8716", "comment": "Malware payload (Mirai)", "value": "0206b00268cb399c4ced6c184b59050e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327201, "uuid": "d637bd7a-ec15-4206-9e71-f9cbf95ac2d8", "comment": "Malware payload (Mirai)", "value": "79a8af9f2801392dc5112a5808917fdfe49464456d8f6a7dca52737599a81d50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327201, "uuid": "9f47b1b0-4431-425c-9146-fd72e8fcbef5", "comment": "Malware payload (Mirai)", "value": "78e744956980f884a8656a235f9ec47accd84c5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327201, "uuid": "f964083e-39d4-4812-95b8-a8e6ce400ff8", "comment": "Malware payload (Mirai)", "value": "65bc2618821f73400c073d36acc9c82021611c46b4552dd608340d878de1031aa66e7bb0abf511d236d53ae7cbb95fec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327201, "uuid": "3fb0722f-7195-46c3-8128-99012d62be76", "value": "T1F013F2E06B1EAE33952048B1E6660786320557FCCD7A1C3A5F8103ADE1DB507BB9CB4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327201, "uuid": "fba81d9c-bf44-4a05-8596-af26a7eb07f3", "value": "768:F4vuCRSVTsr7I6BTdcndbtvA8G616mAHVaLNZRloJVHfzUyF+9q3UEL++:FKuCRSA7/Bwb1A8G616o/Rm/zUyRLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327201, "uuid": "e2a2767a-182b-4b40-aa6e-22d3f149814d", "value": 42876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327201, "uuid": "f9e93d2a-5f61-40e5-91c8-2863fdb4c87e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327201, "uuid": "abe3a5dc-aa44-4afc-9a1b-b2f82aa5df1f", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6a66eb-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327203, "uuid": "df2dc766-c554-4f2b-91ca-abd742ebefb9", "comment": "Malware payload (Mirai)", "value": "31a9f2b8c305cfeec2e3a9504c7c3a7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327203, "uuid": "9685de4c-7a43-4e99-828a-a4e2eee95513", "comment": "Malware payload (Mirai)", "value": "79b4a450651107d2415de00b9f93ecfb47a5f05191a512193b102a05d780d79a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327203, "uuid": "69676f41-b082-49d7-8569-0b5b52f5d203", "comment": "Malware payload (Mirai)", "value": "7301fca17432c2ae296bece5a2f8ea61d63151ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327203, "uuid": "0957fe61-4ddb-4680-9f96-ba24343e3f78", "comment": "Malware payload (Mirai)", "value": "d4ab2cf5423413bbc72e52356142a423a8bb85c849c4c42dd11f9008897307a52905e502b08e6061e9b5df0803d3cb4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327203, "uuid": "89774745-4295-4d38-9903-f006af1b5e36", "value": "T16392CFAE8450A0D5D5619437E6EDC9CBE2AA0BFDE3E8307117A45A1CE361284377604F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327203, "uuid": "325ba097-7397-48be-93e7-699b06954239", "value": "384:v3CFDQy54M7zLnmZFiPThj6r8CKozfdchYC+Gyx2QSHWMbhymdGUop5ht8:/CmyqM7zLnmZQLh+IWfdzFG/QPes3UoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327203, "uuid": "f2e3f55d-4af4-4731-9aae-2572286a5acc", "value": 20524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327203, "uuid": "a25e3fb2-5df7-4d21-9098-12db7dadd1da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327203, "uuid": "b3b4cf58-f913-4f7e-82f2-e38311c85517", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45997e1c-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327191, "uuid": "66c5bbee-a8c4-4ffa-8412-4d5166c8120a", "comment": "Malware payload (Mirai)", "value": "514f2765669800af2996d5ce40e3139b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327191, "uuid": "d8e1ed9c-dcb6-46e9-85f5-5b868172bfe6", "comment": "Malware payload (Mirai)", "value": "79d2422408b1a8440c4d98c8fdcd9da68f876facd965f0dd52d5ae49b21569e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327191, "uuid": "7972384e-38fb-4db3-8c7e-366428eecaf1", "comment": "Malware payload (Mirai)", "value": "ce6b04c1b481979d46824dfb409afe7cf2008d7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327191, "uuid": "044f7a79-7278-4b9c-929a-972ce561aff3", "comment": "Malware payload (Mirai)", "value": "9f162c8997e6e8204493770a00524adf311d23d495e9d172d50b0a3c44c381a4bf5cd41fd718e8b49162d340755901ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327191, "uuid": "2e1cede0-57f7-4c46-b3fd-512a79cde34f", "value": "T1BD734B31F9390927C0D4917A61F74723B5F297CA20A8861F3E720F9DBF615403A57AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327191, "uuid": "eaa44386-34eb-4b13-bb3b-8ecec08ac611", "value": "1536:U2kN6QCXbqt5guvvF7tR7SYm5BHxS1H1tThfT:HhilL7SYOBR2hfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327191, "uuid": "5c905124-e8c0-41a4-b00d-adc06fe3b056", "value": 80032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327191, "uuid": "3bfd686c-4674-491f-9290-6669ff4daf92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327191, "uuid": "af0c0fdc-937d-413b-96b9-ca05b76472e7", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdb6dce-027c-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770286883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286883, "uuid": "122ff89c-98f8-4c1a-8013-ed86b06845cd", "comment": "Malware payload (XWorm)", "value": "52863d3c96f1fd0be6fdb1f5f510b888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286883, "uuid": "90d01ab6-31af-4d45-9b11-91345c1aa639", "comment": "Malware payload (XWorm)", "value": "7a4e6cb96cfa53aa0638b29d38ddc1a31cc53b807e6cc3299f891272a8d00d03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286883, "uuid": "4b321819-a289-479a-96a2-6d4ea758c0c5", "comment": "Malware payload (XWorm)", "value": "8b79f94c36770a0fb9a472369f2490beaf4f2b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286883, "uuid": "5c21ce2c-36cb-4768-8d49-7aae0f312fe5", "comment": "Malware payload (XWorm)", "value": "a1c968689326d83f93083555ff6e37bd175d933c9fe4264beb1cd9735ca63566d7a11c1150f303a9f37cab0f3588c990", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286883, "uuid": "c5a010a9-5825-4d35-9180-c2a32e99182c", "value": "T1011412BD510EE9AFD552C2766E444328CE24F91791177ACE8293A03037D52E0CFB6E8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286883, "uuid": "9e1b4b62-3465-419d-9173-7d0d613dc8bf", "value": "df0774ee1f0224e08060a6563fcbd4b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286883, "uuid": "a090609e-7a9f-4159-8db3-3e37b1f9dc76", "value": "3072:6dxNcnUFeeNsDiEn8mozMixKrUOJrJxa+Ef+xJMpGYu5lybW0Zu+3a1cLk:/UFKuEIkrUeja+Emk5ufybW0NaaLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770286883, "uuid": "1b5d96bf-043f-4d28-9cb7-7dda6302d5d7", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770286883, "uuid": "50eb6641-d82a-4d8e-a730-2fbac2308786", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286883, "uuid": "16a635a3-5dc4-4abe-a099-ff378871e494", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da67deb1-02ae-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770308543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308543, "uuid": "b3f4c87a-a30a-4412-b91f-2e149de08968", "comment": "Malware payload (Mirai)", "value": "0a74bbc8ace21cd0ab21e11dec6da3de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308543, "uuid": "65313080-c075-4cf6-815d-f99854004577", "comment": "Malware payload (Mirai)", "value": "7a74f4db6cc1d8041944fb1b172fb674556e8842544b07f7c63e898b7ae88659", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308543, "uuid": "b42d9325-9e74-4704-8e55-bd65794c8ef7", "comment": "Malware payload (Mirai)", "value": "b91f4479a78297e79bb9d63b7905262134273a8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308543, "uuid": "c8d56b51-abab-4c2a-8d43-d6ea28acc3e6", "comment": "Malware payload (Mirai)", "value": "198fd59d8ebde13da9cdd7d9828c0f15d54d66a58a07f6505787c2962b2c5abca70f708fac240aba9754ee3ff8cf9560", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308543, "uuid": "7b991e8f-d574-48e6-a88f-2e85c4352ba0", "value": "T18F9484BA7750BB9EE368C13405F353E5A3B2139226929205E07DCA3C1DF138C59DF9A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308543, "uuid": "c5700558-c362-49d6-9e37-36cf6601d1a7", "value": "6144:fuNOxAp3SI102NO3/cMtmozzTSR9tVhaL7RhuK2jpajqoyRW/+Ixu5cqlZWU/2b:fu3iOO3DTvSJVhaL7Rhrh2guizU/2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308543, "uuid": "970e4ece-abab-4095-a2d0-2e3afd5102d5", "value": 430984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308543, "uuid": "44489685-729d-458e-a8e7-a21451e55270", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308543, "uuid": "0258b6b0-3e65-4612-b92f-c579d52446ac", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f43e324-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306296, "uuid": "658915af-4fb9-4f78-9368-353717a637d8", "comment": "Malware payload", "value": "0f8068126a319365838a5abcbbc53782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306296, "uuid": "dbe9dd1a-b6f1-4197-95cc-0aff5a805a82", "comment": "Malware payload", "value": "7ab4388950f5a1aa9142d1aa22922a3fb9ab6763c991ce0d36f83e742ac922e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306296, "uuid": "6e6c4112-265e-4095-b6ec-2e253ef49bf9", "comment": "Malware payload", "value": "3ca37113c9800ba5c1ceec5c0f976b16ca79e5b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306296, "uuid": "1b783c98-6823-4384-9fa9-4ef74b07899c", "comment": "Malware payload", "value": "08ccb623e9d49fd0e5ece4e431ba6fb33698934f7a65a4713414fd2d8d1085a2a0ce471e803223960d7c9d3a0b994226", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306296, "uuid": "78d07410-5f1e-4b8d-a1dd-e29359c76e93", "value": "T1BD247B67A42CA7AFDEDA2F32ADDE8A2353B65FC4C991103E0C44730E3C671095E39566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306296, "uuid": "1fa0adb9-32ca-47ea-a70b-02a3009e2d8a", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306296, "uuid": "00378486-9111-4a72-832d-73bc9ef66832", "value": "6144:iynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g3M:BnO56dyO7Wc8oNrRHw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306296, "uuid": "a76d08e1-1a72-4ad8-aa7d-b4866fe764fd", "value": 227044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306296, "uuid": "69d6c137-fa2b-4fc4-a11c-579edc7f17bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306296, "uuid": "0d184285-8cfd-4ad5-80fc-7039264f86c0", "value": "7ab4388950f5a1aa9142d1aa22922a3fb9ab6763c991ce0d36f83e742ac922e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee0df67-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770303289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303289, "uuid": "427f3419-386b-4970-ad80-fe62f2eb0dfa", "comment": "Malware payload (PureLogsStealer)", "value": "fe31ac99900b9b84bcb5d4651262a352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303289, "uuid": "0469d528-11fa-476f-bdbc-d860b692c66e", "comment": "Malware payload (PureLogsStealer)", "value": "7ad2f5d51284fa66e419ed9dbe6822f544739814c2e2c685422e94ea5c093864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303289, "uuid": "c1ded234-8f8c-4994-8eb5-7dbf654ad694", "comment": "Malware payload (PureLogsStealer)", "value": "b60d056fa5246cc678860f82ac7114d27c81f5fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303289, "uuid": "7157a920-2b0c-40d6-941b-3168a16de09c", "comment": "Malware payload (PureLogsStealer)", "value": "9298658f2894e63dad20f8a53a19973a8cae2d4d0afd72b3198f2020ed4dafedc6d5183222ec2cd26e3a7863de405721", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303289, "uuid": "31a7076a-fff7-4829-bca5-b8d276ef7e56", "value": "T11D359CF037689A4BC5A6D9F30623C6704375EEC95602E2DADDE1FACF74B8B005A11267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303289, "uuid": "79837f39-6673-4ad8-a86b-5c78447e80de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303289, "uuid": "12f83e17-6ffd-420d-a5c9-7df9894e0a24", "value": "24576:byE2brFAuygshq49AiYzFDYsDzA+rw6+3e:byEoshq49AjFssAQw5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303289, "uuid": "b190424f-bba5-4ff3-a774-5968b80834e4", "value": 1144320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303289, "uuid": "961f4ebf-b2a9-49f9-b237-b3c26cf5d799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303289, "uuid": "70ad5a9e-1f6d-4c50-a2df-f2f3df5df8c5", "value": "7ad2f5d51284fa66e419ed9dbe6822f544739814c2e2c685422e94ea5c093864", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c1757e-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304239, "uuid": "86547b81-61c2-42ad-a100-92d8654b2d2c", "comment": "Malware payload", "value": "009408ad21c24b1f48c92a469d69b47d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304239, "uuid": "75802bc4-f433-4274-96e9-a14ffedf39cf", "comment": "Malware payload", "value": "7b0732a4c27c3e4019b78d804fa6d985a0e865be6770b60597d69fc56e556d3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304239, "uuid": "4fe39311-7824-426f-b6fc-5bf1d9089b07", "comment": "Malware payload", "value": "4e92c7e9f41cee0d0a67402f68dc09c94c5629f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304239, "uuid": "d75233e3-85bc-4ccf-9b29-22e7e44561fd", "comment": "Malware payload", "value": "9833f06db71138ba6b775c5a5a07cffbd797d221fb36b3c0c965b4c4dd22b5c49e71d98d8c7c0ccccd4a307dfa98c731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304239, "uuid": "30cc18b4-f8b7-45cd-b266-570824d3839b", "value": "T17AA4B256EA60B525F98704703D78A266382D2D372A81EC0FBB898F873671587B5F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304239, "uuid": "bb64655b-819d-45e4-9c12-53bc8aed941a", "value": "6a648ea02d5a15453ce45947667f5f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304239, "uuid": "65140415-1738-47a3-8f50-57bf3424b747", "value": "12288:ER7ZPxWlUYBbFFg+QvnIEdhSKShhUOKma7:NlOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304239, "uuid": "8163f50f-875c-4939-9e45-c8258827e055", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304239, "uuid": "0fb00e78-965f-413a-8233-d90ae6da1374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304239, "uuid": "79b90717-c8b6-49e7-82d8-116ca736038a", "value": "7b0732a4c27c3e4019b78d804fa6d985a0e865be6770b60597d69fc56e556d3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e5f7b1-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304380, "uuid": "35794105-83db-4447-9ed4-76f05582d2ef", "comment": "Malware payload (AgentTesla)", "value": "3fe580783a686dc3fd256a8107a7d5e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304380, "uuid": "ff44c971-0a89-4144-8133-14eadecaa706", "comment": "Malware payload (AgentTesla)", "value": "7b11770bbaf16efed9a7659b18967f1a515d0dfa2df9fcf4eb96791cd1b61f7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304380, "uuid": "7be5f9e0-7092-432a-9f00-3c9bd9fb0deb", "comment": "Malware payload (AgentTesla)", "value": "d559b4bddab2ee971ac5adc4d289442f36871643", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304380, "uuid": "d7f71490-ec79-4b6b-accb-f84c8eeaf16f", "comment": "Malware payload (AgentTesla)", "value": "fa4b27d0dc830ae73d7d18bbd56b50e44e72710770d25b792b385965868c06a072ef8e9d1c321b250d5fdf98d5b05e50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304380, "uuid": "a3c5a9cf-3359-474a-806e-1d2e700cb65c", "value": "T12C84016BF626482FE939EDB11E176A7D57781D20307BC2073E13BB1B89B4161478E21E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304380, "uuid": "8e8928c8-5330-4b1c-8398-28e660125e6f", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304380, "uuid": "e9bc87cc-8090-44a6-b474-c6d060ca65ac", "value": "6144:vDf4hQtpr0FevtY6PJ0o3guNZvd/RsfTrOF7sSapT/goFWaX1z:74y7r0UTXh8TrUwNVg4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304380, "uuid": "fcb4c6c6-3971-4274-affc-3f28c170b71b", "value": 387384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304380, "uuid": "7b04bb97-fca8-44d4-b77a-918adc50f5c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304380, "uuid": "4932c516-41d8-46fe-98bd-7ce5877eb367", "value": "7b11770bbaf16efed9a7659b18967f1a515d0dfa2df9fcf4eb96791cd1b61f7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780a229c-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770305372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305372, "uuid": "01028b7b-8ee6-483a-9f76-3b91eb3d6e9c", "comment": "Malware payload (GuLoader)", "value": "b5d6530b58e7a278f563d18268d8302f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305372, "uuid": "f268d090-af9e-467f-97b1-fc489c335918", "comment": "Malware payload (GuLoader)", "value": "7b2b89b5c92d6436888e918e397eaf479429c9c29eb864adb2f3b56e7ef0676d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305372, "uuid": "dde05514-4903-40dc-af3f-118981c28711", "comment": "Malware payload (GuLoader)", "value": "1157e82a73f05b3786b29f1fac9d7ed3d6a1eec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305372, "uuid": "208f8331-fd69-4cd8-94d2-fd20d4b0f76e", "comment": "Malware payload (GuLoader)", "value": "5d6af50928a149f68010921ed7dafae5d08b32c98cdcee08ecd84a27d3d44eac3cd09e843d5b83cdcd6e54e4bf668506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305372, "uuid": "6af507d0-5349-474f-88e1-02a5be46fa11", "value": "T18B0501853340D643E39513B8CCB9FAF06755BFACDB879B23BB203E5AB8762524807911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305372, "uuid": "8fb29705-f96c-46d3-a771-4c796daf5936", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305372, "uuid": "38273a2b-6b4f-4152-b8a9-73b5784c5c41", "value": "24576:54rQ/uPADOc5OdOpCvPe2WSCQTlVEv1AcSCfiQVP2/i:urjPk5OeCH1flY15SCfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305372, "uuid": "a2df491e-8d1c-4a83-aa6e-2bbc165c7b9a", "value": 813696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305372, "uuid": "6be51577-b1b8-4da3-942f-078dcdc2e8ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305372, "uuid": "a3cf0bef-a4d7-45bf-a299-ea019f72613f", "value": "7b2b89b5c92d6436888e918e397eaf479429c9c29eb864adb2f3b56e7ef0676d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fbf590-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327276, "uuid": "9084ba8d-89a3-49aa-b746-55e8061d39d1", "comment": "Malware payload (Mirai)", "value": "258e3389ecd22f988ceb3daa21af5685", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327276, "uuid": "ed1e4c59-744c-4551-9154-83b3521c4d86", "comment": "Malware payload (Mirai)", "value": "7b98472b9ef4b40ea7a715b4156ea177bbd4dd4b66e3a4983e20668c22aba8f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327276, "uuid": "5a8a0745-40e9-4e3f-aca2-708d387c7a94", "comment": "Malware payload (Mirai)", "value": "9998b47e5ba063e61c7bbf10a9bb5e318b7f140c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327276, "uuid": "918e7613-a4dd-48bf-8558-52b98cd548ad", "comment": "Malware payload (Mirai)", "value": "be50c8fc869961c7b3db64caa4f3b50889d07016c45531f88d0b7848c7e21f6b6f72e23d398ac7ba35a76fc7792864cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327276, "uuid": "2e76fdcf-5390-423e-9239-b5ada64f47a2", "value": "T16A733B56FC814A23C6C1127BF76E468D3B2653E8E2EA72039E259F3133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327276, "uuid": "7fa64984-e078-4c5f-b0ff-9d85f063b9fb", "value": "1536:uB/VU93ilj19ZBpCO72Rbu1U+qhxp8f8vNc:uB/VBBpCO72RDRZNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327276, "uuid": "212ecb4e-fff7-41eb-98cd-b423d4a57f56", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327276, "uuid": "c1125359-b08a-45fd-a11a-340c319fc009", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327276, "uuid": "c5b8a5fa-03aa-4080-8b27-6a11661ba615", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1211bb-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306133, "uuid": "dd6adb2d-8284-45cf-9362-05bbc94309b0", "comment": "Malware payload", "value": "9a568cf612dc11884dfa014a3e811519", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306133, "uuid": "7c96efd7-d3b9-44f2-bac9-6b5abe401661", "comment": "Malware payload", "value": "7b9b3d63dd207fdf2a494d27647d89fdf74536c9658f3af41219d377bcb23a33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306133, "uuid": "38e6958f-44f1-4674-9a67-d43fe9385015", "comment": "Malware payload", "value": "53bf880a24a0ff4c911e786f383a94814798063f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306133, "uuid": "5db37314-b2f8-423d-8702-464ef2a0ae5a", "comment": "Malware payload", "value": "f4ca7fabdd814122320fb1f3d1dfdde2a7e2453e93d2c9bf8145b6305d8cdebcb7d08c841734074241967b961cfd9b11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306133, "uuid": "601a0435-c9c5-4ca8-98d5-6939987a4fe8", "value": "T124247A67A42CA79FDEDA2F32ADDE8A3353A65FC4CA91103E0C14730E3C671095E39656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306133, "uuid": "368b4e75-6343-4db2-bc4c-9d77bd5d4718", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306133, "uuid": "9c840e10-291f-422b-8cc5-35c4ad5346de", "value": "6144:JynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g39:onO56dyO7Wc8oNrRHwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306133, "uuid": "f331a1e8-85a7-4a47-891a-fd468b9210e8", "value": 225888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306133, "uuid": "07bf3035-0200-49d9-aab7-273742547317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306133, "uuid": "c15f168c-3b01-4a6d-a1ca-2c080e7c7dd2", "value": "7b9b3d63dd207fdf2a494d27647d89fdf74536c9658f3af41219d377bcb23a33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beaa2010-0276-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770284445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770284445, "uuid": "c955dc03-04d1-4f25-ad9c-7fe1247dab85", "comment": "Malware payload (Mirai)", "value": "2a9785e9adabaceac905617c9091bbd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770284445, "uuid": "ace84859-710f-4da1-9a55-40964fddb6d4", "comment": "Malware payload (Mirai)", "value": "7bb537fd7bcdae2fed29412080a78d4f0d6ab526c6219cd40b8e78ad040ba811", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770284445, "uuid": "80476bf6-a5fb-48b1-b575-8279f6773133", "comment": "Malware payload (Mirai)", "value": "af4d175b4e9853cbc21c5223b9a1054a9f83386d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770284445, "uuid": "08d34d84-1f8a-4462-a81d-b8c615907afa", "comment": "Malware payload (Mirai)", "value": "f5c98adaaafeb137cbb784db54ecd0bf6c564b578a1180f563bc8d22112d3047d4eb537b63601fa88d6cdb23febcd170", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770284445, "uuid": "36f2c4fb-4ba8-4b6b-8c59-579ad77f61a3", "value": "T1FDD3CF32E0086DA0DD2116B4347659BC0340DEB40BD59243EFBEE59E28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770284445, "uuid": "83efb89d-b035-42c4-8976-e31a366f1f14", "value": "3072:kNulV+GOAc3YSmDEjdX/VuHVv3WDRGGRhaUNZkP0Zoa:yulo2ubIVv3sXL5NZmOoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770284445, "uuid": "c6262545-0000-4ed5-a7d6-94860b49e268", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770284445, "uuid": "c16b4e72-d944-4735-84d8-435cac6d791a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770284445, "uuid": "c6853e63-a0ee-4341-b793-bfeb4dc370a7", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2370234d-0234-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770255838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770255838, "uuid": "a3e0e2cf-e89d-41b6-8641-9745c7ae5632", "comment": "Malware payload (Mirai)", "value": "b77c9b550e405ebd65ea215d7d792b3f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770255838, "uuid": "54686b6e-dc07-4ebe-9eb5-d077a7a5767f", "comment": "Malware payload (Mirai)", "value": "7bf661fa0e6a09cff69beeff9f8949a0723058edd5ac04a3a86e137454b5f684", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770255838, "uuid": "8ad73b9b-93cc-4c31-b8dd-bf543272b519", "comment": "Malware payload (Mirai)", "value": "61c79f3d7c40601f828f245c785a5b1e4858b685", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770255838, "uuid": "f8db24d6-095d-4bdf-a7a1-a71be38d0ce7", "comment": "Malware payload (Mirai)", "value": "e286d605609d609bca1ca94ef7b22ae22f25b0cd52087caa6a1dd7009270ee72e5a56a8427c7fde9ccb2d6020a10815a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770255838, "uuid": "67267aac-ece9-42e9-ac2f-ae239f735629", "value": "T1E9B3E91E6E218FBDF768C73447B78E21A79833C626E1D645E16CD6005E6038E542FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770255838, "uuid": "837cb047-a7ed-44e4-a2e7-0543d776a268", "value": "1536:Xw4lPfv7d7Y/YL8dM416VcwS4ziMN/DIs1ISWlaH6efNHDhU4:BlPfDdM3dM4qcwS4vN/DIsC8HDhU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770255838, "uuid": "1cb1f1c1-f0a5-48a4-865e-f5a396c95bf9", "value": 114212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770255838, "uuid": "340537b2-f695-476c-af8e-3bb6ec718f6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770255838, "uuid": "c33829dd-99dd-4957-a648-6a0c5f1d2a86", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6b119e-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770308010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308010, "uuid": "5f802202-9821-4f31-ab53-91ef28124edd", "comment": "Malware payload", "value": "fea77ed01ebcfd9c09c6bb97ec849b2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308010, "uuid": "7fe7b185-460d-40f8-8a97-eb61a5bf9281", "comment": "Malware payload", "value": "7c0b05f846ac2c98f6bfd064cb35a3fb17f95c2ecf022f30bed09aa1adc7138f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308010, "uuid": "81d3b290-4a99-4591-be2f-2584257566e7", "comment": "Malware payload", "value": "59d0aa3799b1297eb99f5b644b9900324b04ee95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308010, "uuid": "b3db0416-d671-409a-96b5-b4c4e8cc1639", "comment": "Malware payload", "value": "ec9d0466c2855c82802b642a3a4546cf8c96366d14d526811c42901a5d2a1f4f1aaeada9fe06d8ce4dfc69f5bdf0258c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308010, "uuid": "f8d3f5e6-7a53-4013-b5fc-aaae0071a1c4", "value": "T177057D32E7B18033E0631A799C6B967C54267E232D38994B36F93DC85B76342347A6C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308010, "uuid": "0c546573-895a-4578-ba74-1d1cb5dc920f", "value": "421f57ebeade5946b16f0c3c541d2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308010, "uuid": "aa60ec76-d8d9-43ab-9ccb-9240f4f6fefc", "value": "12288:t9eONBtJzhKJd6EPXNQyxbLSoDZ5m9P9lUdXg4GG:Bnzz04EGOzN5aP9qXg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308010, "uuid": "8718425f-7057-429f-8ef7-9f7e9511e33a", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308010, "uuid": "8c1c9e25-7916-4ecd-8f05-8a172ee57303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308010, "uuid": "a353bec7-3c80-4190-bef5-a7167a5fbdc9", "value": "7c0b05f846ac2c98f6bfd064cb35a3fb17f95c2ecf022f30bed09aa1adc7138f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffd728f-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770307398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307398, "uuid": "b3f24534-37be-4700-889c-febaf9532d70", "comment": "Malware payload (RemcosRAT)", "value": "f96743c294869828492d2285d4adf45d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307398, "uuid": "eac287bc-30bf-4909-8256-37b70487d4dd", "comment": "Malware payload (RemcosRAT)", "value": "7c3fb21aea30307dafd91e4a6630f0a24391b486a659450474004975c2ea789b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307398, "uuid": "4394691a-8671-4b3d-b3ab-cc01722ab919", "comment": "Malware payload (RemcosRAT)", "value": "fbc421fa1cdb1862f76d9dc9185dd8b38d21a195", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307398, "uuid": "a8a87de7-ed42-4b64-adcd-a750acdbb965", "comment": "Malware payload (RemcosRAT)", "value": "df50eb4b429ac0c45da0c525192b03cab605851c3a23651917d9b0097e3d392c20def36cff04fd1823e2c47cf84a00fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307398, "uuid": "9039dbd7-3eb8-42ef-8761-4bbeb6dc76c2", "value": "T1DA55CF027391C062FFAB92334F5AF6115BBD69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307398, "uuid": "b5e900c3-c392-484b-b3bc-a917216cf630", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307398, "uuid": "ccd852c2-53fb-458f-8004-90e3aae09e90", "value": "24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8ad75kuLsUxw4sYbRXG:iTvC/MTQYxsWR7ad/Q7mbRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307398, "uuid": "6b1ca50f-7e4e-4562-9c25-27a5ab481c91", "value": 1357312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307398, "uuid": "7de3d2e4-8c78-4903-bd90-42fc1e43bb35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307398, "uuid": "7465d82c-0845-4208-962a-c79ecc6e4b99", "value": "7c3fb21aea30307dafd91e4a6630f0a24391b486a659450474004975c2ea789b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2089a2-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305840, "uuid": "edae852d-a693-4081-bfd8-21950f845dd3", "comment": "Malware payload", "value": "fba20dda015411651d0128161f3cde73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305840, "uuid": "d093e66f-cf7b-4fd7-9a29-adefdb914bcc", "comment": "Malware payload", "value": "7c6343bab29dcc6b879ef0617b056f3d00336d469854e2bfe1363c9708e9e81a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305840, "uuid": "769cb305-ab62-4e62-8c13-e1462cd6084c", "comment": "Malware payload", "value": "ec0e9981c841d9752b4244194826e9cfbcbc9e11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305840, "uuid": "1ea3844c-a8c6-4aec-af23-244b4e5c2b53", "comment": "Malware payload", "value": "0d7b1da06e4dd7cbb4a3b28a442b4f7b9ddad5a134aeeb0ede987793a6b2bcb6000b41267260e3fb62c49b1b6a0491b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305840, "uuid": "40ad0590-aa11-4013-b31b-9a9b98daa705", "value": "T197A4D087F9C0D1D2D8188C3599B3973111BFBCB86A8D8793A344729235331966B3BE67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305840, "uuid": "f6a440a2-e3b1-4975-b6cc-7622b2698eda", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305840, "uuid": "f19d9472-9eab-449a-bebc-f5022b03a0a0", "value": "12288:ZcODb7v0o8JvG5UFP+ibiucOTjjjjcjzjcjcjjYXBLSRj0OyydNKfyb0e:KO4njjjjcjzjcjcjjgB6nDhge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305840, "uuid": "57980d02-d3bb-4d9d-986a-6ce8f6eba8d8", "value": 482856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305840, "uuid": "f5fb12d9-d2d5-479a-89b3-7c2c92a94fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305840, "uuid": "6b79bcf4-87fc-4cec-a4c8-ab748afbe3e6", "value": "7c6343bab29dcc6b879ef0617b056f3d00336d469854e2bfe1363c9708e9e81a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26f3463-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770307161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307161, "uuid": "950310dd-9beb-4a72-8a12-aebf24b131ba", "comment": "Malware payload (GCleaner)", "value": "34ae43cd0a746ba277720ae6f7f36a10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307161, "uuid": "d6624d34-901d-4936-9e09-c60915ff67c8", "comment": "Malware payload (GCleaner)", "value": "7cb3184bb60611b77748c89702d2eb12faa57590d349c96b147626a1a8b9c8c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307161, "uuid": "bb80fdcf-32bb-4419-a424-95afa5e03ea2", "comment": "Malware payload (GCleaner)", "value": "fb8ba97c7caa05e01c17aeae097c31e522d7f273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307161, "uuid": "f7895cc2-f11a-4ace-bad1-b3d56bc39034", "comment": "Malware payload (GCleaner)", "value": "9b76bedb634b8927f8d3e70551d7d911306395d47c3de63fac21c2096f4a576ddcca750e53c53c89329828bd2c999a41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307161, "uuid": "b3042f5d-5053-453f-a3bb-70494a8c31c7", "value": "T16E057D22F2718077D2231E789C6B967C5CFAFE192938F46A27E92DC87B757413416283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307161, "uuid": "ad158d63-e95f-40ab-8686-e71b178c8d82", "value": "421f57ebeade5946b16f0c3c541d2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307161, "uuid": "bf888d11-9d9f-4c8c-b690-fbf546bafee9", "value": "12288:29eONBtJzhKJd6EPXNQyxbLSoQZVKcv+so6dD26G:snzz04EGOzuVK1Oh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307161, "uuid": "15bc2fba-049e-46a9-9d13-07d3ba938b4d", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307161, "uuid": "256e337d-e84a-4243-a312-cb52fe464969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307161, "uuid": "99066f5e-e1f1-44a8-ae5e-f6ceed62eb68", "value": "7cb3184bb60611b77748c89702d2eb12faa57590d349c96b147626a1a8b9c8c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7ab3b7-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770307419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307419, "uuid": "23930246-2d0d-44bb-a183-fc451f1cf307", "comment": "Malware payload (SnakeKeylogger)", "value": "ea013107ea7d5ce0c632be75fdcf82c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307419, "uuid": "090266cf-f9a9-4f5d-9fc7-19f0977cb079", "comment": "Malware payload (SnakeKeylogger)", "value": "7cd098db07ec6508434e9ec6591a37d706c4a976f4472f3740ff4acb5570ad7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307419, "uuid": "562aa22e-7f6d-417d-a1f6-0549d9a2be88", "comment": "Malware payload (SnakeKeylogger)", "value": "3615b534bbd8a284bd6d8af6e6aeaf7c2413526f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307419, "uuid": "12b6d4ea-8969-438a-b2b8-d6de2680b5e5", "comment": "Malware payload (SnakeKeylogger)", "value": "846bf69248f517220f335835aaffa5492cef879b01919c4ec135390258b8b92d9ef1a4a50be61ed9dd9e22601aa2caa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307419, "uuid": "5abda461-ac45-4c92-b3a7-9a39c5dd4d48", "value": "T1C835AE027391D062FFAB91334F56F6115ABC7A260123AA1F13981DB9FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307419, "uuid": "62d81d85-561a-4c64-b14a-80363f2c38c2", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307419, "uuid": "4f5fba47-f615-4cf9-895f-4f684be2dd75", "value": "24576:z5EmXFtKaL4/oFe5T9yyXYfP1ijXda0s7FmDJZkfJ:zPVt/LZeJbInQRa0MEJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307419, "uuid": "a27fb020-fde9-422e-9e33-8b15e24470ac", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307419, "uuid": "4b92f4f9-d229-4413-911e-2ec9ce932576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307419, "uuid": "f13226db-9daa-4411-923b-00fd5f18758f", "value": "7cd098db07ec6508434e9ec6591a37d706c4a976f4472f3740ff4acb5570ad7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b7643e-0234-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770255920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770255920, "uuid": "0e1e8875-cfea-45e0-a662-e88ea1024b79", "comment": "Malware payload (Stealc)", "value": "ae875c42d9f38cc2caa4628141c4763c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770255920, "uuid": "b1bca4f1-85f8-4170-a374-dd0dac88fb1d", "comment": "Malware payload (Stealc)", "value": "7cd80c56e206d083eb68a411bb4b87409c466de055ebe64aa564f78e1cccfeae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770255920, "uuid": "e69c99c9-3e8c-41f3-b8a3-177c5349b00f", "comment": "Malware payload (Stealc)", "value": "ef819f1dcd86d433e7a30e0564e45797811a2f60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770255920, "uuid": "8dfa05c5-0f79-4c50-8a9a-a5e9bbdb8402", "comment": "Malware payload (Stealc)", "value": "b9b1d220f8b457bc6a472460e3f3281de3b01803e8950a9441f477a5ddae84b10556c3244171a44453fb2b04760a4c9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770255920, "uuid": "935c1069-d449-4401-a4ea-f47f066b1134", "value": "T155F48D5AE7A602F9D0BBC178CE424553EBB2B8155770978F03E11AA61F372A05F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770255920, "uuid": "385affa2-a4a2-4d2b-af8a-5e0aa6f87b12", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770255920, "uuid": "03de6d56-73ca-4a65-a428-6a863f24b908", "value": "12288:cU8VHX4ZPBuvzkOkW7UE+YTRqwJ4tC6ALSQTbAK4lVA:WVH6BuvbkW7xXVVmtCzQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770255920, "uuid": "7c3d9e09-4ea0-4afb-8159-bd49cb45c3c4", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770255920, "uuid": "333a3f3a-7d3a-4827-a7b2-a418f90b4df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770255920, "uuid": "38ffbe70-784b-4c9e-b701-5aebcc036085", "value": "x7cd80c56e206d083eb68a411bb4b87409c466de055eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae644d4-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327308, "uuid": "41b95920-ad53-4cb7-816b-1c4cb9b6e05c", "comment": "Malware payload (Mirai)", "value": "a975aeb5d48a25c40287eda40688597f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327308, "uuid": "915acb20-9c6f-4e6f-a116-5278a62e344a", "comment": "Malware payload (Mirai)", "value": "7cfe58b67126fca61e40a19345b9f64a4ca181c46e473937a1c0f085e05a5b8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327308, "uuid": "61abde1a-635d-4a3e-9976-ade12d220091", "comment": "Malware payload (Mirai)", "value": "f0b8f28365d9a32a97497cbe5db02c82a3dc2833", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327308, "uuid": "d04a6d16-3317-4ed3-b026-49f49f68e3ab", "comment": "Malware payload (Mirai)", "value": "b65c03541db86ebf077c6d936ea0612ee0cfbf7645ec84ee73ea3fdc411528a70b460e7c61e68652b7c2738d0d671ab5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327308, "uuid": "c86be845-c5b1-443f-aac2-280ad296c0dd", "value": "T19A835C02735C0E47D1675DF42A3F27E583AFE99121E4FA89650FDB4681B2E33154AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327308, "uuid": "736a39bd-2668-44cc-983c-4ced3e68c3f7", "value": "1536:zHuW7TkldX6K1lpHI69Z+wu2qD+JkoiKm4:zHuW7Tkr6WR91u+JkZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327308, "uuid": "e4c13659-0224-47da-b5b7-8a295692510b", "value": 83528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327308, "uuid": "893768d8-ebbb-430a-b9f9-883c08cf4939", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327308, "uuid": "022ea95b-8b13-4a00-b09a-0a3b5a13f269", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7d15c4-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303879, "uuid": "2aa99074-5845-4f36-9144-3571b744a14c", "comment": "Malware payload (AgentTesla)", "value": "190904a5b7ecbe1a3e868a8ed03a00aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303879, "uuid": "368b155d-dc28-4b53-b223-719fd78dcdb1", "comment": "Malware payload (AgentTesla)", "value": "7d8a887d116f563de667cdc00c50702c7312d2fea2c9e6e29827697041c76df6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303879, "uuid": "da377213-e099-411b-857e-8ad1b8206554", "comment": "Malware payload (AgentTesla)", "value": "9f66f3e8564cabe77da54a4518a3ce376f7c9c3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303879, "uuid": "57518025-bef6-43da-831f-af523f32af4c", "comment": "Malware payload (AgentTesla)", "value": "7783d385348d44b13bf34ebb6332aeb37e024d904c68c3326d75901bebf4cdbae99c7b8b299d6357bf4e0037de3631f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303879, "uuid": "b41a4f0e-4e73-4381-adaf-615400a9689e", "value": "T15735AE0273C1D062FFAB92734F56F6115ABC79260123A62F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303879, "uuid": "8f4036b6-8f59-4810-b642-c810f241cce8", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303879, "uuid": "b779a856-c402-48d6-95cd-a934ec0de12c", "value": "24576:P5EmXFtKaL4/oFe5T9yyXYfP1MAXDzj9o3OwlCl1+:PPVt/LZeJbInGizjLUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303879, "uuid": "40cac112-61a9-4333-a539-ba4ca75c305b", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303879, "uuid": "f86c1405-4fe1-480b-bcb0-0eb06b3e8631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303879, "uuid": "6237ef98-3ab5-4313-9df8-463deb93f552", "value": "b889e6d9579f2e4b3ee78ca51f2ced0361b249922f2aba412f6fcc44a954709d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44aac50a-025c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770273073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770273073, "uuid": "f71691f6-71e1-4350-9e6a-71654f62fed0", "comment": "Malware payload (Mirai)", "value": "6887ba7f71859dd0883002efef2c4df1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770273073, "uuid": "20ec0e91-dedf-411b-9677-68317d7d7b29", "comment": "Malware payload (Mirai)", "value": "7daa41785c9b7b72015053e7d1284c7c1dce4f4faa3d302ef0344fd8dbdf5e11", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770273073, "uuid": "e571c919-0e18-4551-80ac-4d7c99143a04", "comment": "Malware payload (Mirai)", "value": "4d224f8021ec850a6c104d35ae1c7ab1d934755d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770273073, "uuid": "3638603f-5168-43f3-bdec-bfc8f7b5ce53", "comment": "Malware payload (Mirai)", "value": "92846a28835239d7f879c4e778b3b539b369b0943cae16a83c87f0e090c383709180f76009c890bbbe4c969d4a8f742f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770273073, "uuid": "4b02384b-eb85-41a5-a2eb-ded445258f07", "value": "T1AD73951A6E628FADF759833447B78E21AB5833D627D1D641E26CD6002F7034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770273073, "uuid": "eee0cc5e-d5d5-42bb-9d20-cb44a2434aff", "value": "768:uOHdEN88rdOdkr06mC/ddIgGg/vPQKTQCQczck7XDSWbT2tAjUv5yzmRef8yWRwN:aL5f5gLczT7vLU5e/W6nX9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770273073, "uuid": "99633b48-fc51-49a0-a1d8-15893c4261d1", "value": 76384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770273073, "uuid": "ae96a46c-dc0c-4501-85f1-ccec0e6cbd9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770273073, "uuid": "68d72b50-471d-441c-b3fd-5f5c8c58cfed", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3baf32f2-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304841, "uuid": "69f70a71-1622-44aa-9195-8bbd99c957d5", "comment": "Malware payload", "value": "5f8f06b1277543a58f9f1a64b1c377de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304841, "uuid": "4c0911c3-329c-4cec-8c4a-a2af1cb21910", "comment": "Malware payload", "value": "7dde14789fbf0a4a8841c1b43c0f2bc11cca22c6deaf44b82c8d4bc66b58d797", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304841, "uuid": "f14d66ca-42ed-4f7c-8bf8-8029ececbf00", "comment": "Malware payload", "value": "dde1f6760aee37ff79fdc8a6d81e7b84e6088ca6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304841, "uuid": "01f648cb-49b0-4354-8eef-d0301b81e475", "comment": "Malware payload", "value": "95c4fbadad6bbca8804794de9b081e2af623d13bda04e4d19ef88a83a6a676c42d6207c07b78dbea4e043e38d81a0ae4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304841, "uuid": "bf9d19cf-b24c-404f-8bb8-21f8a4b1da7e", "value": "T110941816E65070A9F89349703D79A216782D3D362681EC0BB78E9F4A3771A87B0F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304841, "uuid": "2baf46de-536a-4543-a94c-151244b9ce10", "value": "80d49dd4ce5a3e5455c6fe084274f863", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304841, "uuid": "a574c2c2-b821-4a55-95d3-73ed61935f92", "value": "12288:rmFum8NHadnm4sZbgYy+AbAnXrDdox24M7dLBf:iuXb5Ab6oM7dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304841, "uuid": "998ba92d-21c4-4f00-8382-051e699384c5", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304841, "uuid": "8d0d0a2f-52c3-433b-ba10-aba57abd7e92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304841, "uuid": "0ad4aed3-fd93-47d4-b784-9bb1314c0029", "value": "7dde14789fbf0a4a8841c1b43c0f2bc11cca22c6deaf44b82c8d4bc66b58d797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb8e3cf-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327207, "uuid": "86a5e40d-711b-433d-8148-3abb6d1fe7cf", "comment": "Malware payload (Mirai)", "value": "76e00adaa8cb321bf38d12d7dd1dd72a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327207, "uuid": "0c2771bc-f06f-44b7-8a27-5a5e5757a064", "comment": "Malware payload (Mirai)", "value": "7e1846421f201655226f0191278f145fe426f580d30629aba76897308237468e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327207, "uuid": "55bc0e22-f64f-4063-ad9d-630263a8bbc2", "comment": "Malware payload (Mirai)", "value": "38abbaddd1456cda3a1e7587e7d76c828b6f4b3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327207, "uuid": "81e1fa06-b5f2-4458-a706-e40e25f0651d", "comment": "Malware payload (Mirai)", "value": "39df445b7a8525da646434e4cdc44ee574e3e2cc7f4ab0a4057c3c633fceb2e1d4c8e7ee6ac3770a306dcc81377f13e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327207, "uuid": "427796c2-e9fe-4d3b-bf66-79797dd8d057", "value": "T12BB3AEEBF64715A2C85243F013C79F8E3E2323909E57A4E76D1E267B15760DB1D06B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327207, "uuid": "3b6cda19-6c31-4606-9f40-c7fe3bc08d8d", "value": "1536:pkA9afIgfNMW3zC8aRGGTtJM/qrlpmxJ6nDgJx/LWW:6fIw3e8ZE3MYlphDgJxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327207, "uuid": "f37349b0-4e91-4c35-b041-18adcfb6b87b", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327207, "uuid": "1ca8b572-e52f-4cb0-9dc4-6edce851bf67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327207, "uuid": "5170b278-ee0b-4cfa-bb0d-dee608d0da3a", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1996122-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305925, "uuid": "78a5d5d5-aae7-40a6-ad24-ab676da15e50", "comment": "Malware payload", "value": "98dbf7718cb01b42f72501347a893bb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305925, "uuid": "dd5a5176-fa0c-4576-8eff-1a8711935235", "comment": "Malware payload", "value": "7f2fe8865bcfac4d51191fa1dce122c986e2fcd56184cc42addd6b0a9ad01ba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305925, "uuid": "daa39513-249a-4ea8-8b67-62de67cdc8da", "comment": "Malware payload", "value": "7fef53ff11d71d98720c60ee2f1e6989a7a4e4b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305925, "uuid": "2b0d4723-60a1-4c7f-b682-2fc691ce5c6b", "comment": "Malware payload", "value": "1027567b24152d25addca2b4dcc85a307332dc5c07854d7914c1e3588680d55afa92e4addf954de17984a542cbfe7f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305925, "uuid": "7914b440-989f-4721-8630-5f9ae9756fc9", "value": "T1A4B73366B5E6C371CC0ED235277BAAF1546A7E500719CA8BA3CD3A2E05706E01E217F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305925, "uuid": "1172a05e-eff5-4301-9414-b84c1733151f", "value": "c0c2f11d5b893e749f4bf8936f4f82dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305925, "uuid": "ed003d11-cb94-480f-8ea8-20e34a48ee9a", "value": "1572864:G9Z8If/7J42kgv+PXUaWtfsWOw3X2Y25R:QJLuZBMaYU7ymr5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305925, "uuid": "d5380030-5e11-45e3-8d53-c8623b213555", "value": 50478528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305925, "uuid": "a93ffb43-d117-4717-a8eb-7d65c6110519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305925, "uuid": "c068e506-bf46-41b2-b965-b732e48a3f84", "value": "XWinRepair0424_9998.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8caf284a-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770305406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305406, "uuid": "d57b50c4-f17b-44c3-bdf8-307bc3423f74", "comment": "Malware payload (SnakeKeylogger)", "value": "48ca2435ba5723015c47a4b21e83a546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305406, "uuid": "a0dbcb0b-2242-4b8b-903e-f099f74421b3", "comment": "Malware payload (SnakeKeylogger)", "value": "7f7a3ebc3c537133f40c9796460912778f737c90de32e6e8861bc6fb2431ebbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305406, "uuid": "54af52f1-a4aa-4681-acb5-06957d2323eb", "comment": "Malware payload (SnakeKeylogger)", "value": "6cdbff98d65968b07cd0406c747629c0253fedac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305406, "uuid": "73c398fc-069b-4260-99cc-4a53a372338b", "comment": "Malware payload (SnakeKeylogger)", "value": "8ebcc488ba75900c78778633ced7a5e498343b63358bcedc016f594b543751f381ee0f913363f0f31276e4db31d2261b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305406, "uuid": "abaa7ca0-cda7-47cb-8565-4fb7dba67fe0", "value": "T1C125DF34EA3EFB06D422BA70C825D6F61728FEC85905C31ABFE5AE5F78355620726305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305406, "uuid": "5f2ec710-1ca9-4a09-a09c-3f835ae2cd88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305406, "uuid": "177e76ef-9883-4bea-bbd7-5ee8ef599454", "value": "24576:hs40YGwx8Mc7NLo9FvBpbzpEPN7SD4uYMJ9VW:u40YGwKMULQFv78+E8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305406, "uuid": "61123758-6bd7-4f44-8f9b-98e0f924a9a8", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305406, "uuid": "d911f49b-c4d9-4053-be40-fb3d404b8269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305406, "uuid": "17f30c48-f0de-4035-86ab-f34d992be86e", "value": "7f7a3ebc3c537133f40c9796460912778f737c90de32e6e8861bc6fb2431ebbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f6e5cd-0229-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770251418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770251418, "uuid": "ec5eb047-1893-4287-ba53-9e9527427a16", "comment": "Malware payload (Formbook)", "value": "f4b48496321018ee16c919231621c13b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770251418, "uuid": "deeff2c4-955d-4d36-b8bb-29b5c2e8f73b", "comment": "Malware payload (Formbook)", "value": "7f9d39908a024cc37cdece4ecc8aa724695ee2873d80ed4b1e7f8f8f3ee7ed5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770251418, "uuid": "745172b2-9481-48a5-9f0a-b297741f6b56", "comment": "Malware payload (Formbook)", "value": "e2015ac4f699a07f7ea4c3ae9acfa930640fb965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770251418, "uuid": "fdae9ed8-0597-4527-8691-219b7959c8b1", "comment": "Malware payload (Formbook)", "value": "0505acdb9bf01b33fd45f936b23eee9d811c85dc840dba183720d7114504a950d4d148ade807a802b31017aa385c2a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770251418, "uuid": "972af18d-4686-4da6-9c09-9d46952d04ac", "value": "T10D3512D82280C413CCA9C37C15B1D27547794C9ED961C292AFEEFDE375A47DEA808DA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770251418, "uuid": "b4389731-b02c-4986-af61-fc86453bf19e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770251418, "uuid": "406ceec8-0a3d-4e02-bfaa-1283b0038e95", "value": "24576:5PiTkw/IwLT3KwbyM/n9oRWrMhEzdCfGddSka:5KTkw/Pb9oRWIhKwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770251418, "uuid": "5467f8c6-26ba-43c9-a6a6-e4d188c5cceb", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770251418, "uuid": "7eb3b684-844e-4565-890b-e351f539b898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770251418, "uuid": "fd3c2e1a-619d-4d28-a5d9-0e89cb536efd", "value": "z65PaymentReceipt_0002795_1749618415400_pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215d9657-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306515, "uuid": "bb42e518-9e13-4f4d-a7c7-09c7f35869f4", "comment": "Malware payload", "value": "1a77156547821dbab8c4b594458679bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306515, "uuid": "58228060-888a-4e43-9450-14f4cee441a1", "comment": "Malware payload", "value": "7fef52cfbde93db593841abe028ef5029edd11da5a5dca8fa8f0a9709ce9278c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306515, "uuid": "da7ae10b-3b21-40cd-a76b-2056ba5af4a4", "comment": "Malware payload", "value": "cba708e761ba35ae5fad1931a070d3a4d3da8ede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306515, "uuid": "300313eb-3a30-457c-8e9f-f7a925bb8451", "comment": "Malware payload", "value": "eeaf330d1060dbc7855ef376534ce8c8b69972fc2d191a2caa111d1a68427022fa39ea46178ce70a404190b1f674d6b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306515, "uuid": "ef99d0be-3175-42e7-9255-3ea1d5d6c164", "value": "T1DFB63301BBD1C6F6C0EA60BD585BCAFD826156956BCBF2C3FB2E91339D50263D0A52C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306515, "uuid": "df078d05-54ea-41d7-8ae2-3cd15e382019", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306515, "uuid": "c24e3e76-2049-4377-8c91-e3190754abc7", "value": "196608:aseltq6DAq0sNKq6B2sMCOfhrcIUpKaTjJThcYqWYXnW0RLVAkmBR2vw2WNNWu5T:efq8XNyMCohPStcyiW2VKBEY2WNNl5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306515, "uuid": "2921ec91-283f-41de-aa79-c9489006ecfe", "value": 11326976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306515, "uuid": "1a7cf175-57ca-4fa7-be0b-a2747bb426a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306515, "uuid": "195c9f9c-2905-498a-a2b9-b9ed4a79c7d4", "value": "7fef52cfbde93db593841abe028ef5029edd11da5a5dca8fa8f0a9709ce9278c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49997c0e-02e8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770333211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333211, "uuid": "5dd801e6-c5dd-4baa-838f-8c021f96627b", "comment": "Malware payload (Mirai)", "value": "fb33c93dbd079e619492f5f754f2fd3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333211, "uuid": "2b67b5dc-6fb4-45a6-809c-7d91f11be60c", "comment": "Malware payload (Mirai)", "value": "8000e0fc310a0d1ddf7688d6a5a7c909fba73b6bdfbd02d093e78197818bf1f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333211, "uuid": "4eebc6e3-9be0-4229-90d2-62ef5de0b628", "comment": "Malware payload (Mirai)", "value": "72db1bf33704cfdf5c1c40d85aa83238c2a573b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333211, "uuid": "7fe50615-b813-4edd-8ec6-c0ab63ebcc72", "comment": "Malware payload (Mirai)", "value": "5e73106a4b1c18b0ad1aa3937f58a49339c56f50e0c52b900b6403c74151a6493c6104155644dee4b361fc084690a178", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333211, "uuid": "0382710d-a9ed-4d96-8868-c9c751d040c6", "value": "T169534B99F4028E3DF88FE9B984160E05B93023D212931B276BAEFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333211, "uuid": "77998b4a-2f68-44e5-8e0d-b5e2dbc8d045", "value": "768:me4gpsM204GEkRbj3eXmonQiuQttd3gFHy1eu48B8vB6J7EzNfXQuJpozME3A:mo3EkRbrdDiDaFy1X48B2SEzNfAuJKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770333211, "uuid": "571a464e-db8f-438b-9224-1f340a278c39", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770333211, "uuid": "e3ea18fa-c7d5-4c86-a203-9bf8b35562d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333211, "uuid": "db127c39-8a82-4ff9-a53c-377960b3c1f2", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fdacee-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770305682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305682, "uuid": "74538387-fca8-482d-999a-f6f155662738", "comment": "Malware payload (AsyncRAT)", "value": "1e81adcc3ab7d829f4e8ac77d1d84d93", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305682, "uuid": "93a48d0d-c01e-4d7f-8a9a-9f1464bc9aa7", "comment": "Malware payload (AsyncRAT)", "value": "8039885e2d11860ce03ca4716f516743b48961a0d7090a3c3ebb8b1ea1a8c8b2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305682, "uuid": "6cfa5145-cf28-4da6-8c4e-d6f0c3bd7283", "comment": "Malware payload (AsyncRAT)", "value": "0a43c3b18029bb57c8cbf39dfe59a71b10bcdae5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305682, "uuid": "47d53e22-7230-4bdc-8381-e9e29c277b90", "comment": "Malware payload (AsyncRAT)", "value": "0bd2e500197afe1a4448a45d517b198466904f165815fa61153bae3b88fb367d14d84a15f0857e56c24cfb4dabedb631", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305682, "uuid": "77a601b7-7731-44bd-9a6c-4c471957f557", "value": "T12205BD74EB3EBB05D0627A74C835D6F21728FEC95804C31ABFE5AE9FB8315521726242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305682, "uuid": "a91cb2fa-b67c-4bc5-84e7-db00aab192b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305682, "uuid": "3c0e5b15-098b-4816-8b2e-0c96fca06651", "value": "24576:8s40mDxEz2idz91yuenfQvKtE9k4Kivw:H40mDf8zPFeo29Qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305682, "uuid": "cb7f801d-7043-4cf5-9f80-5f82e941ac91", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305682, "uuid": "188743dc-4491-4b54-9b79-f8f614c71317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305682, "uuid": "185686cc-26bb-4b89-b5a6-b263c0bfeb48", "value": "8039885e2d11860ce03ca4716f516743b48961a0d7090a3c3ebb8b1ea1a8c8b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83a9608-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770306312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306312, "uuid": "16205f94-1a42-4926-81c3-2ac5dae222ca", "comment": "Malware payload (AsyncRAT)", "value": "1bb6e1ef858108fb07e7b700bed2f3dd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306312, "uuid": "50b05b83-cb18-46c0-b257-a4409e39ce19", "comment": "Malware payload (AsyncRAT)", "value": "80d69d6ebb24fba95b31852989fecb2a74313013d993ce1e6dd9bc17df1cf653", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306312, "uuid": "8b394045-1c44-4c00-b5e3-4f9c04b608b8", "comment": "Malware payload (AsyncRAT)", "value": "23679f2d22d11ee87e0727fc62630633ee6328b1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306312, "uuid": "e7eca0f4-0154-4db9-be3c-661814051cd4", "comment": "Malware payload (AsyncRAT)", "value": "d4ad05f71f32c2e6453b8c3ee8a27e63e901db32d9c9135ab5d0ddb74ff2f2f56221e1d2be6642aed75fca3dc567cbd4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306312, "uuid": "8d8a6dca-30a0-4cf7-994c-2d63bb1c1ad3", "value": "T10E738C183BE5442EE4FFAFB459F23127C635F6136903D52F28C8025E0627A89CD816F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306312, "uuid": "04933ec2-9aee-4eea-aff2-f08484b90291", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306312, "uuid": "0a3e541c-dae2-4611-8a91-cf4f816ceaa4", "value": "1536:X/V/w6otjMYkqcKBUQmjR1mkOJmiFXpv4bNxvvN/5eH6y2Okbap+MPT:d46UjMecojmjgfv4bNxbC2OkbakML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306312, "uuid": "266d9f0c-f78e-401c-9185-feb977f37c94", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306312, "uuid": "f66df5af-9a19-471c-afe3-668034de71a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306312, "uuid": "8e0de691-af05-48e8-805f-1ae35311f6f3", "value": "80d69d6ebb24fba95b31852989fecb2a74313013d993ce1e6dd9bc17df1cf653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383ca694-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307412, "uuid": "6f9666c1-2088-4d99-8d26-a316ce85e404", "comment": "Malware payload", "value": "71c63a93ebbf8f2cceab66878215521e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307412, "uuid": "971e67bf-8bc5-4574-ba4c-69e7e3a40fab", "comment": "Malware payload", "value": "81a24d418338e87c3529f08a27102370557fd08c2ab3d63d26c73b97d8dae9f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307412, "uuid": "91f1852c-800a-4eff-b775-c5f848079c2b", "comment": "Malware payload", "value": "ecb2f3df2b8bce1c257d9b27caf67db345e1ded6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307412, "uuid": "6d3d359f-e702-4342-8e86-3cdbb5d7ddf8", "comment": "Malware payload", "value": "cde0f8b5adce60a9539a932200effdf5f953ba40641f72d69907ee11e731b71653bbaed6210d1299d2545c1c59a9936d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307412, "uuid": "02fa3337-525c-4bfb-933c-7d680bb162d7", "value": "T107247A67B42CA7AFDEDA2F32ADDE892353A65FC4C991103E0C44730E3C671095E39566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307412, "uuid": "a8741d94-8291-4d42-a348-43a32e14f822", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307412, "uuid": "9affed91-d74c-4b67-8c3f-fc061c819243", "value": "6144:/ynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g3m:qnO56dyO7Wc8oNrRHwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307412, "uuid": "09c8f96b-ef25-462c-9cdb-06ec24a8e2aa", "value": 227430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307412, "uuid": "1759be62-91b0-47ee-b76f-b0ac0a72e1a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307412, "uuid": "4683aa1d-6a41-424c-9a3e-bfa5014f8bfa", "value": "81a24d418338e87c3529f08a27102370557fd08c2ab3d63d26c73b97d8dae9f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff312990-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770306457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306457, "uuid": "80ed0043-b43f-4abe-a0e8-85cd8213296d", "comment": "Malware payload (Formbook)", "value": "dbff1c402cad7a727ff13afc79b428c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306457, "uuid": "b9ddc885-0aa1-43f2-8df6-bae5b17efeca", "comment": "Malware payload (Formbook)", "value": "8214ce3cfe4ba3bc84b063cba6ab11c0fdbdbaba9c003743f56c181e6a10e134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306457, "uuid": "6160dcc1-e226-4130-9c3a-c4dc56e9c125", "comment": "Malware payload (Formbook)", "value": "e07af5780a32fb8b15f7102d270bb169f7c8555a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306457, "uuid": "8b9538c6-ee81-41ac-aeb9-5989d674f532", "comment": "Malware payload (Formbook)", "value": "131fb627f8f7026a562bad75a869d22125bbc59e52a7d4e4da80398c5a5384931346f6e92c942cb624597e6f85442a2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306457, "uuid": "87ea1400-b304-4b20-9eec-06f208a7d398", "value": "T1AD2512683355FC02D4554BF40C72D3F562B09E94B982D3468FF6BCEBB867A8238552E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306457, "uuid": "7757eb45-8267-4e21-8121-a5883a47ab32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306457, "uuid": "b69a28b1-48c7-44c1-a64f-d47ab3e269ef", "value": "24576:2xQT4gMofinB2Fs3dwlx4K5iQaLS1AyXkIavh+fK:2xsMnBos3dwlliJAk7hA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306457, "uuid": "a6d20864-35ec-4869-9e69-061ddaf0246f", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306457, "uuid": "364bdaa8-3a7b-4e48-b914-d96068c3f1b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306457, "uuid": "61a0521e-89f7-41f5-91fd-2a1ab06e8827", "value": "8214ce3cfe4ba3bc84b063cba6ab11c0fdbdbaba9c003743f56c181e6a10e134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a033682-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306583, "uuid": "46f91344-d48f-4a25-8a72-0ba44f8fcc69", "comment": "Malware payload", "value": "78bd862adf700933ac46e6887d46ffde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306583, "uuid": "08863e30-3ae1-455f-b9e8-3d8b9656aac3", "comment": "Malware payload", "value": "835e0bedbb5f6c4cd6307b2018df6b25880e827f3e03ea1396c721bbce848f51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306583, "uuid": "6ee3a9b3-e486-46e8-aad8-5474ff59ddff", "comment": "Malware payload", "value": "1315e18d216e0cca5e442c5899f0ac4006fcce3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306583, "uuid": "9b84853d-d479-49b1-8e6b-d8aad3dc6528", "comment": "Malware payload", "value": "dd92309473a106c7e80b0ac99a9b133ee27876308fb95e3dbb5d3bc3c30217f633e90356b3d94e1c902768524c381096", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306583, "uuid": "5a45b99a-5953-41d0-913d-79e4794727b4", "value": "T170E4239D2960C457D3E90E710E14DBB12A763EB14CB81B4B37E40E4A75FB2B2285F792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306583, "uuid": "1fd2624d-afd2-4cc6-b4b1-22d20bac3473", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306583, "uuid": "1c32aeaf-7e4d-4a7f-bc09-386fc9cef24c", "value": "12288:mgN7bDkgM5b49gqtkXd3KY0bqZnNxtUyA9v9QKDnxdy2bPeVdSbG3o26hCpV45Ae:mgNzkgeBt10inj/2y2bmVU7dmSAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306583, "uuid": "368fab03-bea3-49b4-a068-5b44db536c1d", "value": 707512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306583, "uuid": "0c4bb303-41f8-4e6d-8c2d-48ae8893f660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306583, "uuid": "1a7fd9b0-6558-47f0-9ee1-335a1ca3e531", "value": "835e0bedbb5f6c4cd6307b2018df6b25880e827f3e03ea1396c721bbce848f51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e4c34c-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770306895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306895, "uuid": "79d3de99-a481-44d9-b550-3688628a7c2b", "comment": "Malware payload (QuasarRAT)", "value": "b0e96e217c9a50f9544cadc899aa6ece", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306895, "uuid": "eeb5703a-d051-4510-bde0-f3c19d276e89", "comment": "Malware payload (QuasarRAT)", "value": "83c68b7f1cc15001fc5888f47553d8fbd3573dc8b83327ff778f63e7c5d3f079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306895, "uuid": "2f685843-3b97-4524-8aef-a363958a4eb6", "comment": "Malware payload (QuasarRAT)", "value": "343494b39e858b84c977dbe035086d2c7f4d5858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306895, "uuid": "9d9dd0a4-ac0d-400e-8d05-3cbda4eab861", "comment": "Malware payload (QuasarRAT)", "value": "110c8324502ab90e25eda3cdd41edadb7a95ed2b0d22f55494fe93c7380efad018f7d6078d200d0180e86ffd56935704", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306895, "uuid": "414e8355-c420-4ce8-ab16-a7b7ca8df750", "value": "T19246230927C68958D53CC374807AAA8357F0B58B6E21CF5EB3C927AD5E12396B713723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306895, "uuid": "260c8768-d85c-4643-8e28-1abd5eb48804", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306895, "uuid": "6d721280-bb70-4dbc-9e88-1aee9158c6c0", "value": "49152:OCfTfejkFAn/2Gnw6nxwXqiMOrENcitrFkPvhGR7thSoWYfy8jg78uoX5UQq32/r:5tQ/2a9Or4cW+PvkNDHmBQq32yeDGWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306895, "uuid": "9cc1ed79-733b-4bbd-ba66-bb4583794142", "value": 5712384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306895, "uuid": "f2c37b7c-6c6a-4803-bf9f-b08a8d60b47a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306895, "uuid": "3513aa0f-a0cf-456d-a0b3-fb51bf7c8dd9", "value": "83c68b7f1cc15001fc5888f47553d8fbd3573dc8b83327ff778f63e7c5d3f079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5f4b30-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305164, "uuid": "80616b90-2df0-4736-ab1d-4d4735b10be3", "comment": "Malware payload", "value": "5975ba0fde8814d2f89b08a7db93de69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305164, "uuid": "c94448e2-c0d9-4c6c-9a02-2ae78c77f1e1", "comment": "Malware payload", "value": "8420f06d61d705dba024c58c924977ba634c6ccce32edf0146ba69dd5dfc02c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305164, "uuid": "c604b944-4fde-4117-9cd0-416934a216a3", "comment": "Malware payload", "value": "452fd2bad23c3229acfef4e768edc5ea9d4956f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305164, "uuid": "fed839e6-ed4d-443d-9e05-8c768573a63d", "comment": "Malware payload", "value": "2558a88138340854a02584f437c402fc32521fe8c600a0c93aa8010b8fe1cd6b742445c6e5f6151738f42c3fa88c2729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305164, "uuid": "6a66ede6-d4b5-411c-bda4-5acebab92489", "value": "T1A866D0CAD17B40D6CC067FF598142BC39B3056324A34046836ABBE585F779FA811EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305164, "uuid": "9cb39dec-ae9f-4dd0-ab8d-2ccd062e36cb", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305164, "uuid": "e946045a-b168-430e-be34-65036e7c63f4", "value": "24576:QCvh3Wnw2fcBPiDqyjEfP6fEIVLIxXwbfR2ODvfRRaSPfEikLsiky89BaJcgqlnn:fKc1+QujNrun/PARcg96H62o8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305164, "uuid": "f1fe9c58-a007-40aa-a413-5d4674593fa7", "value": 6985728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305164, "uuid": "6b021633-a097-44d7-976a-3bab882ec130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305164, "uuid": "fc5bf833-0cd8-43e7-b5c3-c3482b07318f", "value": "8420f06d61d705dba024c58c924977ba634c6ccce32edf0146ba69dd5dfc02c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9cdd53-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306644, "uuid": "df27c39d-ddb1-4a67-ba12-c18f34f2d905", "comment": "Malware payload", "value": "1c8acab1d957aaae1567a93537031197", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306644, "uuid": "626f4cff-18d4-468f-aa6a-ebbd144e9e5c", "comment": "Malware payload", "value": "84273efd48095124a8ba5208ad97689a66339b4268aa907ebb45aeae5d88212e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306644, "uuid": "a6226c0b-e33a-406c-975b-d191c4e229bd", "comment": "Malware payload", "value": "97d14671db2d205ae8ff7b7079e0ea6b9285b728", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306644, "uuid": "c949c29b-848d-419f-a007-760a1147e60a", "comment": "Malware payload", "value": "c5a7150a2700d643b4704ebe3db2dd0e918e51e86af155d75c6b171cf58b5509fe33e92b266e1862b7d41bea317221d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306644, "uuid": "672ee7c7-f075-49a0-9e1c-a6c76da922dc", "value": "T1E4940722EA60B426E89305B03D789256782D3D3A2590ED0BBB8DDF563B7198371F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306644, "uuid": "af77f319-cd4b-457b-81e2-631a13b48f88", "value": "267cb89b895a7a0dc51fe4af9924ec0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306644, "uuid": "ffe2c571-50f4-41db-bbed-03ae83d47689", "value": "12288:fYjnzwletCYw6EfKrJFlPwDMbhWXwgboQ:ejPwDMxcoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306644, "uuid": "5ec185a1-e69f-478c-a1dc-02f8dc39f869", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306644, "uuid": "47c5ff2b-8a76-4264-9a64-e7dfec721cf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306644, "uuid": "95835fb0-d8b8-4fc1-afca-7a8599f51ac3", "value": "84273efd48095124a8ba5208ad97689a66339b4268aa907ebb45aeae5d88212e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e45db17-02dd-11f1-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1770328521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328521, "uuid": "d2be544b-beb3-4056-90bb-36798e38836a", "comment": "Malware payload (N-able)", "value": "ab11a32f0d617e50eb0c710d63128f79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328521, "uuid": "e4630b4a-d4b8-4da6-99ff-d5561d6448f6", "comment": "Malware payload (N-able)", "value": "844202972ff19afa760447fc87963de0fbbc0ebc69d50164f03ecf5d4e67952f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328521, "uuid": "a628c44a-1ced-4090-82f1-ccc2b8b74b11", "comment": "Malware payload (N-able)", "value": "5fa97aaf219b223159f9487b296bb916f073e4a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328521, "uuid": "8c6c5276-bc66-47a2-a025-76ca846bcb65", "comment": "Malware payload (N-able)", "value": "beb7604618564552fd0bca2e57efc932fcf5c26b59947dc85d221e3ee24473d20fb044fe20535b63ed569a746b9ebd8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328521, "uuid": "08c77448-e2a7-4c19-a0d7-e8f6c750196f", "value": "T1FEE633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328521, "uuid": "5288f4e6-ceb9-4714-b51d-c70c21f16a61", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328521, "uuid": "50864331-ad3d-4db5-b5e6-6dabed742f47", "value": "393216:CvF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1i:grRxvoC/7a0jUxX7h1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770328521, "uuid": "ca32e7bd-32d7-4113-9780-a86f22ec80f4", "value": 14782000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770328521, "uuid": "045e10ca-80e6-47e0-8781-0994a13a595f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328521, "uuid": "903c58e4-f6db-4ddb-b842-d34905b8fcd4", "value": "amzn-s3-EfinTranscriptViewer.cm10_14_4_.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54b06f2-025f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770274578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274578, "uuid": "1fb88576-01f5-47a4-a743-5a9b448b6deb", "comment": "Malware payload (Mirai)", "value": "ee077ef07a8c6051c892b2acfbe2f224", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274578, "uuid": "94382524-2f3f-4c29-8673-52b201e99eb3", "comment": "Malware payload (Mirai)", "value": "844bea00cec0850abce1c02151cf13edfe1e4ef986d27ce8e509ffba23562c4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274578, "uuid": "55c6890d-0cc9-4b96-86fe-cd00cd7c5aad", "comment": "Malware payload (Mirai)", "value": "72bb628895fa80bb0a866138c66d9a120704c49e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274578, "uuid": "b7b2a8c6-7843-4f8b-974d-0fff291d270e", "comment": "Malware payload (Mirai)", "value": "60fdfc07f54653909c7ba306cdca86617767311ba90b2fce5d544bd3d444235bf21b5902d781edf70a75ae205c06092c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770274578, "uuid": "ed213012-494c-4b08-a0a4-b10a88a03966", "value": "T15FD31399BEE1CED4C517E8F4C5DEB13C41CD8286B4117B87AE1BA54F28C00DC3A666DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770274578, "uuid": "51aaecdc-9a9c-4539-9712-640f5774861a", "value": "3072:Ltiv4y0ou8LiS0cnghEvchl3kqvh5jIZcLEc2w5o7uUAVC5YO:x4xM8oR6ch+ovLEcXo7uUAE5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770274578, "uuid": "377fbb7b-b12b-416e-b586-8f0404e3fd36", "value": 141256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770274578, "uuid": "5d7b8085-00e1-42cc-9ce1-442d9e7ac476", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770274578, "uuid": "ecc3f83e-a93e-4c47-a0b0-4446d5353aa8", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8313fc62-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327295, "uuid": "4fe1080d-f762-47f9-8618-cb0a5f051ae0", "comment": "Malware payload (Mirai)", "value": "881c5f4dabf425b11814a113abd3b50e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327295, "uuid": "9c1fffac-f9cf-4d01-a8c3-267e043f9b9d", "comment": "Malware payload (Mirai)", "value": "844cd68f30119e6d75576caa43b91b62caaa7ff558c508beca7ae66b4ddf1eca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327295, "uuid": "5b25026f-0ba3-46ba-9fd2-8e1bdf51c412", "comment": "Malware payload (Mirai)", "value": "2cebcf76d93a436c96eba2ac331a898cab9be3e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327295, "uuid": "fe243280-9507-46e8-94e6-66fba7e3284f", "comment": "Malware payload (Mirai)", "value": "839df6a12a5d23499c6a79a753c56ca118e6a2d25097e103062e73e98b7383290236841b924997d6febb2855c7eb2c43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327295, "uuid": "63fb1f75-569e-41d4-8fa9-107262c54e3c", "value": "T1B7834B07798080FDC59AD13947BEB136C423B4BE1379B29B23D8FE267E09E601F19995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327295, "uuid": "70eeb5ab-c7ff-44c6-aacd-5d33f8f4f39d", "value": "1536:nRjDb+aMRl/fIFSnb0/2uhTmqYD2FsgElyoUNnz1/p5rVA9g:Z+pRdfI8njirA2XEly9z1/pM9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327295, "uuid": "33b3da63-aac6-484f-b4a6-66b7c205e3e2", "value": 80880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327295, "uuid": "2f40d536-3f13-4c14-841c-99fd469f4c1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327295, "uuid": "352be90b-e3a4-4e92-8efd-8fc9dbd328ed", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fe55ce-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306098, "uuid": "dd334e0d-5692-4f07-896a-50053acb1307", "comment": "Malware payload", "value": "787c9cde1b14f683abe7e133794f7246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306098, "uuid": "06de90d5-ffd5-402b-bf9b-993234374c5b", "comment": "Malware payload", "value": "84b4c080f28ee872a2d2e89aa1f923a7ab4d615df356e757639e81e05865695f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306098, "uuid": "8f98accf-e63d-4879-8d04-44326f0bc8cd", "comment": "Malware payload", "value": "25355aff761aabb5ef8bd1355461d9a7c3414df0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306098, "uuid": "c0819ee6-3401-4c9c-9726-78647931a56f", "comment": "Malware payload", "value": "a01dbbd5efc857265d8058bb1beffdd6901c738c27ab752c885007597d0d3ca384342724c5d61809b725071ac489a1b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306098, "uuid": "3f13e797-9a86-46f9-a189-7a69111162c3", "value": "T1F6248A67A42CA79FDEDA2F32ADDE8A2353A65FC4CA91103E0C14730E3C671095E39656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306098, "uuid": "6dd7ade9-f7d5-4f25-82f2-40049f4091a6", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306098, "uuid": "a55a6d92-ff15-412f-a8a7-f3a500abceb8", "value": "6144:gynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g3F:LnO56dyO7Wc8oNrRHwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306098, "uuid": "6db3562c-f739-4d19-8315-dea20287a7a2", "value": 225889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306098, "uuid": "e33bdb37-90d7-48e9-8d75-f63bca999044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306098, "uuid": "dfb1d55c-8e22-4ed5-b111-287527156d62", "value": "84b4c080f28ee872a2d2e89aa1f923a7ab4d615df356e757639e81e05865695f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d6afd3-025c-11f1-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1770273310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770273310, "uuid": "e1efca3b-cd7d-4089-ba43-84d2dd76a8bf", "comment": "Malware payload (DCRat)", "value": "9274008a5c543d4c353437edee092a5f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770273310, "uuid": "147b9767-c242-4299-a9e2-d034ef91b5b9", "comment": "Malware payload (DCRat)", "value": "85286ae6c31c9afed288bd0da14abc5cd2a20042c07928ee7eb0039b6e784ca1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770273310, "uuid": "07f9a08d-01d0-4b8c-abec-33f8805890e7", "comment": "Malware payload (DCRat)", "value": "3016381957336d92af710b99735f0a0184a19e52", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770273310, "uuid": "4c148a32-fb65-4cf8-956c-77b14598bf37", "comment": "Malware payload (DCRat)", "value": "639e8a49864cdf9512cb9b4bf1236e5fe5432cbf9e0d80c7f5886c43175882659c1e9508fc758ee1b7595442fe12831a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770273310, "uuid": "81a4dbd5-fa19-45fb-9ccb-739dc20e7404", "value": "T1EE95BE1765924E37C2706B319697523DA390C7763522EF4B3A0F60D6AD0BBF18A721B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770273310, "uuid": "a8386ec9-5b71-494f-a2c3-baec688ad3ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770273310, "uuid": "54f7e5e2-afff-413f-8e4a-43bdfcccc9dc", "value": "49152:lOx4Dh3sVCMVTS4mVGqrn7FmGJ//a2AwHW98MFVyKsPs:AxShsVCMdHmV9nFVQV998ORsPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770273310, "uuid": "c6cdfac7-4ca2-46be-9f07-be894f127e2f", "value": 1960960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770273310, "uuid": "aa3c969a-2d62-43be-9540-e1c84c180151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770273310, "uuid": "fb391ca2-dfa1-46aa-8eb6-3cdabb997b4c", "value": "9274008A5C543D4C353437EDEE092A5F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d195260b-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770303374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303374, "uuid": "baf4dd8b-2e73-400d-8c30-c23880c4c84d", "comment": "Malware payload (SnakeKeylogger)", "value": "7c0bf7c3053ad4aeb58a12f2a0d8ba53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303374, "uuid": "e5eb543e-faa8-4d0c-b466-282ec4e7a483", "comment": "Malware payload (SnakeKeylogger)", "value": "854122b6294f5e11ef7aafc70ae82c94ce653a413d40768313df95a268d3a693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303374, "uuid": "98d7c679-5c47-4024-a34f-ec83c395b6ae", "comment": "Malware payload (SnakeKeylogger)", "value": "b210aed0c2945c5ff8bd95632f2877c3de8d2a98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303374, "uuid": "756eb9dc-15cb-4e4c-a292-f3d17d0a2aa2", "comment": "Malware payload (SnakeKeylogger)", "value": "e84afa2745a1899ba55efa42788a82d776c8999ef539baa0025cb6dc07920f651ed923ba7389dcd192f1c724c961c206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303374, "uuid": "bb366c74-fea0-4902-a72c-4ef985cde5c9", "value": "T17AC4F104136BDD02D0E14FB6A9B1F3B43B29AEDBA5A1C297AFD43FEF74292854950311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303374, "uuid": "4c6337fa-ce8e-4149-8e49-73639305cb48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303374, "uuid": "066311ef-7e57-41c6-995c-8954a759c5cb", "value": "12288:c4ctN7IBWXWWo1/I01MR9NJ9xyYKQa5SeZjm24WEQ9Vp:cTrINMRXrxyY45SMj9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303374, "uuid": "e57d750b-5e85-40c5-800c-93e5d32e1d49", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303374, "uuid": "4faa8b16-8675-4080-a85a-3b87a0fe2007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303374, "uuid": "d3b569e8-6049-456e-a59c-af7164e5bb01", "value": "854122b6294f5e11ef7aafc70ae82c94ce653a413d40768313df95a268d3a693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063ffe55-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770303463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303463, "uuid": "64be31ea-a2e1-468d-b2d1-4a9f6ecf256f", "comment": "Malware payload (a310Logger)", "value": "071043c8db84b5b5ce0672e6ad5b87d7", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303463, "uuid": "8e2ef76a-972c-4719-b37a-4ff50ec7f51a", "comment": "Malware payload (a310Logger)", "value": "854e60be7524451bf02f8906c96cd3d5fe9643236d7e733830e4e51380677b07", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303463, "uuid": "e4c4e8ba-a215-43d8-ab0a-1746c17a4e4c", "comment": "Malware payload (a310Logger)", "value": "7a4d0efadee699447f19ef2446daf1e466241366", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303463, "uuid": "c0bfdec5-ca63-4c99-bca9-4b2d83892b56", "comment": "Malware payload (a310Logger)", "value": "fc6eb0e4e2ebd2d4a40ddcdfdc41d5efe2a70d1f1599f26fec3ec5d17324af6b71131ec9e736622e72e41a128b2d147c", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303463, "uuid": "104e9357-2a83-48a0-861f-bf65dd9c23eb", "value": "T19C0512803798CB42EAFA47F606B0E27647747D6E9C64E21D8EEA6CDF7451B112C40B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303463, "uuid": "453d2f6e-335c-4574-827d-118ab22d977f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303463, "uuid": "0078b1cd-8995-4028-badc-450b250f0cb8", "value": "24576:sgqgnQiJ1idIzDYTgqzuhYpqgHNT0qycn6:szyzK2DYkqjIgHsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303463, "uuid": "dddacca4-b378-4682-a1d5-62a1de5e5bb9", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303463, "uuid": "7d4994b3-5f37-4752-9e13-b6f4e5206696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303463, "uuid": "c4a24b61-d61a-4847-bccc-9bd1755d36ff", "value": "854e60be7524451bf02f8906c96cd3d5fe9643236d7e733830e4e51380677b07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea84678f-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770307711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307711, "uuid": "ad5e05f8-df69-4371-a6c3-a8213d45380a", "comment": "Malware payload (GuLoader)", "value": "7f1d8e53981c06f72199c06031f2567f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307711, "uuid": "b12d5c97-14ec-4c82-8b12-726a01b55f07", "comment": "Malware payload (GuLoader)", "value": "8680ebb261a1aca7e0f0b85f7add7b846b7f897ab3b29152985780b60eb57593", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307711, "uuid": "f7fb4360-b8be-46b1-8e43-86101e055ed7", "comment": "Malware payload (GuLoader)", "value": "9fb57e90c2d9f2473f154538b3e895815a46cff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307711, "uuid": "556725d1-794d-42a4-bdba-23b4161c001a", "comment": "Malware payload (GuLoader)", "value": "b87ff0483f94410228194e52020fcba40b8975baa921371dab20681780c4bfadf059aa6068edb33a3d7043f1b3b225be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307711, "uuid": "8143ec64-9d1d-4589-8859-5d8303806ea6", "value": "T133D423A13AB284B3E65713714961DFFA3CAACC92046478932340B546FCB67B2DE6D347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307711, "uuid": "10238af2-7fe0-4224-b1cf-3138fa21ee19", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307711, "uuid": "e8768159-8779-4410-a070-0ee36443d316", "value": "12288:SBNUqOqINHfSv9/s/bg60lZlGRPOobvoE5j4RcWaKIyOiy38:wBxAfSv9/kbg60lZgRWGoG421ey38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307711, "uuid": "cee50780-1c75-4a26-8685-87158f455606", "value": 643792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307711, "uuid": "e0613d39-222d-4220-b99e-46475ba37281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307711, "uuid": "f16b6fa5-e1d8-4eb9-be2a-3b33c5acff85", "value": "8680ebb261a1aca7e0f0b85f7add7b846b7f897ab3b29152985780b60eb57593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f982cb7-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307532, "uuid": "03a4b615-18e3-4030-9e18-1e705716cf82", "comment": "Malware payload", "value": "a0a96f1ac55c0250cb38e767d2f3a1bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307532, "uuid": "67799e5c-9412-448a-a099-8803d043c7cb", "comment": "Malware payload", "value": "871f5f1d0318df285c4240af646a4ad8b337009e9295b0f0d49c460077e00e84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307532, "uuid": "f1cf4e2e-151e-4471-b304-48f588b83968", "comment": "Malware payload", "value": "45d7f0a95e86bd6bbdf488178d450e115927d405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307532, "uuid": "a3222ccc-c571-4bdb-a295-f9affef4b8a2", "comment": "Malware payload", "value": "5b4d2871a277b1a58baca7105df319d7d77caa88475fd9dfafbafbb5bb43d17c7ddf8f82413597573a4825db211dd53d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307532, "uuid": "18916330-fe67-4ac1-86a8-86016d8ce6f9", "value": "T1C8A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7ADD76F56F603F1623A6C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307532, "uuid": "165a4a76-cf0e-4553-8d27-e5604557e126", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307532, "uuid": "955f04de-b738-4b45-a527-9217595077cf", "value": "49152:ekQTAWYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpL:eaW5CbhZcT2lvnDFpFW/twU7+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307532, "uuid": "3eb2d3a8-7225-45ad-90d5-655a71f9ab45", "value": 2078720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307532, "uuid": "63cf5174-148f-417a-a13b-6824873c6e48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307532, "uuid": "27aa62f3-ae65-4b14-96db-3b3a823df0d5", "value": "871f5f1d0318df285c4240af646a4ad8b337009e9295b0f0d49c460077e00e84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b345db42-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305901, "uuid": "9225725e-d414-4378-90cb-9f9fcb7b6dc7", "comment": "Malware payload", "value": "9c7c74e402b1b9d09164831fc0aa8558", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305901, "uuid": "2515d216-d5e7-4c49-9cfd-bb9aef0d0e19", "comment": "Malware payload", "value": "875d4ee2ceeaa9e1ef431754ef310051de5d2edfc906482ac7f5ae0cc552bca7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305901, "uuid": "adc01180-592a-4b96-946a-db0e6b8d1716", "comment": "Malware payload", "value": "5f0e606dec67d63fbf9ec35e433967a8a42923a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305901, "uuid": "cfee93a0-4aad-421e-815b-b5dbfe1a30d7", "comment": "Malware payload", "value": "d8e600c0bbedf322c531ecfd207e84970961784b1142c492d75547581f2bd68f909c88b6f5858454b1ce498a822a790c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305901, "uuid": "7256609c-01e4-4630-9387-bb2130c60afc", "value": "T17294F712E760B5A5F89349702D38A256682D3C3A2680EC0BF74D9F4A3671A87B1F571F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305901, "uuid": "fb95fe84-6ffc-4952-af46-18b4203b8710", "value": "063655cfca6fd3932b4a9dfab6fd8eab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305901, "uuid": "890bbf69-0dd6-40f5-a994-40cbd7b1ec80", "value": "12288:ibIu5ACZFbPKis285R1OyhAznrjwi6o3/jGP5992F:uV5ACQ1dhAznrj73q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305901, "uuid": "92697933-8b10-459e-ab7c-44a77ee38d7e", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305901, "uuid": "4443fa7f-ed68-4a76-b621-f37fdcbc55e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305901, "uuid": "d9775db8-3d46-416c-b794-5422ff366d4c", "value": "875d4ee2ceeaa9e1ef431754ef310051de5d2edfc906482ac7f5ae0cc552bca7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93009425-0288-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770292103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292103, "uuid": "e5e7d0e4-da1b-490c-b683-343dff082243", "comment": "Malware payload", "value": "f8fffc0e738633806ae1ad45cfff4c4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292103, "uuid": "bf6540d4-46c0-489a-ad13-2abb560a95b3", "comment": "Malware payload", "value": "8798513436bd3817df839e974810fd3f9595393dafdaf4a67b381c30689273f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292103, "uuid": "14fa7060-a9e4-4ce0-8f8d-d692630f80e7", "comment": "Malware payload", "value": "e46af82e73106b88e468cf612e01f69d47a3105d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292103, "uuid": "5e087ab8-3a82-44f3-a4c3-489a32d961b3", "comment": "Malware payload", "value": "dd2096582347e9d5b9bdcb55c072440395435b89faf0ec64b11e18626418cd3cad8ff75ceb4b43ff68ad71d9e033f5d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770292103, "uuid": "38599ca2-9d68-4d9f-8332-47badc9a3dbe", "value": "T153066D07FAA148A9D8EEC974860EE133E739B8494212772B7BD45F103E2AF209F4D755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770292103, "uuid": "ece8f2d9-92a4-4d5d-91eb-ba68702df713", "value": "49152:zBPrFGCmmaNTrHcK5AnnIks93fE5z2WU1NGJ6TgcjNaWdKVtz3LBjh225A:dsMC2ZMC6Ttu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770292103, "uuid": "bedd5756-4d16-45df-96c4-3cd11e9bd6c2", "value": 3906896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770292103, "uuid": "cbccd130-1f2e-496f-a94a-b2b77fae5594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770292103, "uuid": "6b0069f5-e9fb-43b6-b0a1-99ef9b5cef1b", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca848329-027b-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770286612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286612, "uuid": "d7229a5b-d0a5-440a-a0d9-7d8e2341605b", "comment": "Malware payload (PhantomStealer)", "value": "214676af6e1ebf0ac384b31db9b3fc0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286612, "uuid": "ce64168f-f42a-447c-925c-41b3bbee64cf", "comment": "Malware payload (PhantomStealer)", "value": "87b84226af9c445f5b1a764791f29da7c1b87fe3a52647efdb6a6caf6d68e35b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286612, "uuid": "a4a8104e-be36-49af-b3ca-372cb0a0067d", "comment": "Malware payload (PhantomStealer)", "value": "c92490dcdc18c5097efed24cb1462f74964b5463", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286612, "uuid": "6f8c6633-f05f-435f-bcea-e55d2d3d3e31", "comment": "Malware payload (PhantomStealer)", "value": "04740cc958bcccf4ba8b614c274de6a3faa6d5d2a8ec5a5c6baf68cbae7179dd078866ca15f8733d33b68c0d9a8c96bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286612, "uuid": "c2fbb487-2f68-4ec7-973e-c5b367ce920c", "value": "T1BA75D0027391D062FFAB95334F56F6115BBC79260123A62F13A81DB9FA701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286612, "uuid": "11b5ff45-db80-4300-b3f8-d74ef3fa6687", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286612, "uuid": "145185a5-44df-4fb7-98f9-cf0f951d5640", "value": "24576:D5EmXFtKaL4/oFe5T9yyXYfP1ijXdaVK4QngXjc2RJ/+5Io+OX5KazpECE:DPVt/LZeJbInQRaVKZ32R9+5HJK6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770286612, "uuid": "fc7521d1-769d-4307-8c71-3a8949f5aefd", "value": 1675776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770286612, "uuid": "adc31e09-9018-46ac-9936-d146188b7a1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286612, "uuid": "96a65c20-92da-493d-a79b-f9ed2bbd6643", "value": "87b84226af9c445f5b1a764791f29da7c1b87fe3a52647efdb6a6caf6d68e35b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba9d8e3-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770305780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305780, "uuid": "fa36bd57-3ba2-4b83-9aff-dfc96fe4a2d7", "comment": "Malware payload (RemcosRAT)", "value": "094b797d5e09f58fd3776f8abbb0d417", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305780, "uuid": "ac584087-f111-424f-bad4-310856059855", "comment": "Malware payload (RemcosRAT)", "value": "87bfc21e2066c7ad2849cb46789fa7559f874ef64a628599012ff1b20bafe4dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305780, "uuid": "2bac31cf-8225-4bab-9c00-9a90081a5124", "comment": "Malware payload (RemcosRAT)", "value": "9c56e3e8cc0b8ba0ba760b860d0e5a24fa4a1e55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305780, "uuid": "4bd3e574-bf23-4ae7-83dd-88639bdc4a32", "comment": "Malware payload (RemcosRAT)", "value": "7c471807ce72e1c1274879bcb3398371851a8cd575aaadd6e4b572b355364e851e4c9dde7747588a790eea497e81a7fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305780, "uuid": "04bf78d1-b1a9-47c5-aaa7-81e72389dcc9", "value": "T16F3512411B98CA11E9E30BB01571E33A23F49E9EE921C3071EDB6CDF7471B952958793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305780, "uuid": "cd9f43b1-1718-4469-be11-e9ce6846cdd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305780, "uuid": "27a4369c-3fec-4944-a950-adafc32c3e73", "value": "24576:q1WL0pduhnIsmwuE6WTdoUA3mpig4QDZmxWph1P4vE:qhpEIsAEHTy2pignwxWp34vE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305780, "uuid": "f5a3c89e-42f6-40dd-8d8a-0cab3f6c3a4e", "value": 1072136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305780, "uuid": "2ef7d8d2-7407-4b4a-b272-3354740a2e8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305780, "uuid": "e9ef5161-1f42-416a-a8a1-d1b0e611c22f", "value": "87bfc21e2066c7ad2849cb46789fa7559f874ef64a628599012ff1b20bafe4dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d5eb8f-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327219, "uuid": "93fb8ecf-abde-46e3-ba36-12840e9ab600", "comment": "Malware payload (Mirai)", "value": "32b791220ceda0ec1eb23c52178f6b9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327219, "uuid": "47309f26-627e-4214-9bde-a41fa7ef20c6", "comment": "Malware payload (Mirai)", "value": "88270c533838b6bf17771dd3241b42a28a505e1c9c4e92e7d79b3827aa6d74f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327219, "uuid": "5e1fec47-7e72-40f4-80ab-03bc5c2676f5", "comment": "Malware payload (Mirai)", "value": "c080c3321aacf0f3d8005c20843e9dfd200abe5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327219, "uuid": "c290f21f-14b2-4740-9640-cc991edca579", "comment": "Malware payload (Mirai)", "value": "f3cbc5ba88fa38bbb3fae619f897b7745c33b3189bd1df4ebabb6cbc856eb7bbb900e09035e1faa2f7d12a219418b6ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327219, "uuid": "003206ab-e79f-469e-b6f5-025555b62e6b", "value": "T1B85301159E8D5EA5CFA05C79BC389642D344E77883BB18F0656006AC69C32576FF23C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327219, "uuid": "2708e1a0-dc63-430c-a9d8-91389db27b8c", "value": "1536:n/mkgpme1RlYcS9hp8g6wO1126UZO9CMLRzLjaIIDs6rofxYvaux:npSme1sT9hplso6UZO9PLRGIYs8oYaux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327219, "uuid": "90161b51-4004-4c20-83ea-7e179d26a263", "value": 65412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327219, "uuid": "01a464cb-2108-4e49-9f49-fa077df24d80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327219, "uuid": "378de061-d67e-4e65-9f3b-acc63db8d3c8", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f920c8-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770306408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306408, "uuid": "0210bc45-98c6-4e7b-ad17-2294940b741a", "comment": "Malware payload (PhantomStealer)", "value": "fa3d4ec8c6ad6e490efd8c737f15c887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306408, "uuid": "fc58d072-085c-48d6-b559-7f8fe157e3ff", "comment": "Malware payload (PhantomStealer)", "value": "8837e56e04d97a33067617fa59dd039f1e82f86bae8f23171aa77fce26bf49f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306408, "uuid": "ae279a2a-141d-4ba8-8098-8c9b618745e4", "comment": "Malware payload (PhantomStealer)", "value": "0569d1f35b374fda82862d9e06ee90bf1b577b2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306408, "uuid": "277e0e80-971f-48b0-a51a-f1644fa2bb13", "comment": "Malware payload (PhantomStealer)", "value": "7f239be3f0104a5da48a3e6453a984121af7ae85a04f1d7d8ecf3144b698d447a3d7cacec29bf867f99acc22cb3478ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306408, "uuid": "b2379c4a-68c0-4379-8937-9efd1cc1a8fa", "value": "T12965236433C9E812E59757B91970E7F052B49E8CB642DB03CFEABDDBBC1968138442D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306408, "uuid": "b1b60a51-0a54-4116-b2f9-73e3339c348f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306408, "uuid": "1f260937-a638-4569-b345-5e55aba29852", "value": "24576:lQTNLKlrRfGzOH8W3od0pTJjMhmFj3l/QWLzs9zi7MY6oTDyFPFVY1fy:lULKlrR09wnt3loazAzzuDyNVYRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306408, "uuid": "da19ac79-c426-4993-b171-192e69b310e4", "value": 1481728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306408, "uuid": "ea382b09-a17e-4cc0-99c9-10f37ae39fe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306408, "uuid": "a384cb35-e5c4-4127-9795-90133e49cbcc", "value": "8837e56e04d97a33067617fa59dd039f1e82f86bae8f23171aa77fce26bf49f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e4e071-023f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770260593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770260593, "uuid": "42048c97-797a-43a8-acb4-5270913cf24d", "comment": "Malware payload (Mirai)", "value": "6c7450aac479951d6443eb15dbb24dd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770260593, "uuid": "7b24f76e-e641-43c0-b848-79d743572e4b", "comment": "Malware payload (Mirai)", "value": "88615f7d7e2b67a28e5ec2a1ba6dfd302bec926f093b9efae9b341b452b63167", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770260593, "uuid": "f8567ef1-3adf-4ca3-a1ad-3126a4fec0b2", "comment": "Malware payload (Mirai)", "value": "b5b0fe7a3157c19dbec45532e13e2631bf24941b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770260593, "uuid": "5ff5b88b-5ea6-411f-8e6f-80105d84b104", "comment": "Malware payload (Mirai)", "value": "c64597cb12a4443345f3fb8a282208d9949c56e315c7e2733b280142f48de4db7fddb1b3e3b6d164a8518e82da1b515b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770260593, "uuid": "71679d7c-9337-4357-8443-6e8dbfed5c9c", "value": "T1A8D3128ABDF5CD98C653A4B4C2DE612C419D8285BC113B536F27AC8F6C806CD37667CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770260593, "uuid": "08b4d761-f56b-4b1c-92ca-93d03563dd2c", "value": "3072:ftiv4y0ou8LiS0cnghEvchl3kqvh5jIZcLEc2w5BrWmE7SHtLu:V4xM8oR6ch+ovLEcXFTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770260593, "uuid": "e287e0c9-35f8-4120-a4ae-36268955fe7c", "value": 141260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770260593, "uuid": "7f80d6c0-eec0-480d-82dc-3b133c59641e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770260593, "uuid": "eed487f3-c69c-495c-adeb-6842e77f8ff8", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b83626-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770306084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306084, "uuid": "9bc70e8b-3427-4936-be47-e8d94af3da8c", "comment": "Malware payload (PhantomStealer)", "value": "044d7f82cd5bcb1d6558da7ed2444789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306084, "uuid": "faf064da-efcd-43d8-b168-5a27b5e20c26", "comment": "Malware payload (PhantomStealer)", "value": "890a4a783b521c2b7ffefc20c599e8c000826f3af8e75f3c5d4ce9ce7b58e531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306084, "uuid": "a008a402-fa4b-4b49-b91d-3e377db6cd9f", "comment": "Malware payload (PhantomStealer)", "value": "ef9492e3b748b6ab4819688364cb8d10d6c309b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306084, "uuid": "c040e99c-4612-4d16-8ed7-a754340ad981", "comment": "Malware payload (PhantomStealer)", "value": "2ada8a2967f9b6ca75e216065ca3c09b5ff70de4d7f9972eef910572d6cf879dc8a2da800fd534f374ed77cffc91ab0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306084, "uuid": "84dc869a-c29a-4c76-9649-aeff35ae4119", "value": "T12B75E00273D1C062FF9B92334B56F6115BBC79260123B62F139819BABE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306084, "uuid": "0c16c28a-8891-462e-8f83-7fa5a96de73c", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306084, "uuid": "6995439d-4214-4777-8c1a-f01523844fae", "value": "49152:iPVt/LZeJbInQRazF+QlvLRsKwteA7cZWJrLl:ATYbInQUvLRVGpc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306084, "uuid": "50d36e3f-c269-4646-a33f-26dcb46e0f63", "value": 1669632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306084, "uuid": "9dd62384-4824-4908-9196-8dbb9b5d4b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306084, "uuid": "78fd9b60-b259-44af-b8cd-c0684b2523c9", "value": "890a4a783b521c2b7ffefc20c599e8c000826f3af8e75f3c5d4ce9ce7b58e531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99bcfa8-025f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770274638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274638, "uuid": "7661867b-cfb7-403b-9197-fbb2c77dfe96", "comment": "Malware payload (Mirai)", "value": "ca0855bd3777720032a4406432190011", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274638, "uuid": "5380e557-0cef-4ec2-8572-3275e7b4d58b", "comment": "Malware payload (Mirai)", "value": "891a251994596655e0a7237b5c933068feaf5c8ce00108f6b0c1f4a765b90080", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274638, "uuid": "d1f4383d-9035-4892-8905-9726b2adae6f", "comment": "Malware payload (Mirai)", "value": "2b0af1a2629fe2a27c5120ef1e042730e8862422", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770274638, "uuid": "e4b71195-e526-4bc6-9cbf-833f2a41aae4", "comment": "Malware payload (Mirai)", "value": "2774308f31bd4f42b780755f6f8bcfb1d02a40d8382db9bced7bf84d733ba5993e0363f3d2637a69117b784763e9631f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770274638, "uuid": "3e6ba82a-8952-4775-9b34-2f53dc36c4e3", "value": "T14D84096CF8809B79CBD0617AFAA502CD33375F68EBD9730589256B3437EBA25943B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770274638, "uuid": "27bd9596-fe5e-466d-997f-7ff9f047644f", "value": "6144:MQOiWnwsHaiXrygUvKsNFH9tztoZ7FX8ZzG0hDWHYIzc/nXLnISu/9jdN5PzvWcL:QiUXb9FX8ZI2nI3FJMjXiviwg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770274638, "uuid": "c47ecc49-3d10-4411-a51c-d9aa0e9c3f11", "value": 374656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770274638, "uuid": "36221dbb-e0ef-495d-a837-06c93c0bc21b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770274638, "uuid": "13dc8ff9-c515-40c1-a04a-515551cfeadd", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a362d7-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307963, "uuid": "fcecacb5-b10a-404f-b25b-c63f12d4dd63", "comment": "Malware payload", "value": "bd07f829975bdb3c7ab3b13795e6f5dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307963, "uuid": "94eab27d-6726-485e-9e8d-921deb847b6c", "comment": "Malware payload", "value": "8945e45c9a598d5db0cc08028a71047b405ee52edc8d641e86b33151323b8517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307963, "uuid": "5c3d8160-df1e-4b6d-bc32-474ddf132e10", "comment": "Malware payload", "value": "db0601caf7926b187fef7996e533d76770fa5990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307963, "uuid": "b5c67902-d39c-44f7-ad09-db42ee5a36d4", "comment": "Malware payload", "value": "8a00dac1fb6796dc998fabb58a13fbb9a8dfc9ac3f828e6c047c6113af7662ddee910c6705f676541f6835887e806826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307963, "uuid": "08b22485-ac8f-47e9-b588-e83bc7c5f428", "value": "T146740727E660B025F85385B13E78A65A34293D3A0681ED0BB78D9F4A3771983B4F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307963, "uuid": "bc24555b-8f99-495b-853a-3128756c0361", "value": "2785faab882abd24fc5c34a83e3dd70b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307963, "uuid": "37c91fc9-bd4c-4db7-85c9-6bc61c343161", "value": "6144:p0+NrYU5mD6dKrZkSXkEZBke7fqIZWnLe3AS4KV8Zw:p0Ab4kSXkEZBke7fJZWnLe3AS4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307963, "uuid": "bf3ae679-50e7-4666-ad6d-5755564583ec", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307963, "uuid": "4f6cc17f-d183-4ba0-b920-f1db337abeb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307963, "uuid": "8e582992-9d71-43ab-b35a-d9e3f3603ab3", "value": "8945e45c9a598d5db0cc08028a71047b405ee52edc8d641e86b33151323b8517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939a6b36-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770307995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307995, "uuid": "9e4400f8-8004-49c7-a484-5acab8f73b2e", "comment": "Malware payload (Formbook)", "value": "aab75a71f2eccccecfecbb7d2848575f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307995, "uuid": "3d3a9301-2645-4540-81f0-28f3ecbbabca", "comment": "Malware payload (Formbook)", "value": "894f8688e683bf9a25ed2b681d52334822290ce4fb106a248b3d2c4331a73868", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307995, "uuid": "e0f16aeb-111d-4515-944f-26cd55ad117b", "comment": "Malware payload (Formbook)", "value": "d1e18313d42c3e34d45828a7677f223b0619b07d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307995, "uuid": "b561c35f-ab5c-4080-b3d6-02a0307b95fd", "comment": "Malware payload (Formbook)", "value": "239b5067fb7c7a7a5c89ef862599f3bab47932dbf88829bbfedd5c47c4b7ac4431249b8d26236d967294c06ddbbd1fbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307995, "uuid": "6eedd48f-d0fb-47f1-a549-e8e9180fbe4c", "value": "T10F45CF0273D1C062FFAB91334B56F6115ABC79260123AA2F13981DB9FE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307995, "uuid": "63b27fad-bbdd-49c1-a434-191e9733d7af", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307995, "uuid": "a98ab965-5f83-4837-823e-6261d1ce60dd", "value": "24576:r5EmXFtKaL4/oFe5T9yyXYfP1ijXda80NbOHEWx:rPVt/LZeJbInQRa80Nqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307995, "uuid": "6cde6a3e-a13b-456e-b5d0-17c0dc823e52", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307995, "uuid": "94cf541f-0868-4d1e-acec-8c3e9ca19a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307995, "uuid": "ff3194ae-c463-4e01-8acd-44b99a203bc7", "value": "894f8688e683bf9a25ed2b681d52334822290ce4fb106a248b3d2c4331a73868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46cf3508-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306148, "uuid": "a2b3233d-d262-4d12-9bc9-e524648768b7", "comment": "Malware payload", "value": "76220156f22733ff1a35b5f07003943b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306148, "uuid": "130a75a3-04ea-4c85-9358-eefc5161d9e9", "comment": "Malware payload", "value": "898a9548cec32c42f8cfec593d17eb6bf8d735c36fe70d8ef9071217177f4604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306148, "uuid": "4c527afa-b72a-49ac-a193-67e2095a679a", "comment": "Malware payload", "value": "07f86bc7afd6cd55f8d4a92863b6849210a5908b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306148, "uuid": "3e923c57-fa8e-4522-b27d-03402fa2c58f", "comment": "Malware payload", "value": "ac3fadb6dc6e4b254a9beda5dc7ba0190dc0aaaf1aea18803207dcc6643c070d43335993fec1f1a0fb05a81b0a6cd7a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306148, "uuid": "9266b436-6ded-40b4-8561-5b6a1d18f829", "value": "T122247A67A42CA7AFDEDA2F32ADDE8A2353A65FC4C991103E0C44730E3C671095E39566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306148, "uuid": "25e270f0-2191-4a66-acd9-f5b356a094ba", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306148, "uuid": "792eca9f-68be-4501-ab2f-f4d1f9390074", "value": "6144:jynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g3o:unO56dyO7Wc8oNrRHwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306148, "uuid": "f4541345-ad20-42b4-a765-27235f92a672", "value": 227673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306148, "uuid": "3009c38d-82c8-48a0-82c3-0ab1f7459586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306148, "uuid": "64a7e305-8fbe-4912-b67d-50bec15000d7", "value": "898a9548cec32c42f8cfec593d17eb6bf8d735c36fe70d8ef9071217177f4604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ca9efa-026d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770280346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280346, "uuid": "aeae9543-7651-44ed-9c06-0ad538c291fb", "comment": "Malware payload", "value": "7c2d27545cead83ad8f12b09cf294245", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280346, "uuid": "f9ebcc79-0d07-4167-9b4e-34d69a0c4ca5", "comment": "Malware payload", "value": "89948158f21be9b90a2ebd726bd89a6a3212ecc2751145bd673e1975d1b3ceb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280346, "uuid": "9b2c1945-0c83-45b4-bb75-f55003f5221e", "comment": "Malware payload", "value": "35a9a48c2111ebf1db9d2b119048cfe27185a6dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280346, "uuid": "d6b715f9-7987-4513-9a1f-9e2757142139", "comment": "Malware payload", "value": "703c95b8d9262bcc2e88861f4790c0544ffdbcf03b467071ac8e1504453f129bf4034b7870a0570211000148991645cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280346, "uuid": "a69ef012-8eb8-46d5-9a19-82e3ecf37423", "value": "T110F4F97F5962913ADA8A80FC255947625971B33B03B41FF301669130271BAB2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280346, "uuid": "22177944-e3f9-46e4-af4f-162c97e9f241", "value": "12288:68HmItRFFHxLc1BAMjPdKoI8asoPs3gF949tE17jDDmqtn1nWk:6mmA9hMjPFPgKtMnDb1nWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280346, "uuid": "068ad203-549f-456b-a5c3-6e7a1374ed50", "value": 733299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280346, "uuid": "a9f35547-4733-4114-8730-1cd160fb39b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280346, "uuid": "8867f608-4e09-441f-9ffe-8658bfde0e9e", "value": "chacu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e479a4-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306091, "uuid": "7ac9701d-7ee1-4adb-933e-631bca494275", "comment": "Malware payload", "value": "b476b3ea1c0b013744a3bd1efdfa9a53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306091, "uuid": "0c7248e9-811d-46e2-8b23-c330a1ded1a4", "comment": "Malware payload", "value": "899ac556033080b41b4bf64c9e848841b027d413c16876feaca602dabd393a08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306091, "uuid": "dfc54ab8-7353-4283-92bf-5d7f04dad497", "comment": "Malware payload", "value": "9146006fb14f5d8ecf35e603c3c40706827c4280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306091, "uuid": "0dcaccfe-801c-4824-aef2-44189102f1f9", "comment": "Malware payload", "value": "13ceaddc7f6a60a820abc5941f5bb458d5a8c066f4831b962ed78bb3e372a81038252ec69ad4aeccad9a9ba8dcc81825", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306091, "uuid": "82243a90-9c62-48d8-a097-0539486caa6a", "value": "T1D2247A67A42CA79FDEDA2F32ADDE8A3353A65FC4CA91103E0C14730E3C671095E39656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306091, "uuid": "bb08e819-8dd7-47cb-b3b7-a761586218ec", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306091, "uuid": "f50d848a-7cf5-4884-ba9f-76029f3133b7", "value": "6144:kynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g3K:/nO56dyO7Wc8oNrRHwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306091, "uuid": "1d316e0f-ccaf-4922-bf5a-541378729dd3", "value": 226146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306091, "uuid": "7f2d79c1-02ec-414a-8682-4b4308002094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306091, "uuid": "031ccfb3-20f5-4c11-8a17-6b41e505e904", "value": "899ac556033080b41b4bf64c9e848841b027d413c16876feaca602dabd393a08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b796c2c4-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770307626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307626, "uuid": "a5511fe4-a880-4902-a04d-9d4d8135da82", "comment": "Malware payload (GCleaner)", "value": "35d551f8e746cd33cf4ba606b6b86076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307626, "uuid": "dd675ca6-8e04-45d5-90d0-b8088ec454ec", "comment": "Malware payload (GCleaner)", "value": "89bc5d49ecda527366b922e802109c9539d80eb8655303880db838c93867500b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307626, "uuid": "5b67f23b-0315-4bbb-a5c6-00091c69697c", "comment": "Malware payload (GCleaner)", "value": "d3bd02244d66e60b4d209a0caff855617bfd4b87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307626, "uuid": "bde5d1f6-2fb4-42fb-9726-5194bbe296a9", "comment": "Malware payload (GCleaner)", "value": "ce6f30ea5124d5f05879eea374d9067a2bb0d126afcdc458a82a4d33c6b565c96e2defefe20764c10971aafb1f2eb198", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307626, "uuid": "72e0f7c9-38e2-42cd-b93e-b4e088ecd4d7", "value": "T115F48E22F9B28033E0331A799C6BA66C74367D102978984A37D93DCB0B767417526FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307626, "uuid": "8b2ad10f-e986-494e-acd4-c64e28ba5f05", "value": "421f57ebeade5946b16f0c3c541d2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307626, "uuid": "a1200285-9eb0-4e50-8718-e7bf5c2b32af", "value": "12288:Y9eONBtJzhKJd6EPXNQyxbLSopZD70mgr1kzhI5kwmYbgG:inzz04EGOzDDopWNI5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307626, "uuid": "bfa2183d-273e-4a24-8ffb-ae9d05a2d867", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307626, "uuid": "3af03de9-3062-4d1d-ae35-b86de757ec9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307626, "uuid": "b0a4238c-2c89-43c4-9e3c-c5c73ce9f2b2", "value": "89bc5d49ecda527366b922e802109c9539d80eb8655303880db838c93867500b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e200eb-029d-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770300936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300936, "uuid": "60d20628-b263-4fa5-8237-73648d108475", "comment": "Malware payload (SalatStealer)", "value": "8332ca5ce1efe6830982d2384d4440e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300936, "uuid": "0a762b97-8188-4aab-9cf8-715ea9dfb0e9", "comment": "Malware payload (SalatStealer)", "value": "89f0bfbf3c14dedb75b169d42516bb1d01a36ae8309afa8723f5a91e609a774e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300936, "uuid": "918542ca-5c20-41fa-a2f7-ad8f58d1ba70", "comment": "Malware payload (SalatStealer)", "value": "224d39c196e609af91b69843b25015b09efe17e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300936, "uuid": "249eaf0f-8d5c-4ff3-b46b-0cf3e16b1df9", "comment": "Malware payload (SalatStealer)", "value": "0b35327a9d76a89d2d34239196ef5a6bc89bbcc65954f191637bb6da6460c61cc0ee0537fa87c3ec2ddeb4af95bb3bca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300936, "uuid": "7a6573d7-8bd9-45b4-9b60-d16ca7ae6047", "value": "T12CC65B01FA8B98F5E9031835416BB23F63355D048B28DBEBFB543F6AFC7B6811966205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300936, "uuid": "0d2379c3-cff7-4e54-938e-c42a53c951c5", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300936, "uuid": "93ee48de-bda5-4a5d-b3b3-f6ba2d4f787c", "value": "49152:GOQHA+9gZmPRsxBUdXo045UFcVvcoca1MEQiuv9f1NJaB+bJQwvRyN4nGmM7oeT1:5sA+9Zsdnkv9paByyaRAW3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770300936, "uuid": "8632f164-dafc-4230-8650-15e5bab32746", "value": 11671040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770300936, "uuid": "836b1800-7e78-4606-a219-b8c4691275d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300936, "uuid": "9b12b4ed-eb59-47b3-875d-5dae35c03b44", "value": "fontdrvhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772cf2d6-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770307088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307088, "uuid": "069dc7e2-3e1c-4257-a69b-f8d8db8e7954", "comment": "Malware payload (GuLoader)", "value": "e4a206b5122ff8e12aea36a46437a0ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307088, "uuid": "6dcb51d6-9669-4926-9a34-006852e8295e", "comment": "Malware payload (GuLoader)", "value": "8a41eb98178ca2b5158c079616022de80ff2335b5cdbc7ca856bac72324eb17e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307088, "uuid": "24f916db-ec50-48fc-87c8-06d6e171f0f4", "comment": "Malware payload (GuLoader)", "value": "636f24e54f8005eca72719e2de37bec21f1fedcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307088, "uuid": "ccb8bb44-e9a4-44ab-8573-8c7d3d369a2d", "comment": "Malware payload (GuLoader)", "value": "e2c9b89b3f0aed6f6e48e59fca1ef23753ecee7ff344386f7958d624946eef8315c962056fa566b8a4a3d7ab83b7bd7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307088, "uuid": "f2db8647-1f80-40a0-9206-48e1c0be0291", "value": "T11DA4BFB9FE18D4D1D01553B43836A835FB29DF16E4B8422FB9B9761918322CB642BD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307088, "uuid": "f52940e4-1dc6-455a-bdbe-5da32b13bf0b", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307088, "uuid": "7c23e960-99a9-4e1b-87bb-44f089d81c44", "value": "12288:PMwtn90cUBQ2L2WUL67pw5RDuQ36PUJ9jXTj:PMwP/UB7L2WJpmRyQ36sbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307088, "uuid": "c0baef09-46ec-4df3-9075-f595e7248d34", "value": 449336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307088, "uuid": "60ae541e-d3f3-41f0-80bb-cac66a647496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307088, "uuid": "af47f6b1-32e8-4773-a461-0ad13507355d", "value": "8a41eb98178ca2b5158c079616022de80ff2335b5cdbc7ca856bac72324eb17e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c2a3d8-02cc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770321311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770321311, "uuid": "2b909879-a6e4-4fb3-b90d-8847d000244b", "comment": "Malware payload", "value": "33dc471a0df359c69964e8d6d36d6fa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770321311, "uuid": "50aecb63-0304-443e-a6b5-e2dc5683e6fb", "comment": "Malware payload", "value": "8aa79abe278f2d1b6d97b5a297db83a834e68678fa2072f90b4d11669284027a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770321311, "uuid": "5d5a460c-9938-484a-98ef-5f4d095f14a1", "comment": "Malware payload", "value": "ba29551bf89b0eb4a815ff5120a23cbe10abd492", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770321311, "uuid": "e2e80045-0ee5-4a81-8cfa-c3e885aab437", "comment": "Malware payload", "value": "9dccca4c8ef348397992db18885d58a8ddfd134839cb80d761f41d86da5184265925ef712c96f2296a9b2746dd863c87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770321311, "uuid": "1628a60a-1186-48ed-a573-cc01386cfda8", "value": "T17ED50127F66264ACE56BC034478E81B2DB2AB46902267B3B7BD496303F38C655F1D713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770321311, "uuid": "2dd281a1-9b30-484a-9dd7-c65b9357d3f4", "value": "49152:eED0nUUfDrm9TYWxFm5NNUgn1A5JUMt6oE5/p7SEi3+/xQaSk25s3nvLFvh4:eEWm9MYUvmMy5qUVkf3xQa52+3zFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770321311, "uuid": "8e732ec2-f8b8-4cbe-bcd4-3af514a9a7bd", "value": 2765512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770321311, "uuid": "7d132d6c-e312-4aed-98ab-80b657bc5543", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770321311, "uuid": "d61134aa-d97f-4d1b-b8fe-2235bbde3193", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524ab152-02d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770326783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326783, "uuid": "9874138b-0f19-43df-b2a7-8048681e0925", "comment": "Malware payload (Gafgyt)", "value": "8096643cb28771eac8c40be26cf07bbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326783, "uuid": "eb63e758-1039-4559-8663-e1748dc72119", "comment": "Malware payload (Gafgyt)", "value": "8ad1cab84108ddae5f6c9f93fded9e17029bb9615668710e83924c12c7336c8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326783, "uuid": "3155b227-234d-4b0f-bb18-222d3c546a36", "comment": "Malware payload (Gafgyt)", "value": "31f88aa6ece503b034a094b9b610f07c38809eaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326783, "uuid": "ed2cb892-deab-4224-8cec-98a251c6c273", "comment": "Malware payload (Gafgyt)", "value": "5aa4a795c474904b08c1754ae0ed15878a606d5944e6ab34560db0ea03a02b42cd7bb08a14127127230b02f3760aed94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326783, "uuid": "847a9962-73e6-4a4e-abc6-96fb6acb024b", "value": "T1E0C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326783, "uuid": "392e0a06-995c-43d7-a7ea-2215c22076f8", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeeEdWfRZrmW+IFj:Ted0W0MZQHAd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770326783, "uuid": "8069d1b5-b7f0-467a-a4fa-141c497d758f", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770326783, "uuid": "3eb6f3e6-04a4-400e-a3a1-9160862fbf01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326783, "uuid": "d936591d-8571-4130-997f-3c057e9fa918", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11d8d72-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305897, "uuid": "8aa318b8-18d3-42ae-8907-3e9f7eda0883", "comment": "Malware payload", "value": "bdb3e666bc91eab29770512597393a42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305897, "uuid": "9b3b6bef-74ca-439e-9c6a-029f2ab3cada", "comment": "Malware payload", "value": "8ad5c2664f72764ee8f9cbbb4223a97f43df295512f2cb4367639f517b185ca3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305897, "uuid": "ed8423a7-1062-4bab-86c0-a93d359fba15", "comment": "Malware payload", "value": "fe67bc799a47b4dfc058270fd1b5f05510b1d111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305897, "uuid": "abbdd4ad-2b5f-48f6-9368-3014f09527c7", "comment": "Malware payload", "value": "6d90e1c57b2d3d3eaabc4c66046189533495c742f5dd24e2158d76eca99013e9f5b7d2224590ad40c1a7412adbed04f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305897, "uuid": "3ff7f59b-c061-4452-8e81-9e1bafb09eb3", "value": "T15FE6339877A90CDBC89EE23E52E4434B56E274E60398D6CB57F10C420EA73E6DE35B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305897, "uuid": "381ffdac-0289-4c52-aef4-170df4f6f1e9", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305897, "uuid": "53655c20-777a-431f-b03e-6b1f97f775bc", "value": "393216:+jW8W563hucw1+TtIiF4uARuA3dS9QVr0EDo:yW8W83hrw1QtI1uAHsMr0ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305897, "uuid": "737bf253-9d47-4a9a-b421-0809bf469afa", "value": 14861864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305897, "uuid": "607019eb-4deb-4cf6-b5f3-83ef7d7897ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305897, "uuid": "a198c928-f045-40dd-bc53-359a4eb4c606", "value": "AutoSend_v1.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9929c525-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303709, "uuid": "a35012be-c1a5-4206-8bc1-13fd2fc40a2c", "comment": "Malware payload (AgentTesla)", "value": "8d67a68ed0e183dee8f49d454f595dc5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303709, "uuid": "0338ba5b-70d7-4d31-a1a7-23841655d82d", "comment": "Malware payload (AgentTesla)", "value": "8ae45c720a8a11d0e93820faaa0269483025b685c4626fb22f39797c70ea0af8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303709, "uuid": "ce5966aa-b9c0-43e3-ba16-fd3feed3d739", "comment": "Malware payload (AgentTesla)", "value": "3786ecceec845035f66df91cdc484240f6fa1150", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303709, "uuid": "ff4bd605-1c23-461f-b327-dead534639c6", "comment": "Malware payload (AgentTesla)", "value": "3031856e842e313491f689c70314f7b9be1afa379e00652f890f20d797efe318ce540ade83630f9ca356d58cca1065f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303709, "uuid": "3e357e8f-065d-47e6-b588-854e47fe9909", "value": "T1EC35AE0273D1C062FFAB91334B5AF6115BBC79660123A62F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303709, "uuid": "69c30615-0eab-4db6-a285-0f0c61adedc6", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303709, "uuid": "a409e353-fa0a-42fa-ab6e-4929fccfd8eb", "value": "24576:N5EmXFtKaL4/oFe5T9yyXYfP1MAXDzv7s8efs+:NPVt/LZeJbInGizvQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303709, "uuid": "acbe6f4b-8297-416c-873e-1cbebe9aa4dd", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303709, "uuid": "1ad8254d-2871-4f68-9719-bc02556768ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303709, "uuid": "7761adad-dee0-425b-8646-9e8d1e04d2fd", "value": "8e49bc5255e6e01b5d5fa898271ee60b2616ede84ec2c2f6cec2377b431c0866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59ad98b-026b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770279786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279786, "uuid": "177c4f9f-5ecd-42b8-a0da-a5635d902ca8", "comment": "Malware payload", "value": "6e706f60e8419120df12ff8616a42165", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279786, "uuid": "4cf1b3ae-b6f3-45bf-8238-6fc3a40018f3", "comment": "Malware payload", "value": "8aeac8512abd4b8ad00448924d05364448c3fe7dcf00917cdad8dd3f3fc79680", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279786, "uuid": "f94065e2-36ab-419f-b79d-786e6041640e", "comment": "Malware payload", "value": "016d9051d5a3c91e10bd7fcf6d13394edf81e387", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279786, "uuid": "311aef8c-c9ed-46f2-9f1b-980abeac494b", "comment": "Malware payload", "value": "fc4368c6e3641e540b0f0addede429d26be72fdf3633d135cb2000c4f27fd25e6280f0c88450e27f36abf815ac608d5a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279786, "uuid": "35ffff5c-cd84-4d4c-aca0-c60a08957d0c", "value": "T102E2C65BB3509331D48203314A6FC7E5AF35AC489F63521632AAF30D6E72DD017A7AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279786, "uuid": "112f07d9-cba7-47b6-8ce8-6cffe219e52f", "value": "384:RzY+DXK4NTToW331XFFMibizV1XFFM6ztcq5ICr:hFKonhVQz56qmCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770279786, "uuid": "320ad45b-10d3-4210-9e5b-244545acf9e4", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770279786, "uuid": "072f4d82-d19c-4b47-99e4-1875b4f468f1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279786, "uuid": "11295fad-ac15-4db0-a128-48277e7e0f58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124b1e6e-02b1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770309496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309496, "uuid": "eaca8909-4bf5-4a39-b889-8f464b98b739", "comment": "Malware payload (Mirai)", "value": "7ba5a1f574817eb35e7731e7b09d39e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309496, "uuid": "9331fb7e-7680-47a8-9566-f58c10a703c2", "comment": "Malware payload (Mirai)", "value": "8afdd65b1a5d033eb3bfc1b29fc2c1ef6b78a6902088db6c6da728969c2ff668", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309496, "uuid": "b8cc2dbc-4b87-46b1-aa34-a2e681ea8f7f", "comment": "Malware payload (Mirai)", "value": "a9aa2da69667bc644f0357545a69313949e639fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309496, "uuid": "b479729b-409b-46b3-80a8-f4d9b87fed2c", "comment": "Malware payload (Mirai)", "value": "7c20eb3a60cc20f434fce6a7b5fe5e5da9b2f74b44af175d881ccba4fe6a6d37a101ae9a0f26a5d5a2f5a40cb3dc0662", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309496, "uuid": "84817372-647f-4bd0-8698-545aeee7ec2c", "value": "T12C54F75CF8809B79CBD0617AFA5642DD33334F64EBDA320589356B3437EAB25A43B241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309496, "uuid": "f2963fc0-4e56-4a7b-b98a-7a75aa415cc9", "value": "6144:EtcuY/tajcYKzIrrAGJU9r0dGZtum8YiNvrcYj6nIT9j+WXeEh+BL63EM45JS03k:Rf/pum8Y0JXRQd5Qqdo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770309496, "uuid": "a1ee9b30-32dc-4725-a0d5-2f782d3f6319", "value": 300008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770309496, "uuid": "55f27faa-74ae-4f60-b115-a21020202c1c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309496, "uuid": "b234a41d-1953-48b8-bef1-6b4ec3513db8", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20f1894-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307670, "uuid": "d06214ee-be91-41dd-a9bd-6e1495f2fb6c", "comment": "Malware payload", "value": "ddd09d82588cec93e7b22a96ba677200", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307670, "uuid": "35a9a498-9a43-4d28-bf83-19bd9ea20f4f", "comment": "Malware payload", "value": "8b25ad72ad7ca85b32fb71e4ba29b8000a26e6c595b304e6783e201808bff63a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307670, "uuid": "4924c371-e13e-4459-bab6-1678a2808e44", "comment": "Malware payload", "value": "50200d77c19eedc328b462491b92d958cea60fbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307670, "uuid": "2e5b54f8-f03f-41b2-b317-4628649c9e6c", "comment": "Malware payload", "value": "344da40601961f3c8eb8683a95527dd69037ebf00d27a81c9b1cfc1e706f7143164b7e6afaf240f6f633d93c1bcbcc27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307670, "uuid": "0a4cecde-d0d1-4cdf-8e8e-bbb18cd25a76", "value": "T1568633097586DBB1D5EBE23A5FF19BA2DB3E243087B405CB398917770A796F292310C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307670, "uuid": "ce4908a5-bdb7-45ec-bcb0-072ced1327a6", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307670, "uuid": "082ebca9-64b8-4cbb-b2e9-7f3b6f94681e", "value": "196608:xnrgI0mgDUXNGDEPmJ7+vZIQ+KlN4/rbxcKWD53O:xgI6DGPu1+hl7liGKWDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307670, "uuid": "877ef5b8-2c88-4faa-b333-397580f65b00", "value": 8527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307670, "uuid": "b1ce916a-a8cb-4a31-b86f-b8a5a2115b3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307670, "uuid": "40541d64-4eb6-4a86-9958-fb36ed98edac", "value": "8b25ad72ad7ca85b32fb71e4ba29b8000a26e6c595b304e6783e201808bff63a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873c329d-0286-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770291224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770291224, "uuid": "8353bcfd-bf34-4c5b-b09c-12cf18edb8dd", "comment": "Malware payload", "value": "5bc224eaf5661bebf3f744fed6be10e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770291224, "uuid": "d66ac5c2-4d99-49bc-9d53-993e3ad3db30", "comment": "Malware payload", "value": "8b347c04c943cfac1356bc1d46786eced4071c2b879a6057bf2713f2938bec8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770291224, "uuid": "cf2c2572-5089-444a-9745-3e415d75cfb3", "comment": "Malware payload", "value": "42f624902ecca0a0cb4372f3afded238db82e663", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770291224, "uuid": "fa6b3967-c349-4a8c-a26d-0f87ad3124ec", "comment": "Malware payload", "value": "dc73e3ab414875601b1698c50e54c2345b389b3fcdbca2e7347301730837b4a3eda95195d33763d52b15814f8517b89b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770291224, "uuid": "5d7f51cf-4636-4b64-8b98-134a6bbd42ad", "value": "T18DF76B4267EA05D5F9F79A349AE65213D673BC066F3081CF324C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770291224, "uuid": "6529c79a-16b7-46ee-a516-9ed0a12ffe64", "value": "c26e33877abaa94e37e0b8ae3c8d27f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770291224, "uuid": "2ccec537-41bb-439e-bae8-c4c258759efb", "value": "393216:/fUJsRJDQVZpWWWrGc/d0ULRRQcKPxeUSp3LJpbRQSI8wxSvDazn1N5VRoEY7Smx:/fvTRQtRe5+asRv/UpgPVlcmTMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770291224, "uuid": "5a5a6b15-dd8b-4bb4-a664-3ccc92faa6ce", "value": 72877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770291224, "uuid": "097ed630-0d64-4a08-844a-82870a758e80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770291224, "uuid": "e9e53d58-24af-4aad-b2ef-c4c1c4fd87e5", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31be52c3-02ae-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770308260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308260, "uuid": "75ff7fd7-24ec-4025-9793-1b34b8a26805", "comment": "Malware payload (GCleaner)", "value": "983a49dc1cfecc605020bc0de27eb71c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308260, "uuid": "7eb72374-4e06-40de-b520-756290601f43", "comment": "Malware payload (GCleaner)", "value": "8bd7fcd9115369fa29ab166fdb76163348e6aa0a4a88d74add67af936337bbc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308260, "uuid": "805b7f49-a1d1-433c-bd83-69d4d8f6a933", "comment": "Malware payload (GCleaner)", "value": "73c394ff5104f5a5a3f748f8929b5f39f05f71f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308260, "uuid": "097e8257-f688-4e9d-b549-28e631f336e4", "comment": "Malware payload (GCleaner)", "value": "38ec2e73f2b698f1ce50a93cb979053065d312c060aa9d7d668c7c6bce17e58ce636cbb284cea63650ebb398a1d5c84f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308260, "uuid": "0d0fa029-a7dd-4f5c-a342-77a6aa43aa89", "value": "T1E9E47D2DF19084B3D3B21E38DD17626DDB29BD803924687A27E81DCD9FB57813626393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308260, "uuid": "22516157-ab88-4c9e-90ad-adecfb146222", "value": "07f608b4818de60660a6d587f85c6c18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308260, "uuid": "510d44eb-d48d-4f1a-a108-da9c612e8d1e", "value": "12288:JTYcy8yZ08zaVh6E3DXDr1focTOAuZyywpA:JspV/YdD1focT5cyyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308260, "uuid": "93348a05-4f7e-4fee-848d-50262a1bca16", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308260, "uuid": "358ca125-16aa-4f64-a4b4-22c71c46f8dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308260, "uuid": "03d52467-bd47-402b-aad4-b73b7161e6f4", "value": "8bd7fcd9115369fa29ab166fdb76163348e6aa0a4a88d74add67af936337bbc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177a716d-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305210, "uuid": "efc53dde-63ec-423b-bdc3-89958c4c3812", "comment": "Malware payload", "value": "9d0a67fe99f31d749e34e5ee8d6a3aca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305210, "uuid": "1702caf5-0c89-4cea-ae6e-07f11045a55c", "comment": "Malware payload", "value": "8cd02e11c631fd1869bb48c7c451a43f167e85c6fc32349f5cbb74270e30b2f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305210, "uuid": "2bec897a-11a1-4b5b-a63c-5c70034be0a8", "comment": "Malware payload", "value": "56a99e0c850ce820f9bc6ea321a5a9b9b736af76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305210, "uuid": "48253528-3830-494c-acd4-7c5a271616cb", "comment": "Malware payload", "value": "d13f3dd6715582b1bcf638770c1be9dcce574bdd52140fa04b6f7ce1bfe4bb81a71862a2a8eb897c704f14a82a14e04a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305210, "uuid": "3a830a05-0355-419d-9d54-31b1e7f50263", "value": "T1D8187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305210, "uuid": "6f405b2b-9b38-45fe-8b2f-64db2eac891f", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305210, "uuid": "57fa3f57-ac40-4d42-b7c7-2edc7f8c9ba4", "value": "786432:zAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:zAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305210, "uuid": "deaf7727-e9e6-4d09-8535-c3b3ddd24533", "value": 90437632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305210, "uuid": "86b14a88-1b87-4424-a60a-bf54313ea155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305210, "uuid": "db3dff61-2e06-42f9-b711-f66b29bfce8d", "value": "8cd02e11c631fd1869bb48c7c451a43f167e85c6fc32349f5cbb74270e30b2f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653eacc9-02e8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770333257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333257, "uuid": "c91bdeef-0d43-47ca-a5f3-93e6c89e6373", "comment": "Malware payload (Mirai)", "value": "0232a6e2af25ed5fe7d7c433a5bface9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333257, "uuid": "d9887449-2ffe-4aca-b84b-70775977f2d4", "comment": "Malware payload (Mirai)", "value": "8d4af5844d151bb37bb6bcd981b2c2e89156488a8df626b6e8d4561db9710c3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333257, "uuid": "745db1fe-b8ac-44b7-8324-b4919d019fb4", "comment": "Malware payload (Mirai)", "value": "4d231277588d61b01f8bc00281231154535284d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770333257, "uuid": "c5f8f38f-8d42-4ad4-9065-eb7693f5fbd8", "comment": "Malware payload (Mirai)", "value": "0a21b0be8648477dea8a2cb9e2a517feb5d6f9c52b6a3760747d77116bbe57dfdb9e18f0e1f1bf71b5d72bb766b7a8c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333257, "uuid": "c7d90497-289d-4f75-acfa-2b9e6bc9eae7", "value": "T10D83C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333257, "uuid": "6e817dd2-f905-4adc-be5b-e9c0e6f78837", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoAxgR:x/8RHTgMcJ0fmqJZOpkM/aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770333257, "uuid": "c27904ff-c940-41e1-88ba-c25fee84ec3c", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770333257, "uuid": "849666fb-d658-4bd1-9aeb-3d8ca06dd0a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770333257, "uuid": "54405848-fd04-4341-b0b6-e6c6b3210f8c", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876b6139-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770304109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304109, "uuid": "3660efe8-a393-49fb-b0a9-6440dee1f534", "comment": "Malware payload (RemcosRAT)", "value": "4401b4527228d2a44fd3cbd90d23dee0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304109, "uuid": "83b56318-c12d-411a-b004-982a5d05cba8", "comment": "Malware payload (RemcosRAT)", "value": "8dbb11fd5f8312929932c6821319910ffff73f05fa5f5e19d2015f31d66b3a72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304109, "uuid": "323881f9-21b9-4655-83c0-ebb8e710c865", "comment": "Malware payload (RemcosRAT)", "value": "4bdf422fb26722db53838b3fcb439752dfa0c4f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304109, "uuid": "1903090c-fd28-4121-afc8-41cdae712947", "comment": "Malware payload (RemcosRAT)", "value": "591950970999255dbe5583bee48541f679ec55d3f7c2f6451472c784f6ad8cbbc49aaf5e0e8dfd88a808ef48cad2c0f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304109, "uuid": "4171f1c2-89c0-4295-b125-f6ee40ad9d7e", "value": "T194A40263B786DCD3EA5108B248F1ABE022F16FA14951054B7665FB7A2C323C7D9079CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304109, "uuid": "472be3ea-8c5e-4e4b-b9d9-1dae4216b6a5", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304109, "uuid": "7ce0c0d7-c322-4925-a023-a93e8d2ae620", "value": "6144:H6dQC6a5KqBFfFFM6FSi24RlblYji/snzWdjmPpVV+Jgu:WNBFfot4Yxad6PziP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304109, "uuid": "3db3dee6-5755-48fc-a4d0-9cb8930f0865", "value": 449424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304109, "uuid": "e901c72e-48ad-402f-b2ea-fe9f5d33b4ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304109, "uuid": "b625a517-d68a-429e-a457-b0c4ef17ddd2", "value": "8dbb11fd5f8312929932c6821319910ffff73f05fa5f5e19d2015f31d66b3a72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25662c6a-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770303515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303515, "uuid": "6f54903a-6262-4a94-814a-8876ff0a655b", "comment": "Malware payload", "value": "802095205fbcf8156d8eb44f640f9ed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303515, "uuid": "c5d9e9a1-99ea-4b15-985f-72588d28aa4b", "comment": "Malware payload", "value": "8dc0327f4ce514126c41ec3d9243acc9ce79648e0aa41435acd7ceb1d83f2292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303515, "uuid": "a2aa81e3-2a8a-4865-9407-3dc18318dea5", "comment": "Malware payload", "value": "8338c301a664fc43711cc8a15064bf28cfcbbdd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303515, "uuid": "0b25b096-b41c-4aca-99b3-188b084cac95", "comment": "Malware payload", "value": "9bb5439c42781872d8181da4b748a71a996ed136d5bd497b5894684a4af8825e922c5512c9320832c985bbbad62ab2b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303515, "uuid": "ac82ffcc-165d-43a7-baba-e56231ca7766", "value": "T118E402946A98DF05E2BA17F225B0E33147727D9F6971E20E8EC66CDB3025F116DA0363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303515, "uuid": "17293186-e3fc-4935-bef8-c1993950d453", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303515, "uuid": "1f37b3eb-fa88-47f2-a806-4d78e44abc55", "value": "12288:PpYaKt2RMyC8zSfz95qxjpbpfeepLCcs6vaF1/NBm2A1hHWBP+1DFxRFIkCDSdb:SfkS7PGpbZscsF+tWBGDXjBCDSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303515, "uuid": "85cb4d1d-869c-4fc7-b485-6c4e7215db14", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303515, "uuid": "a22ada1f-40e7-4151-b7a3-fd319a3beecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303515, "uuid": "32b2a00b-00e1-4df0-aefa-eb5b0359ad93", "value": "8dc0327f4ce514126c41ec3d9243acc9ce79648e0aa41435acd7ceb1d83f2292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81316c97-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307535, "uuid": "a2904354-de6e-4fcc-a595-29f6af2fb3cb", "comment": "Malware payload", "value": "231f35d754dcd39cee6e63123a29b38a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307535, "uuid": "fae6287a-df91-45cb-b4cf-9d4edabe00d4", "comment": "Malware payload", "value": "8ddf082a0d873e027aff8444ccf6bf4bdc6f325db2264cf84975a69986a25508", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307535, "uuid": "36c1f862-5c22-455f-81f0-f8d6e60c6c07", "comment": "Malware payload", "value": "005394abd2a61cd46a0f2510284dfb168d37e7de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307535, "uuid": "04838090-2a9d-4869-9869-5b2741ca80db", "comment": "Malware payload", "value": "2c8a967edf4ef77bfa76dc588b6f45e5b4dd7fab0e1f80c2f079eea286cde713720e860d5a0c3d82ede6ff9ffd105e67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307535, "uuid": "a6de22d2-7873-4c62-9150-a2bcf67645e4", "value": "T15145BF0273C1D062FFAB92734F56F6115BBC79260123A62F139819BAF9701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307535, "uuid": "92b526b9-8021-48ef-80f6-27ad7acbc249", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307535, "uuid": "0d3e9fc8-e0c8-4159-b838-283b792b7db3", "value": "24576:t5EmXFtKaL4/oFe5T9yyXYfP1MAXDzXGB5cIX1Ne4jVs+:tPVt/LZeJbInGizXm5mmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307535, "uuid": "108bf558-9a12-470a-a8af-219397f80c5f", "value": 1254912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307535, "uuid": "18710507-8a4b-4b06-b58b-3f227a0c102c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307535, "uuid": "b9829d84-d96a-476c-93b1-901a17192f2a", "value": "5da07462a347ae9bd580a35637af7ae16c7120970b1ca13bfb0516b07f8c8b09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6b7989-0226-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770249999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770249999, "uuid": "09fd6759-1c1f-4511-b276-6e2ef6f96c9b", "comment": "Malware payload", "value": "cb6d942cfb0e7216d56031e7ab9da3a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770249999, "uuid": "09461b5b-67b7-4a95-8a14-09db24eb36a5", "comment": "Malware payload", "value": "8e17045440eca602af6fd5a4ab08e915e473c8253fbcfc9be2edcebd47f575c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770249999, "uuid": "d0df1dc3-00df-4e7c-a240-9c25db17d022", "comment": "Malware payload", "value": "8ad111a78e07e641b317e90698d20b8fc026a9e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770249999, "uuid": "9b868a73-3d44-45d5-95c5-96a1de564688", "comment": "Malware payload", "value": "a3b1637da1e7fdccdb203486e83f5fd4f5e0a53a86cf77e53faf7eea302ea92c47e9507d19b3ccc937144a760000e1a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770249999, "uuid": "ee9d9ff6-b418-4309-bc8d-83f4ba77a139", "value": "T1A09423B3287E09F9FCAA6651F0C24DBAF32837D8B9C6C4DC467A5345581CAB34C650B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770249999, "uuid": "eaa08696-0117-4aff-9216-58213e63d8bd", "value": "12288:SI74X9cHbU1yzmsWQlvTed1up3903TPrlH9L8dtIjsk:SaoS7U1yzGQhoupe3rpdgKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770249999, "uuid": "fe95939a-eb78-4c03-82a5-44069686f16e", "value": 443421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770249999, "uuid": "92a50183-3dfe-400b-8e44-e7751e8209c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770249999, "uuid": "0e574aa0-cf45-4833-8d4d-604d32d7bab3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eca2094-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327314, "uuid": "a14e5e34-4911-48ce-8c25-66f48574e8c7", "comment": "Malware payload (Mirai)", "value": "b3031f0d9177b449f593aca468c9b73e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327314, "uuid": "4bb5abd1-1609-4994-8d39-43ced10e6a1d", "comment": "Malware payload (Mirai)", "value": "8e25b65d9675f7ee4703ce4a6d47f6845969e596640dd7205316b3e10775fac0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327314, "uuid": "9979468e-39e4-46f7-9375-eade298e61f2", "comment": "Malware payload (Mirai)", "value": "e2c0c7d57fdf810f957cffbf16e86adb5c2c60c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327314, "uuid": "ff61d6de-c941-4136-ad8e-4ebe7ef8e9f8", "comment": "Malware payload (Mirai)", "value": "120156e969ebf0daa78e8390adbbf45efb62f84fba0c15b469dd8a8d9f7767e0d3c3759bab90cf9b7e705d1cd84324bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327314, "uuid": "8c238b0d-1db9-4843-ab5b-4d3d669cfa1d", "value": "T184736DC5FA83D4FAE81205311237EB37AAB2D53E2178DB43C3B5A675EC13502E91A25C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327314, "uuid": "367233e5-f61e-4bae-9a21-d769f8694723", "value": "1536:LVryJ1xzGdrf1TUpPwi282IiKxZXB9hsHZ8WY:LVrqx2rf1T8Pg8JfVBrLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327314, "uuid": "b4fba024-6162-4ef1-b302-f6ced8798ff6", "value": 75028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327314, "uuid": "0452ef6d-7ae5-4f0a-ac36-a7b73b1edfa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327314, "uuid": "4efabf85-5e9a-429a-a98a-965b6a9d715d", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2af1d7-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303612, "uuid": "ef3c1585-344c-4c65-b514-08b33a5758a4", "comment": "Malware payload (AgentTesla)", "value": "9b9d70c540f8f981539f6e1917ac8f68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303612, "uuid": "c1273400-8098-4ef2-92ca-c0e3ad4b4474", "comment": "Malware payload (AgentTesla)", "value": "8e49bc5255e6e01b5d5fa898271ee60b2616ede84ec2c2f6cec2377b431c0866", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303612, "uuid": "558a9f38-91e4-41c4-81bc-fd9fde35927c", "comment": "Malware payload (AgentTesla)", "value": "f5106d4df380dcbc7da356733f43a32d945b4a6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303612, "uuid": "0791d9d5-3653-45e7-9a20-24bf42853be7", "comment": "Malware payload (AgentTesla)", "value": "12198ea38d0b1e89894c044bf1ba5c2af6291a4e689c9ffc043f54e4327df65ae1ad2779ea1e15c73c1b2c02778b6b58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303612, "uuid": "25a73e81-5950-4fe8-8f2f-9d8531ed7bb4", "value": "T17AD423524690DD95C491A370C032CC9086787CB1AD4A777E8B2EFAAB7C70393AE7365D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303612, "uuid": "d54947b0-9400-42a8-b5af-81d200284dad", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303612, "uuid": "250a6ebd-5554-48d2-9730-60a6597f3dbe", "value": "12288:wz7hU5I5yuNHIgzSFKxWltRohBfSTso93UcTWjXg8ZSViXoao:wf+iN57Gtene3gs8ef9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303612, "uuid": "0be0f3db-e12f-43f2-95ab-d33f01e5b17a", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303612, "uuid": "064e6d74-b220-4ae4-8f02-bdff6bc7b5fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303612, "uuid": "9d4f2cfc-6a30-4e3e-914b-086522935e3f", "value": "8e49bc5255e6e01b5d5fa898271ee60b2616ede84ec2c2f6cec2377b431c0866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548d5763-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770305312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305312, "uuid": "8f07c54b-6808-4c25-985b-3e69f3a26081", "comment": "Malware payload (RemcosRAT)", "value": "4447b40b931b5ae9c58a53d380818cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305312, "uuid": "7e1d5050-60fc-4669-9525-b53ba7d09d08", "comment": "Malware payload (RemcosRAT)", "value": "8e918dc30ae62e349340f07b703627d829553dbf4f641b13da548e1e179a3463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305312, "uuid": "44b465dc-6d14-46c0-b6c1-38cb79cc8093", "comment": "Malware payload (RemcosRAT)", "value": "98a646a347879d55e1fa09ed034054e815728790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305312, "uuid": "7a449f70-16e6-43d7-ba6b-7ee0f45e8abc", "comment": "Malware payload (RemcosRAT)", "value": "ec66f2d95f304a523c13e042153b4be6a7c028b2b616de88fa77ab962fd8cb99966c59ecfc3da721bd376bbc1367e0a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305312, "uuid": "f2a69594-498f-4162-b968-59f9ca7bfb6b", "value": "T1CA0501467740C903E39403B8EC7AFAF41366BFACD7974263BB203E5E7836696581B512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305312, "uuid": "4c923c13-a038-42c1-b23d-a56ec2552986", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305312, "uuid": "312a66f0-b5f1-4a62-9c64-563cd6daa306", "value": "24576:h4rQ/uPACYQmR/5iF8m2/hSGYJK10sDS7N:2rjP1YPoFG7wK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305312, "uuid": "6408e632-19e5-4041-8515-1c49dbec8b6c", "value": 807584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305312, "uuid": "b8041b87-1150-4534-a94d-bbfd8e6e0983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305312, "uuid": "4fe1e827-94c9-46e2-a23c-91a17ef3cdff", "value": "8e918dc30ae62e349340f07b703627d829553dbf4f641b13da548e1e179a3463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cca4c40-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305648, "uuid": "27dec030-4652-4250-a59b-20731cd7b51f", "comment": "Malware payload", "value": "9511aaa142b4609bdde7333119cc5d58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305648, "uuid": "169bd79a-1644-4507-bd02-7407d901422a", "comment": "Malware payload", "value": "8ecdbee20a8026b44a15b4866b35db8f835b15570fc3b4bfcf8bf823cb915852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305648, "uuid": "440f9ee3-54ea-4f63-a769-97072555b981", "comment": "Malware payload", "value": "d1545acb7b7537f0483de4916b0c50a54e83bc37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305648, "uuid": "4b9d16dd-536e-456a-adc6-4ea620beb005", "comment": "Malware payload", "value": "6c54e1d094582b6d7cf3bdef30f3a92e8f55249e67a1f4b93eb46bc0335de76575395c2de828e513dfa621576df0ea3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305648, "uuid": "cfabaf4e-99cc-4884-8a91-e7ec4e585778", "value": "T1DBA4DF87F580D1D2D81C8C3199B3973156BFBCB99A8D9393A388715139332C75A3B9A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305648, "uuid": "bf34912f-f7ec-431c-99dc-364a98edbfb4", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305648, "uuid": "34d5b510-4725-4787-9b17-4dde9e73a336", "value": "12288:ccODb7v0o8JvG5UFP+ibiucOTjjjjcjzjcjcjjYXFUe5pEEkqXxoEWK:3O4njjjjcjzjcjcjjgyevCqhcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305648, "uuid": "afa8ed8f-0973-416f-83d7-af96bad00987", "value": 456072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305648, "uuid": "a9a472a7-6f3c-48bc-9664-c0051d58a73c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305648, "uuid": "d64b0b08-0b34-4652-b5c3-807a554ee016", "value": "8ecdbee20a8026b44a15b4866b35db8f835b15570fc3b4bfcf8bf823cb915852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e873f1c4-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770303413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303413, "uuid": "3051f935-78b4-4944-9338-f16e04ef51c7", "comment": "Malware payload", "value": "2c826f661c578d965f539b7a6e10264f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303413, "uuid": "72c93ca3-5649-4f34-bdc3-9ef2d53dd91a", "comment": "Malware payload", "value": "8f1d654b95b445a8f398e7c6a7b779106533526b45741fd3921a7d44584c915a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303413, "uuid": "1bcfd735-9749-4ca2-ad73-0f28254cdad4", "comment": "Malware payload", "value": "2639ee4166f3d6769582c9b9ec9c856d0cbd7cd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303413, "uuid": "fb3cd692-b7d2-456a-b08f-7d38e0e882ec", "comment": "Malware payload", "value": "cd48bb94df31d4c79ee00e9aca4249277bcb0f3c6e7b1ab172e7b2d27c977fe9be0762b3755bfcea62f546e4d1326b9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303413, "uuid": "8ce638be-7a90-4aef-8320-ee1fdf9fd7fc", "value": "T1AFF423825A81D694C291B331C1228E30597939B1AE4AA66EC71CFD777C343C3FCA766D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303413, "uuid": "007eea74-3d35-4ff9-b66d-5ebb10b5482f", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303413, "uuid": "a160730e-acb1-46b7-bf19-e2525a6a1c18", "value": "12288:Cz7hU5I5yuNHIgzSFKxWltRohBfSTso93U9HxXa6IF8U1KqFKWisa6r:Cf+iN57Gtene3WRK64MqAWi1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303413, "uuid": "f05b2a1c-f7a2-4a04-b9f6-ae318e607b39", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303413, "uuid": "088d3429-3c11-459b-aaa2-ae5ab11a7b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303413, "uuid": "2bc88bbb-5c76-4c75-b920-cb7c0a11f48d", "value": "8f1d654b95b445a8f398e7c6a7b779106533526b45741fd3921a7d44584c915a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f5baa8-026b-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770279697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279697, "uuid": "55ef8ed3-f255-4b18-87a5-f73a1796fff6", "comment": "Malware payload (AgentTesla)", "value": "284054d8a0b6b0fc40e876dd65fbbb3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-diesel-turbo-gr", "colour": "#062EE5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279697, "uuid": "0d7eccea-f0c3-4a96-a7d3-3dfb7674323a", "comment": "Malware payload (AgentTesla)", "value": "8f6951e6e0b0f0b60620f809dd8c13f1f2b00e364c745d3e2834af40a8cbbbe2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-diesel-turbo-gr", "colour": "#062EE5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279697, "uuid": "9929c505-9ae0-4e37-b6bf-0460cf26b0da", "comment": "Malware payload (AgentTesla)", "value": "2fc63d15b0a5c7496c8c754040c8221972f68a8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-diesel-turbo-gr", "colour": "#062EE5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279697, "uuid": "07d463e1-b4f6-40bf-8d80-038ec30e565c", "comment": "Malware payload (AgentTesla)", "value": "d1a5e738970333cee86633e74595faa0aba6097f66679a30fda87b8f86f1ffc2ca98af69d1f033ba2f911e115c48f3e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-diesel-turbo-gr", "colour": "#062EE5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279697, "uuid": "4a63969b-4f53-4dce-b371-72503608c65d", "value": "T14775E1004EA22FB48FA8061964FD1ACE97AD479E10596CC9A727FFC5DFDB98841CB0C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279697, "uuid": "26967288-aeea-45e4-9d43-8923a0ce63c2", "value": "24576:ewrKEzvp00uhLG0nSb1boMMxvxOPqFtpV77fdoSSDfn2LLYm8:ew7YLe4VxpFFKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770279697, "uuid": "ba22b8a4-b0d8-4b95-af91-21f9707fd37f", "value": 1629093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770279697, "uuid": "605ec2d2-8f4e-40cd-a1bc-527ec91d400d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279697, "uuid": "65c83c8d-ec67-4afb-aca0-aa2e375fa85d", "value": "EURO 3.112,46.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce93efc-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770304870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304870, "uuid": "2f98b22a-6ab5-4a32-8049-f086d965817d", "comment": "Malware payload (GuLoader)", "value": "179f63f67727b5fb30dd48f0752517ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304870, "uuid": "fb387c85-2a0c-43cd-b54a-b5261bab7aec", "comment": "Malware payload (GuLoader)", "value": "8fad66431727ea8f2e30bd3f5c73b0adace46f0eed7e6ab287931b100351973c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304870, "uuid": "bf74ec40-f8fc-4e84-9c62-ed8bdf188a5a", "comment": "Malware payload (GuLoader)", "value": "d86bd75d9ceab863a43e49181cb18d0307c0631e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304870, "uuid": "f8181635-0b2f-4fb5-9e9a-a4c72fff07ca", "comment": "Malware payload (GuLoader)", "value": "a62628b5017f13cb2cf2a4342db43cbf49a1c9b43398266e40116041e8b0a65974170857cf0cc6abd7e661a8bed3c104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304870, "uuid": "89222eb5-e0b7-4e20-b014-7ebe43a2004b", "value": "T1F72523C1A986E653CCB48072D65389F3064B1D3ADA5539332BD2BF2F38BB952E325513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304870, "uuid": "035939eb-ad85-43f6-99e0-9f33a38b8919", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304870, "uuid": "63e3ea8d-a6e1-40c9-879c-9dce13875d02", "value": "24576:uGEImsKwblu48sz3STGSaafmF/Oyasbn9o1NDQCGt:JfewbP8sTS5aa+F/Oy1Y50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304870, "uuid": "e99c589e-801c-4b55-9e3b-fd3ad598a31d", "value": 975176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304870, "uuid": "647cf866-bd23-4b25-a041-3fe09301a0e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304870, "uuid": "416b5744-d970-4b4f-92ff-93709f20eccd", "value": "8fad66431727ea8f2e30bd3f5c73b0adace46f0eed7e6ab287931b100351973c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908ecdc3-02b0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770309278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309278, "uuid": "01345b4e-0318-4535-85a6-a149a7c6f5df", "comment": "Malware payload (Mirai)", "value": "18240d51ab9f17bb4c7cde4ca774b01a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309278, "uuid": "9083feb7-9424-4e5c-ad9e-404cf2889603", "comment": "Malware payload (Mirai)", "value": "8fb56f784afb30cb064a9b17fb5e2aaa7f3e2617d7ac19ab6246971e887b2498", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309278, "uuid": "94118963-ef33-46c0-813e-4c28a3a8a36c", "comment": "Malware payload (Mirai)", "value": "4da8106b924d706ba27fdd639b44557786242b86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309278, "uuid": "7601023c-5040-48c7-8f6b-982af024ed1a", "comment": "Malware payload (Mirai)", "value": "958bfc43bbf64ac3783803dbabd0e01c59fb322184f1302543414eb0e1d6f97235103e44fd5cadded216c69c53eed36d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309278, "uuid": "e18027a8-9497-4656-8fa0-61b71376c9d6", "value": "T1636301B873EF8530E0D9E532154F21703331EB56A43B63DD3E95F5ADE2625980863BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309278, "uuid": "e11b4302-40f5-4b1f-92c1-b273b1a15354", "value": "1536:hltrI7mDmde7Lletk8cghgLFPjihgulh6DoI3FrPI:hl+YmdkLMk8c5PdulI3FrPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770309278, "uuid": "094e11b2-0ca6-4c2d-a495-81585571e93d", "value": 70848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770309278, "uuid": "76fc618b-5f2c-4117-970f-fea542ad4626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309278, "uuid": "55da0118-ed51-4f0d-80ff-a3acfb04c9ce", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b9f56f-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770303831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303831, "uuid": "89b60c45-4656-43da-95e4-df2e624bc278", "comment": "Malware payload", "value": "6ff963874908310ca071286f431d8cfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303831, "uuid": "d1bd5c8e-ecc6-4539-bd97-f599843e7925", "comment": "Malware payload", "value": "904e7fab9083903a08142478e9650418c230bc7c29411c10081f652d3fd42b67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303831, "uuid": "2587773b-e60d-415d-bcac-d11cbf75149b", "comment": "Malware payload", "value": "563047ce979cc2f379a61fd437f4ceb931e0ab13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303831, "uuid": "88ab416e-e43d-478f-ab02-81c30df55092", "comment": "Malware payload", "value": "0dc7aab8fa68eaec12a7aa0e614aac9bbc176f949bc4bf914c46ac09f92417728cfd93194ed87ee2475d4e99aa773d8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303831, "uuid": "94d9574e-8ec0-4697-bc7f-9a461d679128", "value": "T1C0742A22E6607025F9A345B02EB8A25B75293D3A1680EC0BB78D9F4A37716C774F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303831, "uuid": "6d013563-ebb4-4fc8-a3ab-c40985cb1759", "value": "2232493190e348e9129c989d18d885ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303831, "uuid": "4c2040aa-ee91-4f7a-ae5b-14cb0d2f08ae", "value": "6144:/JE0k4xpzoUmc7jY5DCmYbVPS4dbhUo+Gpit5O72nD3e4T:/bkGvY5DCmYbVPSE9+Gp8O7WD3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303831, "uuid": "460a8451-9cf9-4d82-8862-532fc0120c40", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303831, "uuid": "f2a648f4-7b9c-4613-ade2-22aa26153d73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303831, "uuid": "a0ae4ece-5b3e-4be1-b710-eaa080f18f9e", "value": "904e7fab9083903a08142478e9650418c230bc7c29411c10081f652d3fd42b67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f9434f-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304058, "uuid": "7fb2d6bf-2c58-403c-965b-d3036a060df8", "comment": "Malware payload (AgentTesla)", "value": "5b5f020deb5a0fffa2bd480b477ea544", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304058, "uuid": "0b17ee3c-0d23-408d-8e83-cb429fdca7fc", "comment": "Malware payload (AgentTesla)", "value": "91044f4275d08e1b125bd81467124f8310eb1ca312b9f088667702535bb8c840", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304058, "uuid": "d91073da-9691-4f49-9fad-fff39289d5c6", "comment": "Malware payload (AgentTesla)", "value": "12c042d88c55a11394c2cf7d5a304ab0b496a0da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304058, "uuid": "47d66fab-f53c-4cdd-8009-0e9389770346", "comment": "Malware payload (AgentTesla)", "value": "2818330e4a060ca9a5c0cc2120cce7d7f3bb4c12edfb33489959702f25abf2e3f776e2f36791bd7f40698c7aa9a9de4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304058, "uuid": "0116ecc0-5aeb-4ca4-9e49-f637232ebbed", "value": "T16E940167FA31545FE970EDB01E27A9AE67B41D54303B81073A53BA3BE8706A00F4E25D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304058, "uuid": "85285bab-0a2d-4f8a-a3f9-2f59c3b4b2a7", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304058, "uuid": "1c685f53-bec3-4561-b4d7-fbb07efc0fd6", "value": "6144:FDf4hQtpRNevRvAhlwVRUAc+2UGDKe38Qg6mgslTLLihDWUbxp5+mwq+IeCbe:54y7RcZrVRl9eZ8j6mgiqa+xHpwq+ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304058, "uuid": "b07ed375-55d9-4632-b734-6717be055b76", "value": 419120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304058, "uuid": "743fb699-e1de-4f7b-9dca-0a99ee15ba25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304058, "uuid": "f231d34d-646d-486a-85da-7f1ec3e20f7f", "value": "91044f4275d08e1b125bd81467124f8310eb1ca312b9f088667702535bb8c840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b504fab4-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770303756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303756, "uuid": "d3794b17-0afd-4c68-aba9-314354083142", "comment": "Malware payload", "value": "65c4c7b135664c131581b46fc11e7475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303756, "uuid": "2c3bfa25-156c-4fdd-a9ee-097e38ea2292", "comment": "Malware payload", "value": "91afc212490a9995e8f6dfc76d33dfcd616f90fc5eabf0aec6307f81c1eda901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303756, "uuid": "25cb08aa-c8a6-4280-95bf-925dae952839", "comment": "Malware payload", "value": "7c20d909c4a9a2b10aeeef2703db28433440726e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303756, "uuid": "13f23480-2d7d-4b7a-99f7-117535c0fc75", "comment": "Malware payload", "value": "1dc145d10164d732a8994358096cc32e08741ee4ce73cc4a5deced5a0897f56beb5936fe906268355bdc7f29fe393efd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303756, "uuid": "0b32fcf6-43f6-4703-b6a0-b71217cdcb9e", "value": "T1B194E616EA60B0A5F89345703E79A25A782D3D392541EC0BB38D9F4A3B71993B0F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303756, "uuid": "45132c04-c8b0-41dc-91b9-078faee4c8df", "value": "b4ffe398cb82360ba8fe010b80173288", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303756, "uuid": "6c4abe92-2244-4cf0-813b-9ca2e05c7adb", "value": "12288:uai4I/Mu01DWlUYGxEvUfcC3cZMk3oq+V6LKTc:YNKD3cZMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303756, "uuid": "6f726b94-94f5-4b28-ad62-b0cda212ea6b", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303756, "uuid": "034dbab5-2018-4935-937d-530e91564f8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303756, "uuid": "ef29b9e5-3157-49ea-b1ad-81f4a56cf0f2", "value": "91afc212490a9995e8f6dfc76d33dfcd616f90fc5eabf0aec6307f81c1eda901", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a0c534-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770305901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305901, "uuid": "e5548167-3b3a-48c7-a0cb-aaf293e79abc", "comment": "Malware payload (ConnectWise)", "value": "4782ec93a020e1fd742ef22c30800dd9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305901, "uuid": "d6b239b1-c99a-4bd9-97a1-f8408500cbad", "comment": "Malware payload (ConnectWise)", "value": "924be472de4d7282c3e3188552a62b0d513903ecef71b10cba2e6e21cccfd439", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305901, "uuid": "2376d8ef-53c8-4b35-bc9a-3cb8ecec6203", "comment": "Malware payload (ConnectWise)", "value": "b4392702b0e2cf76e33268a68de1696153d07d9b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305901, "uuid": "556f8108-a988-4e92-ba14-246421eca0e4", "comment": "Malware payload (ConnectWise)", "value": "fc05bdf0d121c0e59e69045d4830b8d8086f89c1c96033869d6465fe791f56ec357d4713753663eba445413b44bcb7be", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305901, "uuid": "bce0efb1-02ff-477f-a932-687ba595e543", "value": "T163A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305901, "uuid": "e8bd5b4f-8d0c-4e5f-831c-d9760486e7af", "value": "196608:AKaLNkbgci4QeKaLNkbgRKaLNkbg7KaLNkbg:GWgciHAWg1WgzWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305901, "uuid": "cb74b928-a35d-4c10-9c0c-6c206193f2be", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305901, "uuid": "cb5a1526-bd1e-43cc-9d3b-8633f746c906", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305901, "uuid": "ea816608-61fa-4b2b-8cd1-d61abda1355e", "value": "MicrosoftTeamUpdate.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726f1b52-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307510, "uuid": "7fb492cf-0ee7-4223-b3ba-8917d4e71a16", "comment": "Malware payload", "value": "b7cd9c07aa9c973bacbef17557d0fc41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307510, "uuid": "29e7128b-255a-4b35-83f9-0e12c91972b3", "comment": "Malware payload", "value": "9297c50e1ffc8fc2f7bc8d91757cca2d4bcc184114738f3b6b22a55a983b76b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307510, "uuid": "dbf0f215-5e52-4abc-a9cf-c13b7ad398b4", "comment": "Malware payload", "value": "04ec59b9e937af1fbada6927e83c68789b894d2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307510, "uuid": "d3114cfb-efbd-4a33-ab2e-62685e2836f7", "comment": "Malware payload", "value": "f63b34fb730a9c27b452ff6a4a995912aaa552ce8b05a02ade7724c38c03f171313437733e57d1dcecc045032da82966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307510, "uuid": "21ae3cb2-4ecd-49f3-8a95-4e916ed5f1b7", "value": "T19BF1F82567F14737DAAF07730CE36A430B72DA11FE17BB6F1484936B9D5220846A2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307510, "uuid": "0710251b-7ea7-45e9-9cca-f99f41e13078", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307510, "uuid": "c58d3b31-7ac2-4ea6-b947-fca26826af62", "value": "192:f963pZSWSPmVFnlYJLLLTTb7RnPVb+uD:f96LSPmkPLTzzb+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307510, "uuid": "f7fa2557-17f6-4bd3-b53b-8397f893648c", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307510, "uuid": "e5583f5a-0c07-445e-9bd6-c4e5be7696ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307510, "uuid": "9a28616b-8a10-433b-82c6-e667320b8a67", "value": "9297c50e1ffc8fc2f7bc8d91757cca2d4bcc184114738f3b6b22a55a983b76b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247f4ab5-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770304373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304373, "uuid": "15df6694-9f8f-42e1-87f1-74918eae0e84", "comment": "Malware payload (GuLoader)", "value": "cd9e55b523eff5aaa915e94aeed01fad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304373, "uuid": "1cda451e-3b6e-4607-8ebf-a3034f9385ec", "comment": "Malware payload (GuLoader)", "value": "92bfdeda6460b342061aba713db076ce3abfa96f982ab67f64ad2bdc57db9823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304373, "uuid": "0b178986-7427-462b-8b25-23ce4fdc1f5d", "comment": "Malware payload (GuLoader)", "value": "ba3c9144df811d59617ae6623909fc01d37c1e89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304373, "uuid": "d3a35907-5173-448b-9615-d29e76ff09ec", "comment": "Malware payload (GuLoader)", "value": "d3f1d9f58730acf70b877707fdf0013a6907472272e3f2ce7a2171c09a84158311f27f686635cb562928b59fd4d73ce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304373, "uuid": "37c7ff32-45a8-4c81-9c40-23a7e90650e8", "value": "T16AE4236137E0D446F5524A72E8BF84FE8A6A5E16F2E1231B33007FA47C366819D1E727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304373, "uuid": "6f861724-5ece-4460-b635-57594fd4900e", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304373, "uuid": "ab4f2e3e-1758-4e76-991e-ab87afa8a8b8", "value": "12288:LkhhvJGrvkEDT2stbzAnpflpX73Ajsy5dVuU:LghUrvjGstonptJ7QP5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304373, "uuid": "a307edd4-a638-4fa5-b314-bd302c175ad6", "value": 698408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304373, "uuid": "25190938-c945-4152-b8f9-a51f0f4a6151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304373, "uuid": "644eb114-93f4-4054-a5e0-a7d953a209f5", "value": "92bfdeda6460b342061aba713db076ce3abfa96f982ab67f64ad2bdc57db9823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a773f5a9-02cb-11f1-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1770320913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770320913, "uuid": "17cd85e2-e4b3-4dad-bc0e-b34133b57d77", "comment": "Malware payload (SimpleHelp)", "value": "c41fd506228a2c112d2c76f66c786846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770320913, "uuid": "831e9fc3-924e-4b0a-8ce3-9231896787b8", "comment": "Malware payload (SimpleHelp)", "value": "92deffc1f425b84271997cd02cd4c892076cb6e1b9839ded3482009980d48a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770320913, "uuid": "a4dfeded-e01b-4cc5-abd9-47bb3cc21a2e", "comment": "Malware payload (SimpleHelp)", "value": "c260151cee3fc695800d885da5cc846f14a5566d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770320913, "uuid": "478b6580-15a8-41f0-9721-c618d6324dcd", "comment": "Malware payload (SimpleHelp)", "value": "93d077c324a2e6ada9ec0c8deaee91621da767d8612501f23230a8b67cec901251889929cea5a8394291cdedfe07426f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770320913, "uuid": "444e5e17-8cdb-455b-a434-6f8fc6a8f888", "value": "T16387331AF39599FBDE33D0FCC0854447EA9678E54381422717F085EA4E606E98A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770320913, "uuid": "620c940d-0e28-47b8-ae61-4abf8f066f7c", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770320913, "uuid": "868b0751-b2e7-4b1a-99e0-965dac55ee0b", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1bF:/uRf+nAu2FuQd73XyFeDMnKTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770320913, "uuid": "3f42808c-469a-4dec-91e9-80a941cdbdf4", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770320913, "uuid": "167e0177-e1bc-4758-97d6-3fd55f2d8ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770320913, "uuid": "af601cc2-6f28-4788-b82c-906716a8f433", "value": "92deffc1f425b84271997cd02cd4c892076cb6e1b9839ded3482009980d48a7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b095c481-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770306326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306326, "uuid": "67cfdec9-7e9d-4f3e-9192-a6f68b4cbd02", "comment": "Malware payload (QuasarRAT)", "value": "9cecb4deaa8d70a5ac3211f739732929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306326, "uuid": "7aa5ed49-b33e-4cac-9388-fc389b1596c1", "comment": "Malware payload (QuasarRAT)", "value": "92e226d89ccec2adecad02563fad6ff7fd4ecc91cddb9a1f8a43e3c94b9ef9bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306326, "uuid": "1f07f139-a61a-4fd6-a310-ad8851c61cce", "comment": "Malware payload (QuasarRAT)", "value": "97797cf7512805afc3bffcb28061c6e634cfee1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306326, "uuid": "0dd0068b-50c0-4e47-bb84-242222d77ce1", "comment": "Malware payload (QuasarRAT)", "value": "c2132057d77ae6bf736970599cb218d35f75f6c05ea856375613e28e32e65eeedb985fcb2a852c8769cc7e72cdf7f230", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306326, "uuid": "c31b0029-82d4-47b8-a045-d347a16312d1", "value": "T16C15CF5073F98207E1FF2FB9E4B64A090B73F552953AD75E188960AD0EE77808E503A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306326, "uuid": "dd825750-87df-4132-a079-d2b48056a163", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306326, "uuid": "a6bd1aaa-a00f-428f-a573-15361d098884", "value": "12288:b1e7w5U5+hQyg7oZisqtksOtgg+WLyDrQ9/7WxdtbiqCr8ALrB7uLEeWH+:b1exjyclOoWLuyWf1wXULEV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306326, "uuid": "bbe05b3a-b4b4-4e78-8f7f-898d204b750c", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306326, "uuid": "b1630590-11b9-4fd2-8df1-c04b42fe9da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306326, "uuid": "f1a0fb69-88e5-43f4-9c7a-b7df05d79770", "value": "92e226d89ccec2adecad02563fad6ff7fd4ecc91cddb9a1f8a43e3c94b9ef9bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992d89c9-0231-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770254747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254747, "uuid": "6c0ccb5c-258b-4af5-b081-66b985ad7a2c", "comment": "Malware payload", "value": "12f9c55da4c5c2b760493cf29332577e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254747, "uuid": "c1a7ac83-0e26-47f5-978d-d9cec763010d", "comment": "Malware payload", "value": "930236706dac79e929ed51a0bc993b528e1efa6254a86ac653d49306fd078246", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254747, "uuid": "87cdcbce-98ec-41ed-b2e9-f33c476de54e", "comment": "Malware payload", "value": "0eb1562215eaefc48e01eaa9c2f549e14236266b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254747, "uuid": "c7ddf2c9-a33b-43df-afd0-e2779cc484f3", "comment": "Malware payload", "value": "03a14a3bc6fe59e72386e77630cb7f3309e8410921f3921e965b3fbe03720c6328cad86959f18c2764e33e647022d9c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254747, "uuid": "6502aec1-4cc4-4979-86fd-fc457fc816a7", "value": "T1519733BD2CC3DD6AC71695BE219AB72E74261B8CDC7CF40E358522A52E742333935AC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254747, "uuid": "f400768a-c67b-46ff-b913-eba0045a3639", "value": "b484b52df60e8d823b647a09bb1e39f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254747, "uuid": "5a9d0785-5592-4f4a-860a-6e8c162cb0c7", "value": "786432:jolKoU6fcjiBEb9HlqIiU3Mog8YjmF0TVgsgLRZer2IzPajM4:UlHdoiBEhFpiLJ1qF0P63TQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770254747, "uuid": "705cbc68-ad01-456e-bb84-3601d0d98ccc", "value": 41404685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770254747, "uuid": "62c4c5d2-d80e-4445-b554-f1ddb253993e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254747, "uuid": "052eb290-2df8-451e-aaf3-e63bfd7a890f", "value": "Clash.Verge_2.4.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2796cdf8-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770307384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307384, "uuid": "e4a7fd9b-7796-496b-8992-e157bb996582", "comment": "Malware payload (Formbook)", "value": "fa3610ccec02814f4ca1c2e2bcb9767e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307384, "uuid": "e3acd0fe-a314-4154-8294-1db69ff820d7", "comment": "Malware payload (Formbook)", "value": "9363e7ba40e20d8750a9cac5059539ba663d346b88c09d8d924ab8c7e9fa0acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307384, "uuid": "522d1bb4-e002-4c5a-8e80-8585b45c55a1", "comment": "Malware payload (Formbook)", "value": "51e84b03e8f25ade353d0dde09a06ab9c2f77ab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307384, "uuid": "5aa52d7a-1267-4743-9ce1-5cf18a380ea5", "comment": "Malware payload (Formbook)", "value": "58d585a3f907be2b92682323795c037aced6c979023d2500b85feb221006a8ebc863e70730a73803879bd61e427eec2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307384, "uuid": "81760619-55c5-404f-8f12-89d2c728f1e8", "value": "T12945BF0273D1C062FFAB91334B5AF6115BBC79260123A62F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307384, "uuid": "5985ad29-7ec3-44ca-9cdb-72d35f20736a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307384, "uuid": "c0628cbc-a53a-487f-aa6c-7458c4a41e2a", "value": "24576:I5EmXFtKaL4/oFe5T9yyXYfP1ijXdaAYCbA3+t8UpFHf:IPVt/LZeJbInQRaAhbA3+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307384, "uuid": "99084734-1a91-4b1a-9f44-db02aab9f234", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307384, "uuid": "18f7ab7c-d046-4c84-bb92-88070abf9b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307384, "uuid": "f5271f00-addb-42f7-9591-58392bef6c03", "value": "9363e7ba40e20d8750a9cac5059539ba663d346b88c09d8d924ab8c7e9fa0acc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56a241f-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770304616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304616, "uuid": "140b9e86-c0f1-4fa8-b065-d3d0834dfcaf", "comment": "Malware payload (a310Logger)", "value": "eb9516ca0f0f8dc7119cbd7a4f157a67", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304616, "uuid": "933acc27-a574-4a95-9878-eb047830acfb", "comment": "Malware payload (a310Logger)", "value": "937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304616, "uuid": "4d42eaec-ec94-49c8-88f8-0645f37003da", "comment": "Malware payload (a310Logger)", "value": "1df692a1fb9f5835bc1738fc8373c0f7a517eab2", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304616, "uuid": "8b5b605c-acdd-4dcd-bddd-7f6e1f860495", "comment": "Malware payload (a310Logger)", "value": "00206855f9a93541beddf79d1a94499c88318136d9e568b331a5e6f05509144d1b807d07b1cbd9013ec64b664972e70f", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304616, "uuid": "68426194-8ee3-488c-9fb0-bc2deae5e05b", "value": "T1D905238246D05D60D250B3709838CD5A4AB475319F06B32B8B5DE9B7EC78383A6B7F4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304616, "uuid": "151d8ab7-49bf-4fe1-be4e-f46b9332ada1", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304616, "uuid": "2b2ba896-7382-4dc9-8a9b-f2e11cb073d9", "value": "24576:4f+iN57Gtene3sYakC1+PuTHl5057mhAMU5dpY:OLXKtene3gq2TEhmLU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304616, "uuid": "d7e3ee70-7abc-4b09-a94e-cd174b11c79a", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304616, "uuid": "1ee8d437-5ec1-4aa7-969b-f6b9ffb410eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304616, "uuid": "8c31f742-6b42-489d-9c92-3c365a712657", "value": "937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53be6958-02d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770326786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326786, "uuid": "8b1478a9-77db-4a2b-9eb1-aba0e6a2d2ef", "comment": "Malware payload (Gafgyt)", "value": "37bd95904360fa38ae63e56d77bcd3c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326786, "uuid": "730025e6-b663-4cba-ba0f-2e4ae7284128", "comment": "Malware payload (Gafgyt)", "value": "9392867cf367bbf67d4595f37ca80a03013064dc27d1ab570af0c0ae1c7907ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326786, "uuid": "0f62361d-173a-4ca3-8dbf-daf3046a3626", "comment": "Malware payload (Gafgyt)", "value": "7af5fc964f2ad3fffb01090ffe03417e0299737b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770326786, "uuid": "83ec7651-364c-4f3b-9a0f-63458f57b418", "comment": "Malware payload (Gafgyt)", "value": "5d4603d5d58c6f785a06724414b937ff1595b2a1604f92a0fedf9ce70f40bf9d13859b42094946cd0353566356ac4023", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326786, "uuid": "984b3453-b442-4945-bf9c-687f75dc8f6e", "value": "T165833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326786, "uuid": "1111a996-8a7d-4fbe-af66-2ae36b134ede", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCpdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JaBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770326786, "uuid": "3961a83f-f383-478a-a86d-a9186d8cdbc9", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770326786, "uuid": "60c6fcd3-728f-43a5-9fa9-ec07ecf02a19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770326786, "uuid": "995f160e-6638-43f2-bdf5-a7874f804148", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20870c3-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304261, "uuid": "af5cc5c4-dabc-43fb-9a1f-f03b0cf72231", "comment": "Malware payload (AgentTesla)", "value": "87e225b11badd6433c6cfc1428f9091c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304261, "uuid": "ed42529e-fe02-43ea-9e52-801e963f00e3", "comment": "Malware payload (AgentTesla)", "value": "946a4a365d4616d821da6f4d2c36d54ca850d6a659e755152324e2f5c6c9ff64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304261, "uuid": "9d475e6b-82f2-489b-8acc-5bcf06c45700", "comment": "Malware payload (AgentTesla)", "value": "a5e621ca60577c495423536ca698e60178e0f9bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304261, "uuid": "31368bcc-a3a4-4ae9-abe1-49143d1900e6", "comment": "Malware payload (AgentTesla)", "value": "ed10e4db0240e28060ebc24291cea4154c3c39ef97b60c96599a390f689a68d5b1a4a3ac8598f0e7d8c165ed0af04a3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304261, "uuid": "5eb8bd1b-e141-4cb0-af7b-59f11a79a87c", "value": "T16435BEEF7A54E453C992DA35F81BE0B11B2C1E5B9E408163E69CFE8F3CA411A54C6393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304261, "uuid": "d43a738d-ec94-4562-941e-e76905bbc4f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304261, "uuid": "42a7c343-e4f2-4fdd-b867-6b5a14c300c8", "value": "24576:Q7pXPbk6EUpW3sZ7UD4P8u92sxaiBpIC6TEURtmBu0I0SGPH:QtXPEUw87UD4P8spBpICwL2BLuGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304261, "uuid": "6fab479a-d879-4d27-ab0f-161060b77a29", "value": 1088008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304261, "uuid": "44543431-bbb7-424c-8a21-85306772b8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304261, "uuid": "40923f2d-d7af-4960-943c-8ada2823622b", "value": "946a4a365d4616d821da6f4d2c36d54ca850d6a659e755152324e2f5c6c9ff64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd6b3bb-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307583, "uuid": "b4641da6-da7e-4bb6-9a85-d72c0fdf6618", "comment": "Malware payload", "value": "dec8c42edd823666d7b2e1d1c3386212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307583, "uuid": "ab51c670-37d9-4b0d-94e3-b58c23b0d022", "comment": "Malware payload", "value": "94e03731b59ee88792372c5a7c357ef2b64a95bea095ef81a572755460067228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307583, "uuid": "af347f03-8655-44b7-a5da-344c4c6ec485", "comment": "Malware payload", "value": "a72728d9cf2607443fb139a9132a478f25012c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307583, "uuid": "a0c7c296-168d-4946-a810-d94cc1414063", "comment": "Malware payload", "value": "68a2288f7d66169cc35b9e203070ef9ac6c8a2b463d93c53731733910fb43a8c51a56b28b4222c86eda0c8178d2fc415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307583, "uuid": "78b5819a-ad09-4f4a-8603-1165763644f3", "value": "T15B742A16E660B425F95386B02DB9A25639293D351780ED0FB78C9F4A37B1A8370F631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307583, "uuid": "d86014d9-ff05-43a2-8b40-89f5e40f22a6", "value": "8c52501e786551529b909f16c5bbd3a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307583, "uuid": "347b3877-1bc8-495c-9abe-1e21c024c884", "value": "6144:LUZFv9b7vsA9qD7TeVefO2iQAAxdU+UWEGPT5o3W:EFlqD7TeVefOUAAxe+UWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307583, "uuid": "dd2da9e8-2fb8-4229-aaba-e977089d0eb2", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307583, "uuid": "f6abf524-0c41-4015-b958-98bc2da40fa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307583, "uuid": "6fda60c1-1474-46ac-b018-2526e53c4ffb", "value": "94e03731b59ee88792372c5a7c357ef2b64a95bea095ef81a572755460067228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6156afe5-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304904, "uuid": "a37e7fe7-d13b-47b4-8023-5b0499e9df07", "comment": "Malware payload", "value": "7f005efeff7be2212d1f9e97dec23d04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304904, "uuid": "865a2b67-1e9d-470f-a129-9c78ea638a7e", "comment": "Malware payload", "value": "950c7d9f61434830e1e8d78dcdf696c1f09586852dbf10d83ac415b2d47cd3de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304904, "uuid": "c4ed7031-f382-471b-bf4d-cf672719a8ab", "comment": "Malware payload", "value": "9e700a8017966670583d84d56b923f9e0e69eae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304904, "uuid": "e956b042-1764-4b26-9ecc-1ff5f8200a1d", "comment": "Malware payload", "value": "9cc4f9ba31932446fd86c2fa83b5231bfdce6520aeb185d51067771309488fbb67a8d3c3e087325e0a48060db25b2665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304904, "uuid": "da1ec0da-0175-44c8-a05e-b1e9d6e7061f", "value": "T19C740822EA607425F85345B02DB8A25A291D3D391681ED0BB78DDF4A3771AC3B1F532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304904, "uuid": "c66e59c2-a74d-48a9-9bf1-b09e7109ce37", "value": "6fa84b7dcbc7b71e5e3611c2a6f9485b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304904, "uuid": "9dc18bcc-0d53-4c94-8595-d644deec7251", "value": "6144:WeXxptloxJto7umSbpnKnKOQ9WTfEWA+9I7OcRPemeO2trS:rlgiSbpnKnKOQ9WTfEQm7OcR58S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304904, "uuid": "e0098062-107e-4f18-a3d0-d8557b898e2c", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304904, "uuid": "e34b7f0f-995a-41c1-a2a7-aa601847c52c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304904, "uuid": "9029e88e-fa99-4f9e-aeca-b76e5bb66088", "value": "950c7d9f61434830e1e8d78dcdf696c1f09586852dbf10d83ac415b2d47cd3de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d96f9ed-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307448, "uuid": "502a233a-92f9-4526-ac2c-11229fd230d6", "comment": "Malware payload", "value": "6f94485baf1dfb8fa65aacf24cbdaea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307448, "uuid": "184f3fc8-613f-43d8-85a4-561b40e3ad3d", "comment": "Malware payload", "value": "95da9671691f4d0b02043a824b4d3540c1e7bf7efb3c39fff156c90b0fe5c935", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307448, "uuid": "6f258c14-c299-4b7f-986a-82957455dbd0", "comment": "Malware payload", "value": "7d68eed222f5ab7144c5e953474a8c5bd45ea8a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307448, "uuid": "3dd387c1-f3fd-486c-bd3c-48d788e58dca", "comment": "Malware payload", "value": "89ba1eb60c9d6f1eadd8e547b7118503c5a4b5ee42366f08ddb1e73413488fba466114a5b4a7f1c11d06bccfa90ec5d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307448, "uuid": "80362ee9-85ff-4705-a56c-68dd2bb0e46f", "value": "T1C834BE63A4BCAA9FDDD82F379C4E880713B66FE4D890603E1C44710EFE2A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307448, "uuid": "acf53b33-3bc4-4ad0-8a08-c1cfd63b69e9", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307448, "uuid": "e347fe2e-5a46-41e0-808e-329897b84533", "value": "6144:lGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOG:lG60BpL8jk1FGjDc8GVdOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307448, "uuid": "7f237b4b-99eb-482c-bed1-55a31d64da29", "value": 245861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307448, "uuid": "a3f0b6dd-a837-41a8-935d-b693fb7f9038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307448, "uuid": "6a997503-fc7a-4f97-ac0d-5f0c08ae1318", "value": "95da9671691f4d0b02043a824b4d3540c1e7bf7efb3c39fff156c90b0fe5c935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940c5970-02d4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770324746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324746, "uuid": "1805f090-8ca8-4109-97bb-e33a35c97bbc", "comment": "Malware payload", "value": "3012959afdf3e55714a0d40bf00f0ca5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324746, "uuid": "56fb8107-093c-40f8-9aef-bf4679ede8fb", "comment": "Malware payload", "value": "9623fd06f0721e56ca71196f515a4870959f5b2daf4d954fe6af25bbe7896132", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324746, "uuid": "c386f0bc-68ba-4e0f-a1d1-2f1c3caec255", "comment": "Malware payload", "value": "9e3063f6d9c7d4e30528c008284f0059adf548ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770324746, "uuid": "fd7c82d6-2259-458f-a5d5-bdc46e4c6cb2", "comment": "Malware payload", "value": "3fa04b1d3ba95640565b78c350f39dd2f4f620a303699bf94d17c546d38e63f3e0c3f5106895ec708a82df184ad0be7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770324746, "uuid": "f66f4039-09d9-4921-9eb4-79867dd7f6cd", "value": "T130566B85F793F0B1F15308B0129BF7B7A02026355047E1FBEB8E5A64B4733915B693AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770324746, "uuid": "d40e6325-f6fd-4393-b939-6cba13b72f74", "value": "98304:a4csGJV6Cy3qzNsq227Yexdv3fEP3IGbGXg7i0iTw4qfIkayVU4u4vKYXdzJ4Hem:a4csGiC0qzN32APxdayN0iTw4qfIkay+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770324746, "uuid": "62be1462-cfe8-4b1a-8f2f-876e86bb206b", "value": 6225876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770324746, "uuid": "3e4f4c82-1b96-4c4b-b85d-ef612494f72f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770324746, "uuid": "9a477f78-6784-49cb-a7fc-3e20afb894de", "value": "build.32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebe7d5e-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770305920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305920, "uuid": "2adbc163-78e0-4fdf-b3ac-bfffd2d4b084", "comment": "Malware payload (Formbook)", "value": "32e5d12e5196477b3038423358c79f0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305920, "uuid": "8da8d5e4-ca46-4ae7-a881-a339559abaa9", "comment": "Malware payload (Formbook)", "value": "962c600e321d42aa05155b29b3e45b73edca5b57180801f70b03c7fb80ad23a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305920, "uuid": "bec41a3b-33ec-45c8-b070-23d7e884dae1", "comment": "Malware payload (Formbook)", "value": "586be96a87471194f285ff91e0c529cea2e658e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305920, "uuid": "e72acdcf-c648-4077-af28-98dc24ae6baf", "comment": "Malware payload (Formbook)", "value": "2b7fff72b89600f2ab2408e3c122b82a1c8474e305af710df24fb61ed9ab7880358633479abae7871ce7dd132aaf63d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305920, "uuid": "1c99b67f-463e-42fd-89e7-d9d636f1d498", "value": "T1A245BF027381C062FFAB95334B5AF6115BBC79260123A61F13981DBAFE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305920, "uuid": "16b5149e-ad84-4196-bfa4-884516505c4f", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305920, "uuid": "fdb2c878-d032-4a41-a740-c098d3264b27", "value": "24576:t5EmXFtKaL4/oFe5T9yyXYfP1ijXdaqkA2s1lGeBTFE5y/A:tPVt/LZeJbInQRaqn2sDT+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305920, "uuid": "96ee886f-2687-4c7a-80a0-323f3e6367b5", "value": 1242624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305920, "uuid": "eaa918f6-fc2c-4f22-b8cc-aae2f4e4785c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305920, "uuid": "0387f20d-97f1-4c1a-b304-839df00f2f1f", "value": "962c600e321d42aa05155b29b3e45b73edca5b57180801f70b03c7fb80ad23a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2952f2e-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770308127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308127, "uuid": "b8ff9f09-2169-48fa-8dfd-d8fceb2b2a86", "comment": "Malware payload (RemcosRAT)", "value": "2f0568da02c8179455230dfd9d1b0d57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308127, "uuid": "192fa0a6-da43-4e37-8e0f-a62cfcd25f27", "comment": "Malware payload (RemcosRAT)", "value": "96398d91d1346c9345c76cd5319cbe5266ac1293b02049d39cf32eef68c1509c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308127, "uuid": "2953460e-fced-4ce8-ab5f-acca9fb5fbee", "comment": "Malware payload (RemcosRAT)", "value": "0d4b5bb994aa288b91361ecae9a0b44b03edfc44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308127, "uuid": "2d0779ff-9aa6-4f00-848b-e7128553f70f", "comment": "Malware payload (RemcosRAT)", "value": "da0c924db40bbe2e6346591de72982fdc3320dba8f7e45d6f8643a057c2e96a44700aa1619075948db7a43df2a85d288", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308127, "uuid": "ef3499c2-fc84-4b38-a27c-5c84811362f3", "value": "T1D6551285267DEB07C5724BF46476D1342BB06C5DBA01D21B6FC5ACEFB0B6BA08642B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308127, "uuid": "d840de14-efd0-47f8-8786-1ed91881be2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308127, "uuid": "c21d83f3-8825-438a-b38e-e31505d43ac5", "value": "24576:sW7CHIg+XWi2WEpF+RGyq4xOx0oq3kIkKE/uMon3FhCDm9jl8wj3:s1IlWi2WEp/yqgILgHkBt47j9Co3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308127, "uuid": "f07805ed-df53-4dda-81bd-f6421e242142", "value": 1296904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308127, "uuid": "6af949b4-f30b-468c-9338-2047cf964e01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308127, "uuid": "15465cf9-e1c3-4184-a4b0-479b325d08a6", "value": "96398d91d1346c9345c76cd5319cbe5266ac1293b02049d39cf32eef68c1509c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6011130a-02dd-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770328524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328524, "uuid": "a412c6ea-4987-461a-a4e4-d6708a5fa146", "comment": "Malware payload (ConnectWise)", "value": "bde91123504303ae45776eb0d32ee5af", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328524, "uuid": "bc2ff1a3-7376-4099-8161-f212d073b952", "comment": "Malware payload (ConnectWise)", "value": "963b317a03a902cbfbd6e1797a9b48859da08cb3e417e840a04016df7984dca9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328524, "uuid": "6cd7ef76-2a41-4793-a5b0-8a7644982848", "comment": "Malware payload (ConnectWise)", "value": "ca68a91dc5806321642e228e2e91e292ea704178", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328524, "uuid": "096f014f-e01d-4dfc-b692-482a7f896a7a", "comment": "Malware payload (ConnectWise)", "value": "77528875c3e0f79b97a9bba87a40b4934bf6514ff32fb7cd1255a77f1ce111315ee63cb946e98161d7584b9806ac7f9d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328524, "uuid": "05c8cd8f-2e2d-4cf8-860b-ec04a3d56261", "value": "T1C8A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328524, "uuid": "3d8e466f-02d8-4e8f-8ba9-ecf77ec1456d", "value": "196608:WKaLNkbgci4QHKaLNkbgRKaLNkbg7KaLNkbg:4WgciHfWg1WgzWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770328524, "uuid": "2a815e28-c755-4e69-affa-46e1d86d3f4d", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770328524, "uuid": "f296379f-ce0d-4277-af66-c28e653cd31f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328524, "uuid": "102e20e5-d59a-4606-ade0-08533f66e51f", "value": "payment_details.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f44c375-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770307988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307988, "uuid": "e8744800-d409-49d6-b1ae-d13aa4bad90b", "comment": "Malware payload (GCleaner)", "value": "bf97df26d3d05a2eff3719e9a19bcb4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307988, "uuid": "c7383efc-0ee0-4da3-a11d-79f1a0ed9055", "comment": "Malware payload (GCleaner)", "value": "969ddabbc1faa6f0a92c79e683bffb96858c080e6742baae07f75148541b1cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307988, "uuid": "5b5e6856-fc11-4480-9199-2df915f0f87d", "comment": "Malware payload (GCleaner)", "value": "97281ef779e73dab6d847cb127cf1877348749ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307988, "uuid": "56829451-65cf-439e-a8a7-ae10d0bcaf6e", "comment": "Malware payload (GCleaner)", "value": "14ec20da79105ce9cab002126cead9739aa67ab665183eaa09cb349ffa9cfa5980d9529962d93defe278e7809e3bdc46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307988, "uuid": "4e816faa-8a33-4b15-927a-2efc03add5d6", "value": "T1EF057E12E1F38437E0272B799C6BCEAC9436FD302938994AA7D92DC85F757437426287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307988, "uuid": "de8dc01d-059d-4b54-b8f1-30a10afb6008", "value": "421f57ebeade5946b16f0c3c541d2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307988, "uuid": "74782ed5-0b09-4a13-ad87-491744159c1b", "value": "12288:d9eONBtJzhKJd6EPXNQyxbLSoeZ5A5zRygQ0uHG:xnzz04EGOzU5kzRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307988, "uuid": "b6577623-6aee-4144-bb0d-f4b70a5682b4", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307988, "uuid": "72684071-21c1-49ce-a6a7-f74a8922e88c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307988, "uuid": "97a23c22-3c56-41a5-9bec-b542e6c88d15", "value": "969ddabbc1faa6f0a92c79e683bffb96858c080e6742baae07f75148541b1cf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce8970f-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304789, "uuid": "0b9ea7f0-be91-4541-8be3-29bb35075c3a", "comment": "Malware payload", "value": "4f65c2cffd181f5c04b276f46292696b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304789, "uuid": "f1410318-63f8-4937-9f9f-55bd595a3a5a", "comment": "Malware payload", "value": "96b4f832577ced8b48363da9d90a70c3938c44b1154f2cdd18ffeddfbb7d53b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304789, "uuid": "d7f1a0a6-25e9-4aa8-a4c8-98efc1f0d37a", "comment": "Malware payload", "value": "40e4194d380f64f89ff14bafb60239948fccbbe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304789, "uuid": "23b6d304-2268-4335-8aeb-78733c05fa2c", "comment": "Malware payload", "value": "4b4b87bb683b2e46b1a49dfd473c8d431f0a92fd8c850573359a9a95696cfe402b065378d034ccac613cc3ae969c6693", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304789, "uuid": "9723f024-5331-4069-afeb-4a4993a6239a", "value": "T180940712EA20B466F8A309703D79A25735293D7A3A80EC0BB74D9F5A36715A370F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304789, "uuid": "e4ba8009-55f4-446c-a8e3-2fad0cc6bb69", "value": "6a7c403f48b6e1f5a74df30649122a4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304789, "uuid": "fc0f8ff6-9a88-4dfa-afee-e9be842e9bfe", "value": "12288:Lk7uGAJwFFjGdNvrwNqi2f0IGvCc+b/owQx:LkyZMNqiIW+b/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304789, "uuid": "22e53fb8-f25c-4c57-895b-6516ee998fb2", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304789, "uuid": "8b079b10-23cd-4e6c-8589-1ce3bb299ccd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304789, "uuid": "542bd018-7973-489b-9d5b-b9ac2ca3028c", "value": "96b4f832577ced8b48363da9d90a70c3938c44b1154f2cdd18ffeddfbb7d53b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735294b5-0288-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770292049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292049, "uuid": "fa0a88c1-6b17-4ff4-aace-53f35d35c9c7", "comment": "Malware payload", "value": "65a4a8a24fbd9cd7585d3f843be9210d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292049, "uuid": "d7eec629-d207-41a0-8de5-98d3ccb5f298", "comment": "Malware payload", "value": "976e3772ffea7499f7c119e956a5a71806f8f054caf174978fa888b254dd22a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292049, "uuid": "efcfceae-f992-40a6-849b-8651fd899c41", "comment": "Malware payload", "value": "b5c5268ad6b270a446a19387b9813696f6ebc9b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292049, "uuid": "204cf9f7-daf1-4a5c-9726-e5a7ba83b7ca", "comment": "Malware payload", "value": "8624495c191cc6c30dbd0f84ef0c9f6e5c3d247b6586bef18639727dacf85054ffdfe658bcca66dfc3b5783183d52016", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770292049, "uuid": "4cef1b7e-72a7-4fa7-b18a-8d9b742155b5", "value": "T1666533CAD6ED5A4184EC5F3C71B03A877510F36311FF24DEA808DA72567E4252EB827A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770292049, "uuid": "9fe4c116-1ed3-417e-8cd6-231523ac2d64", "value": "24576:DgYo2+3cq++VvXi/JbMncb6mgaxGejnsj1wmvn8i0Z0Vntsmkv:DgYAcq+gvq9MvjaxmRKiI0VtsmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770292049, "uuid": "189b9971-baa6-4bd2-a21a-e412705fafbe", "value": 1458464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770292049, "uuid": "13202467-02b5-4ab4-ba02-32ca51f20860", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770292049, "uuid": "2a1b58b5-7a7b-45b5-abd2-e45464a58683", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f66422-027b-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770286422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286422, "uuid": "9ccd2c8b-cfcd-4a4d-8c13-33f2ecd4c6e5", "comment": "Malware payload (Gh0stRAT)", "value": "2c9928e974fa612a660f8501a2e1a32a", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286422, "uuid": "afca586b-3972-488c-8d88-3beddbd83532", "comment": "Malware payload (Gh0stRAT)", "value": "979f8470bc155a62d32041c37bfc8c8abdfec193338ab27940560181899d800a", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286422, "uuid": "c77ed219-1f79-4191-b46b-40def8eb4833", "comment": "Malware payload (Gh0stRAT)", "value": "4990c0cf871b7b8a8eaeddb7f8b9f2a1aa113e6c", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770286422, "uuid": "a0513319-0e39-41fb-a928-4b095ed1bb16", "comment": "Malware payload (Gh0stRAT)", "value": "93383cb0142cdaa2e87778372d7d2a0d6b17034becc72e7015d27485df47144a9b2842b281a879fd076e22a6e6440eeb", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286422, "uuid": "73825ee4-9699-4cd6-9e4f-aebc52b9b5a3", "value": "T111873325B2CBC636C52D007AA868FE2E14B8BE63473151D7E7F97DBA84B48C25374B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286422, "uuid": "cd3b74a6-6ebe-4bce-bd8e-1a9221970438", "value": "786432:vDgJMWLqzdottrSyS2zw9URX5mVWFxtriNDQSnjT8:vcJMvzFH6dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770286422, "uuid": "8c136a10-2072-424b-9695-eb43b47ac84d", "value": 38460416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770286422, "uuid": "9e2e963d-2bd8-46e6-9422-7c785aab9ca7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770286422, "uuid": "6cec6c1b-1c92-42ad-8f44-66c39c073f1e", "value": "202602053.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40817bc-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (UmbralStealer)", "timestamp": 1770306304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306304, "uuid": "965c634c-a99c-4c94-be26-b8d9d8b2070a", "comment": "Malware payload (UmbralStealer)", "value": "d6a08da48daed7f78da3af931839db52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306304, "uuid": "7097a5bc-84c7-43e6-860e-8f437c26e1ba", "comment": "Malware payload (UmbralStealer)", "value": "97d6e783edf9659c4751dccc27faafb28356928d8b625ccafec823ff1df2da8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306304, "uuid": "b0ea7362-4378-4b88-a06e-7d2006be4741", "comment": "Malware payload (UmbralStealer)", "value": "9859e3860ad30b4ec31eaf0b3304209d428a70d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306304, "uuid": "ec27c394-83fa-4029-9e3f-a2cffafc627d", "comment": "Malware payload (UmbralStealer)", "value": "b7f8e5dcfa21fbbe05c20f10032a67339e3027d5bd252e2ccf67a572668c71cbdb2b6a1fdf08fb42d79d74e9fedef80b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306304, "uuid": "c58f7051-4893-46b2-9518-793e7a9afbe4", "value": "T1E0346C4533B88B17E25F8FBE95B1158F87B2F143E90AF78E1C88A5F82411742E849E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306304, "uuid": "01b3a954-4974-4599-8e7e-53176917395e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306304, "uuid": "636dcd7a-7acf-4d11-8aee-8e81b4bed287", "value": "6144:4loZM9XU9Zx0kt8X0/PSCsMxZ2QU69Ve2bGkFZwJxb8e1m8i:moZdf0kkPAZ2QU69Ve2bGkFZw/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306304, "uuid": "6d77d9bc-188e-4cb1-b81d-0e2439b995c8", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306304, "uuid": "52c1e4e3-dc07-4a54-a13a-a951a0fd0834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306304, "uuid": "a95477bf-f90e-4c62-bbb8-f102a65be8eb", "value": "97d6e783edf9659c4751dccc27faafb28356928d8b625ccafec823ff1df2da8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c51886-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307242, "uuid": "bf9c5f74-f83d-4d71-a9f3-3f33acaec7b8", "comment": "Malware payload", "value": "248815d782e4f2a6383a57e56de78ea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307242, "uuid": "84670f4f-0b9f-43ae-a9b2-ff666dd0bef0", "comment": "Malware payload", "value": "980579ae60a59f1db048893155a8cb9cf112c659e03a21aed5189e5b6d703724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307242, "uuid": "773e987a-611b-4f44-93ad-19f47986694f", "comment": "Malware payload", "value": "8a2eb5cd248d958e167931a4f89a562b9c9ce885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307242, "uuid": "9814f654-af53-410d-ac6d-248f67fd570f", "comment": "Malware payload", "value": "41fad3c1c8c072372c14ed157abfa93e0968d68728c568bd7d8c6d493e8f8d38e71ce477369dbe384706f733e64b257e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307242, "uuid": "2e6b7816-140e-4621-bb9b-8a85cba5487d", "value": "T13E445FA6AB00B01EF442C0F53829A65A681D6E760790BC57F782AF5672725E3F4F470F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307242, "uuid": "02812c49-8484-4d7d-8545-6be4ff6ab948", "value": "bbd35690f0fc4abbc22b523491635250", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307242, "uuid": "1e854014-7b5b-4b1a-ad82-ddbce9ce568e", "value": "6144:wAb7XwEabw6e6SwB72Lu6Z8wgNVI1KjBVfhTKKbW9i4qgTHvFQ6hDRmshf:e7K/O31bW9i4qgLvFQ6hD9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307242, "uuid": "27030479-31cf-43ad-853b-9a905bb2bb16", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307242, "uuid": "5527d437-597d-4cc4-8c74-85297514aa33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307242, "uuid": "1d489155-a1cb-421c-929a-d5e49c68571a", "value": "980579ae60a59f1db048893155a8cb9cf112c659e03a21aed5189e5b6d703724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3662473d-02ae-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770308268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308268, "uuid": "602b8b4e-32ec-4974-aeed-9d4b764e8912", "comment": "Malware payload (GCleaner)", "value": "2f1ff072b0d7570e25e80e0caaec9c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308268, "uuid": "24ccada9-65a6-47ca-9d18-5f4502a88d78", "comment": "Malware payload (GCleaner)", "value": "98661c0235e95f9ed8e411a07e9f370179d435bbde0cbb234cec3ddb21a7e890", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308268, "uuid": "2726376f-e1ef-44fd-b174-f51fce608890", "comment": "Malware payload (GCleaner)", "value": "6390e6128cf4f5cb6c7bf9cc44a3ebcf169ff512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308268, "uuid": "e52b4536-437b-46bb-a7fd-f9f4ce64cd80", "comment": "Malware payload (GCleaner)", "value": "d1e3a45d1d8952bd662931a27a5d2437b1935fe5d3188c5e69840f616c7c236fcf41c174521fbb5e4cf1b8b2558ce088", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308268, "uuid": "94e4fe15-90c7-40bf-b11b-94fde8f13468", "value": "T1C4D49E22E1D1B433D0331D3CDE6B92659826BD832D2C69462BE89DC99F357B174263B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308268, "uuid": "d89286cb-8f79-41f2-93d7-5c8aeda24ffc", "value": "07f608b4818de60660a6d587f85c6c18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308268, "uuid": "6df7d55f-9dc7-4036-8308-f8aa8cb231ee", "value": "12288:xTYcy8yZ08zaVh6E3DXDyTG4QBOcjyaHXHmZ15:xspV/YdqTG4QB5RHXHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308268, "uuid": "84abf035-3fdd-494d-9eaf-64fd04c4553b", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308268, "uuid": "a8d47633-9946-496b-ada9-0cad13b30286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308268, "uuid": "b3fe1e63-ac8f-47f0-81cd-3dce4fcf67ae", "value": "98661c0235e95f9ed8e411a07e9f370179d435bbde0cbb234cec3ddb21a7e890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18397b1-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305951, "uuid": "44f75a46-d3d7-4c2f-9a87-68c190729508", "comment": "Malware payload (AgentTesla)", "value": "308f1f57566346fcd549bc99a92175a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305951, "uuid": "ce0a0cc5-b54d-41d3-ae93-d73401d2eda0", "comment": "Malware payload (AgentTesla)", "value": "9872577ae3cfdc450b4eef138b6389555b85ff592c894b7d359058f683ed1753", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305951, "uuid": "23547bef-a907-45c7-93e0-16ac48b51191", "comment": "Malware payload (AgentTesla)", "value": "a71c38fcecaea1c4ce194bb3c6cdc1a990032871", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305951, "uuid": "cbe88703-da6f-4dc4-90b3-1d4e8a1ebdb4", "comment": "Malware payload (AgentTesla)", "value": "8db933f92ee8515af7f79c512899f486e26a279dd82f750b1a28940cbfce7a60f30edba85cff3688a5ae5c3ebf32551c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305951, "uuid": "d7087d41-ce3a-4c8b-9bd7-bd871385cc63", "value": "T1A13512283616DA13D4460FB44932E2B91B38AF8DB921C707CFD97DDBB97AB904D14253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305951, "uuid": "58466017-a539-4bea-92f3-7470e1b76346", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305951, "uuid": "6352a3b1-1471-44ec-b111-f9d34b33ca71", "value": "24576:RHVfwGkq/4ywZMhVNJ+do9dbdTMvT/qlTLMB0s40:RHV4oUZMhVNJ+693m/ql8Bf40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305951, "uuid": "0d707523-bd31-4ed7-84ff-7934310c6703", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305951, "uuid": "53aba813-e7d2-46dd-a30b-fbcb7fdf63f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305951, "uuid": "eea9a2b5-45ce-4d7f-bdc1-af839c51abdb", "value": "9872577ae3cfdc450b4eef138b6389555b85ff592c894b7d359058f683ed1753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81a1294-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770307197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307197, "uuid": "497cc9a8-4b77-4d12-9fa4-f370b898c062", "comment": "Malware payload (GCleaner)", "value": "58d2f84a7ba2bdfee8740126c005e9fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307197, "uuid": "60147c3c-ab41-42c6-ae04-9237c6d81a03", "comment": "Malware payload (GCleaner)", "value": "98998f1a2c74ff7441392f5d01eacfdd2b75121f98bc4da8ebaf9a92185ae7db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307197, "uuid": "f2c21ad1-ae3c-4cf6-91cf-a9be1f471416", "comment": "Malware payload (GCleaner)", "value": "ea49c27d3baa4cc24551bda8ebf4c36e9c0b1798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307197, "uuid": "8e197680-4eec-4eb0-9a7e-3012fb401e3e", "comment": "Malware payload (GCleaner)", "value": "706be5d063f0b7594b3abc72e34f81fa61a5cd61228e5832f52ddd014ae3f2f292f59812e66c55ebeb55a53e2fea38c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307197, "uuid": "0aff9ad8-4639-4cdd-998b-4d719592ca4e", "value": "T12B057E22E2B18033E06717799C6B966C94367E1439389C4A37E9ADCC5F763423C1BB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307197, "uuid": "8de652eb-bc5c-45eb-9c36-6fe379d848d6", "value": "421f57ebeade5946b16f0c3c541d2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307197, "uuid": "def8c5fb-84d9-4873-9f51-b25d8d8c0c67", "value": "12288:y9eONBtJzhKJd6EPXNQyxbLSo2ZgbKGqViN9ZpbbJh0G:4nzz04EGOzcgU493xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307197, "uuid": "e358a833-6530-4c54-9573-fde59f0c1976", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307197, "uuid": "a250d6b1-37de-437b-ad4f-ff3fde221195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307197, "uuid": "9e668f4e-0a5b-4ec3-aebb-1afa0ba59654", "value": "98998f1a2c74ff7441392f5d01eacfdd2b75121f98bc4da8ebaf9a92185ae7db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21bc640-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770305120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305120, "uuid": "f773b1cc-51bc-4ae6-a8dc-82ca9ab329ce", "comment": "Malware payload (SnakeKeylogger)", "value": "0e5615243be67f8a39fb9c91a7a215f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305120, "uuid": "b97cc9fc-b626-496b-828b-fb9729fdc7df", "comment": "Malware payload (SnakeKeylogger)", "value": "98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305120, "uuid": "fe6b5dec-1828-44fc-9e44-3e63a71c4bf4", "comment": "Malware payload (SnakeKeylogger)", "value": "f8d4d27fceb919d28b232690673eefd46eaefcc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305120, "uuid": "c1ee9e0e-4aab-46a6-8630-ecb5de83ff2b", "comment": "Malware payload (SnakeKeylogger)", "value": "fe7ba524b1f2c09941936429fcab04b787a722fd3f056d97725f9b631460d800b1f2581ca1da80ac347db4cb782681a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305120, "uuid": "c4cdcfa5-855b-4aae-9286-9f5d94b49527", "value": "T12F251295379DCB22C9D65FF00665D37423B0AEAEF920C3428EEDADE739607062954387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305120, "uuid": "04879da2-84ca-4d6a-b5a5-f83b049c3a81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305120, "uuid": "7f084b8c-ee59-4146-8221-237bf8112877", "value": "12288:Jc9y7hqTXIH7dSgxf2fwTesttkWZxYuCcH46GvmNj3sBsDAPGM9QDH6CsFkkR:JeWU82fcHkWZxYun9sBsDAPGM9Qr6VD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305120, "uuid": "132c24f0-eabb-452d-88d0-696b3ea179ee", "value": 982536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305120, "uuid": "3fb3bf08-7188-4104-8f1f-cc00b4901efe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305120, "uuid": "e5144249-61a2-43cb-a5f9-f43c8b7ce893", "value": "98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af74d3f1-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770307612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307612, "uuid": "6035f21c-460a-4598-b39d-aef294cbf1c7", "comment": "Malware payload (AgentTesla)", "value": "e0698e67ab30a208a15b27b1f3e47292", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307612, "uuid": "92226ca6-c429-4de0-98f6-ffb88bbca71e", "comment": "Malware payload (AgentTesla)", "value": "98da2d0be1cdf8085be551fcdc0aed78acd580c1f45738a1ce417a479d1d00f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307612, "uuid": "c1bc96f0-15b3-46fb-83e1-d2ba69193a89", "comment": "Malware payload (AgentTesla)", "value": "5603f41bcb9bf78d6cee4aa5ee05331ff2d73cc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307612, "uuid": "2997d8c9-8e4a-4c07-8a1a-a572cd14e613", "comment": "Malware payload (AgentTesla)", "value": "89559cba2488a570b6cd76c88879b282a7f1964a7ae9368a7b6503a10c19bd0c2e96cfddf79a08ef6e2de96592c283c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307612, "uuid": "3327b690-53fc-4e98-9fcc-8404c0863816", "value": "T1674502043669D803D49B5EF85870C2B157BA7E8EA931D78A0FD56CDF38F6B0096607A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307612, "uuid": "4967c29f-7e42-46b2-8cf9-4b60f064247e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307612, "uuid": "c72b4702-a947-4eee-b5e6-90eb30a374eb", "value": "24576:+xjcoseicEBwcSmTVIDPfUnJ1wLemqqUytyocp+gNJW+r1Xyvcc:jeic3fmeD8XOeDhq/WNP1ex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307612, "uuid": "76386f03-013c-4998-b4e1-d1262add6225", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307612, "uuid": "1702a080-6777-401f-9fec-c5a095dfa9da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307612, "uuid": "7dd1f096-168d-4a3f-b805-9806d5a2cebf", "value": "98da2d0be1cdf8085be551fcdc0aed78acd580c1f45738a1ce417a479d1d00f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54fa501-026b-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770279678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279678, "uuid": "4c211c9c-e719-4586-a0d3-8e7420df0cf8", "comment": "Malware payload (AgentTesla)", "value": "ad8b60344d3c117f098c0f309e9c238e", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279678, "uuid": "2eba1482-99f4-4b80-bb53-08490ede2e82", "comment": "Malware payload (AgentTesla)", "value": "98e62a8415a581b337aa1bceed208d21dd5144bf615940cdc440fe374d5da248", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279678, "uuid": "b63f00b5-3336-422d-8ca9-4712b5ececc6", "comment": "Malware payload (AgentTesla)", "value": "5b0882c1c9fa24a7abd5282503f78cf3229f2233", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770279678, "uuid": "264b19ba-0615-4a6b-8f06-4a3909156646", "comment": "Malware payload (AgentTesla)", "value": "167d324fd8dbbdad5206f29d6f0e4fb3edd1275bed4ea1fb61a8ad1dedabf1d3ba216adb3664ae7d9215ecca69452c1c", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279678, "uuid": "987173ed-94f6-424c-9e41-d1c6d6d53c9b", "value": "T1CE4394CD3EC3B0B90AC534636E2FA0D7F66E5E846C4C9158C21B2DA6B46435DCD366AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279678, "uuid": "1d04ba7e-7862-4ee3-bae5-3e8a3b95f384", "value": "768:LNwH86qybJPiXgi/bE/XAmMnviWLd4WI1TYmSCvtfryz0pQ5LxNMAVcQzcTnbo3W:LmTqybuHw/XMn3ZTyMkzNpQ59NEQzcsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770279678, "uuid": "2652dc27-35a3-40f3-b87d-8f67da6f097b", "value": 56452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770279678, "uuid": "f8e19168-39a7-4f1e-98f9-846fefa205e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770279678, "uuid": "825b1950-57c7-49a8-aeb4-6f174e9a7f4a", "value": "INVOICE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ea8335-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327217, "uuid": "cdfe5e39-b0f9-495a-8a33-facfbe07bb86", "comment": "Malware payload (Mirai)", "value": "04e0d974ca946d63c8d6e317216fcd39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327217, "uuid": "00980e23-31c7-43fb-b13d-e79d024864cd", "comment": "Malware payload (Mirai)", "value": "98eb5b795ff9ad48cef00b09a1c4448415d869d2f60ef04b9a54ae45e4d69e21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327217, "uuid": "b9b79718-40bb-4109-a0d0-8689cccc47ea", "comment": "Malware payload (Mirai)", "value": "50c3d4f32f2b3ab61fdcb1d2dc64d2f2e1785ce5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327217, "uuid": "53200065-47c3-492b-98c8-d6d24442fcfe", "comment": "Malware payload (Mirai)", "value": "81c737a61c2d13c228d7a1a562ceddddb2032d44b8229d9c6955b06b38339ffb8d8de1abe3669365b63d524755b8d17d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327217, "uuid": "944c708f-2ea7-4808-8048-db4350e43c9a", "value": "T19E639E16D82109A9C28685B471ECCE3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327217, "uuid": "1ecb6bfa-b873-4891-9df7-7204d28e5914", "value": "1536:daT/uMkOtg9iYv2ZKsT5Z7BPxznCI0sCp8udQ:dWVkwgAYugsz9xznsxrdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327217, "uuid": "2570a0cc-f42a-4e3d-80b5-e7bc7a7263ac", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327217, "uuid": "00148fa3-7817-4016-b381-537a6fa766fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327217, "uuid": "254a9741-87e7-4187-a098-af1e74fe50ef", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8315cfe-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770306822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306822, "uuid": "7268c483-29a8-400b-bdce-b6e26fb44475", "comment": "Malware payload (AgentTesla)", "value": "40cf058065441854e21114f3313b6ea8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306822, "uuid": "fcac5b0e-59b3-4a0b-9714-c2f1e6dbfb3f", "comment": "Malware payload (AgentTesla)", "value": "9987ec2812cd79f25cd60af929f8d42abaf34ab3cfd54f56da6268805e401487", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306822, "uuid": "e04bc8a3-0a71-4e4e-bd41-165fa1a16dc2", "comment": "Malware payload (AgentTesla)", "value": "fb892ee3e54fbf21a3f8cbc911127cab37d5ff86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306822, "uuid": "5d847446-3e1c-4f9d-b4fc-9c360fbd1a50", "comment": "Malware payload (AgentTesla)", "value": "6d88225631d263eff032591b949ade5dc176f856f5e320181bc0ef09e7a220c5b9a1ca2d0c3082cf583a4724416f2f40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306822, "uuid": "3d85137e-6b6c-4092-be1c-c9b4cd870326", "value": "T16435DF0813D8864CF8BD9B349177361147F0B81AD976EF9FA3C460B91C36BA49697B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306822, "uuid": "eefdd078-05d4-4cf8-8f6c-56d09a97bcb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306822, "uuid": "b55dca7d-079d-43f9-b039-d7e94c8cd3d0", "value": "24576:XdfMs1hsAdBen2pqprk6Kr0QwmVxEUXiTBdu:XdfTfeT7Fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306822, "uuid": "4310e255-daa4-4df9-aa51-545b3d8166fb", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306822, "uuid": "3ee1be17-7d26-4917-b4e6-ddbcc550600e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306822, "uuid": "e96d590c-fa90-4686-b7aa-34115cdc4db5", "value": "9987ec2812cd79f25cd60af929f8d42abaf34ab3cfd54f56da6268805e401487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab2cfa9-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307121, "uuid": "f5e890d8-d668-4107-98d8-16c91ad04c97", "comment": "Malware payload", "value": "0e6e1942a740723438b8b5e9bab31d78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307121, "uuid": "1752856e-aebb-4a50-8431-357d1f922de5", "comment": "Malware payload", "value": "9a3a5ba300aaa963d2fa346a6a117b153d86ffe69f0a4e0cd29712467d0ed50e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307121, "uuid": "e0fb0db5-19ea-47f6-81ec-83e34de80bb9", "comment": "Malware payload", "value": "69b5cb499357f2d5a1eee03ac85a30512f52d1c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307121, "uuid": "363340c4-0c8c-49c2-8e4a-69145fcee521", "comment": "Malware payload", "value": "4d3201899d36d9d8416a674e944d77383c13a1b33118ec09a42c782b0106c9b26eb451b48dafaa7b1807d8f893f8246a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307121, "uuid": "4b99b02c-fb2b-444d-8984-fd22e3fa210a", "value": "T13AB4B416E660B426E89744713E79A287791C3C3A2680EC4FF7889F4A3671587B0F971F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307121, "uuid": "8ab6ccd7-c047-488c-9b6c-c476c5a0f339", "value": "b421ea50913bba05fb82ea8c68fdaf15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307121, "uuid": "54858d86-4e39-47d6-9d08-991a62b36aad", "value": "12288:xR05Ka70HQDCR/YhTi6Z0I8leNRKO2EAMs:V20HS0Jl7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307121, "uuid": "7ada3b2f-97f7-437c-9f10-7be06406f203", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307121, "uuid": "341dc39f-3e0b-4a40-b1ed-bb089d39e70a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307121, "uuid": "a7988c32-48c7-41a5-aba7-0a44f583a1b0", "value": "9a3a5ba300aaa963d2fa346a6a117b153d86ffe69f0a4e0cd29712467d0ed50e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f7f785-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307704, "uuid": "21724255-83d9-4ac3-a202-57447a010c64", "comment": "Malware payload", "value": "1743c4d5ffc5be0a40361d613adfe826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307704, "uuid": "8e1fb4fd-ad17-4807-82ff-f770b7e93457", "comment": "Malware payload", "value": "9b0f247fa2f7c2f27f0b5db849d8869538e65ecd32f77b48f4820964190e1876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307704, "uuid": "b7dbcf0d-1cc3-475a-8e67-035631dd4a13", "comment": "Malware payload", "value": "02b3da4276a961ade0cc48ffab9f8b3f4a0adf43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307704, "uuid": "294dc33e-38fd-43f9-8708-29c72464d67a", "comment": "Malware payload", "value": "1c5185f09d5130d620c61ea34afd8765f481e2009b32e4fd904fd097a5d105d7509efd54b8eb0b587d1c60cbd5803a39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307704, "uuid": "1f61f12d-0b3a-42c0-99ce-0909256356ba", "value": "T1F0152244726DC603D1AA9FBCDD60E17927B8ACAD9A01D20B4FCA7EDFB039B51950131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307704, "uuid": "bb54ded1-c20a-4363-88f2-c22f8458bf82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307704, "uuid": "07b09cb1-f00f-4764-8c5c-5d25c8856c6f", "value": "24576:kW8l1f88Z/ELYJONR2fUEwsBpn6cq1oYzAP7C:58l1fV5ELAmR2aEK1Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307704, "uuid": "89a47375-c855-4fb7-9254-7f5ebe98c1e7", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307704, "uuid": "e7567b2a-8426-4849-bfab-8320a4f37f46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307704, "uuid": "55437af5-9275-4137-be23-76415706326d", "value": "9b0f247fa2f7c2f27f0b5db849d8869538e65ecd32f77b48f4820964190e1876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8fecb4-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770306374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306374, "uuid": "42c7f04f-9274-452d-9d24-d34bc3fd1356", "comment": "Malware payload (GCleaner)", "value": "a56c130d214c92764326caaef428a9f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306374, "uuid": "c1aa00fc-969c-46d5-9c67-c583557f1ff6", "comment": "Malware payload (GCleaner)", "value": "9b32f0d2865faf34e64365a0491ea36e9a09794b87de25d4c03f612f1132d21a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306374, "uuid": "ad506861-be3d-46bd-9d4d-d5e71ab8f4e1", "comment": "Malware payload (GCleaner)", "value": "1f59db3ce33db3166b196f7accbbd5a9c1a4cc97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306374, "uuid": "62da7905-de3a-4d43-a2e2-c38f6cbcc1cc", "comment": "Malware payload (GCleaner)", "value": "8b65b2a92c7da2bd987f5f75356a4b0f13b82a1aeb3b396b9fcd0e74a9dc6a51daee82adcad58723ac6d3bfd7238c416", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306374, "uuid": "609fc637-52e9-461b-84cf-474fd2f6a0b3", "value": "T1AF16E03D508378FEF8A5A67C6F0AE8DDF4D2A9315D99161F0BB82ECD8734259200D972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306374, "uuid": "48e069bb-6dc4-432b-bcb0-6fe3aa22991d", "value": "fbd9744ea458801c15794b746fb79ba9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306374, "uuid": "80b14571-c606-49b5-a71f-52ec85ffeb64", "value": "49152:DVQDgBHQNRpMiyafqdn8X7Odpt2ls3M9hKP3xPnufyxh1969AR7Y5dLZkC/yzOS8:DVQuARpM1afpXR3ToBPRlS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306374, "uuid": "d7180fa9-364b-4eb2-9b85-fc63112a898e", "value": 4366336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306374, "uuid": "bb6b5246-a3e7-43be-8885-dc0ce9958116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306374, "uuid": "bdb2c1df-49a0-47d9-9758-66bca60c62d6", "value": "9b32f0d2865faf34e64365a0491ea36e9a09794b87de25d4c03f612f1132d21a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f875c9-0266-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770277340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770277340, "uuid": "7800b71c-450c-4c62-a04d-af2ad0886127", "comment": "Malware payload (AsyncRAT)", "value": "0bfe23bcd09166f9d77427e155949a76", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770277340, "uuid": "a8d5f145-ed63-42e0-8ec7-a2e4fdd293ae", "comment": "Malware payload (AsyncRAT)", "value": "9b8d72d1a03fbc62aceda0d7e071474fa88f81624ce6aed1fd77f4197cd96305", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770277340, "uuid": "9d179a8f-54c9-412c-ac93-b6210d05028b", "comment": "Malware payload (AsyncRAT)", "value": "429d214bc1859a6fe626e7d0394eaf1deef8a49f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770277340, "uuid": "6020a3e3-f6e6-45ec-bb0f-52e7227b495d", "comment": "Malware payload (AsyncRAT)", "value": "4816dc4ba8fc9bfb2fac1161272d7b9cbc11ebc5724a51f7f420e010213b995dfeb36c0d4a610601db8e960760cf347f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770277340, "uuid": "980e0d8d-ef7e-4eee-973e-f56cc9b9e9e1", "value": "T10D2512612689DE26D47B57F90031E2B063B9AE6EB011C318CFE9FDDF76A5B912464303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770277340, "uuid": "f0aed4f4-61e9-4154-b797-031a01e56992", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770277340, "uuid": "a23d9dd9-bd2f-4bfe-80a3-367a26f2bedb", "value": "24576:rguQ8Zqt1/9zUqCOweMb/dDtYJ6fmDyQ5CPNAUq/XUK25IR7ckBf:0uTZqt99pfVszYERQ0ikK28bB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770277340, "uuid": "42b8906b-80bf-472a-a531-fb8d038389a3", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770277340, "uuid": "be080720-bd68-4051-926b-c9d88d93fbdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770277340, "uuid": "234ee674-d857-4253-8141-ea0a04a2179b", "value": "Roll Over notice for EVER LUCKY 0769-082E. - 2X40'HQ CLS 19 & 116 & 123 & 130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900c29c3-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304982, "uuid": "7b3f1112-2265-4944-b7ab-f335d5dd93c3", "comment": "Malware payload", "value": "ce707c6716e56ebe4072b9c551f68185", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304982, "uuid": "f9041c33-da3e-4549-8582-c6ef818524c4", "comment": "Malware payload", "value": "9c4ec04e2cc150689b8c1031e7624bd3614eb4784f79a8c08d9b0b6d1a489f7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304982, "uuid": "4097527e-3139-4b22-bfd8-233e920eefaf", "comment": "Malware payload", "value": "98090759d880fc7e97860611595c4ef5eeed9e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304982, "uuid": "6d060a6e-b008-4eff-b57d-297c34426ec0", "comment": "Malware payload", "value": "02fea76cf52dc10922fe52653fefec4e02d2cd35174a5dbaa1532fb6ada34f2cfabf72622c134143112239340c6e9a42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304982, "uuid": "b5f18746-da27-466c-bb90-e936a8d16b4b", "value": "T1752523C5B645E393CC6480B2DA134DF7165BAD26E250393366C6BF2F39BB553832A123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304982, "uuid": "0d8172bf-9fd1-4d1a-b2d5-8d2c5237925e", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304982, "uuid": "9a3db79e-66e0-4332-9db3-68648568198a", "value": "24576:DGEusSW25jCmjC8sz3SMafmF/Oyasbn9o1NDQCGV:Kk6jC8C8sTSMa+F/Oy1Y5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304982, "uuid": "520ac824-8b4f-4fbf-917a-6236ae8108e3", "value": 967304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304982, "uuid": "bca5469c-4231-496f-8769-6a7e6b40759c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304982, "uuid": "23b7853f-8662-4fb1-8ea9-05b72709e0c5", "value": "9c4ec04e2cc150689b8c1031e7624bd3614eb4784f79a8c08d9b0b6d1a489f7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606e0d6a-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770304044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304044, "uuid": "260f9a71-6936-40a8-8482-200cc71fdae7", "comment": "Malware payload (RemcosRAT)", "value": "1f1667d0647514ed49578698d5992e36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304044, "uuid": "ae588c93-07f2-4ec4-be79-93f38ac0e9be", "comment": "Malware payload (RemcosRAT)", "value": "9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304044, "uuid": "ede9ecf8-aa7f-4e5b-91f4-3d5eacac960e", "comment": "Malware payload (RemcosRAT)", "value": "1e072f8257180d00d8846d529ba5c8fdf1834caf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304044, "uuid": "5eced89c-166a-46c6-91be-f6d4ab2efaa8", "comment": "Malware payload (RemcosRAT)", "value": "89b3e0673d331aa0e6fe1d74ae33ec313414abc26eb707e81931a8f857a6ce422e12fdb4198730d4cc1eb0099ea59b81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304044, "uuid": "a6cc9141-9995-43e8-8207-6cccb52c8cbf", "value": "T1B81523952592596AD1A5A330C423CC60C638BE304F47772E4B3CA92BAC383D7F977A5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304044, "uuid": "17a4c249-c8f0-4113-956e-08aa9f6830e4", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304044, "uuid": "69c0d918-09c6-4917-911a-7b653827ad3c", "value": "24576:Sf+iN57Gtene3W7gipT45hIeHFciTyLzOXEu9JslR:8LXKtene3CgiReJFizON9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304044, "uuid": "f572b5a2-54f3-4b96-b01f-3f03c3eaa03e", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304044, "uuid": "28c22d6a-87ea-4b4c-8a5f-9690fbc71811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304044, "uuid": "1168628f-0694-4201-8480-752f2de59130", "value": "9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1a2e93-026c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770280115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280115, "uuid": "81b81eb1-28df-4ebd-af48-99e947ce0fd9", "comment": "Malware payload", "value": "edb1ff66ac68bed5fa3a24753a4499c7", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280115, "uuid": "629fba52-4f7e-445a-aae7-26698f112b77", "comment": "Malware payload", "value": "9c9c2539e73f2ce45d2ec7b8c57e4086382f5101605af8b057e32599e91b0780", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280115, "uuid": "d8c9385c-2fa3-4aa8-921d-551e7b56dc57", "comment": "Malware payload", "value": "bd5042a44f3e1cf8865fe4ab66f7b22a58503989", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280115, "uuid": "7cd477e2-ff6e-4355-86e5-b42542601f89", "comment": "Malware payload", "value": "434d16cc5aa15b35b7ef84f32771a386218d1d7b6e6a3e9ded3f2eabe047fdd89645f695eb26a4e5d2f30d5deb7f618c", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280115, "uuid": "b759d981-265a-4995-adf3-01f47ff28cf5", "value": "T192C51111CE26CEA1095CA60424AA5C8716514DB34CA47B767F9E0F8E2F0F91FA4763FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280115, "uuid": "4a9bbcf2-40e0-489d-922d-4679c1c30be5", "value": "24576:W9dG/hlAMumkzQTl6GDpcntBxrf2sRsgLJ1jLm533tyIs1GArNxjnlIpitHxIEcA:rPyzclLDaK4iSHxsRy9dWEfnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280115, "uuid": "202d7c49-5b6c-4d83-b33e-7101dba24b04", "value": 2520325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280115, "uuid": "18d7041d-2020-4393-a9ca-bcc90e68e925", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280115, "uuid": "8241f59e-520f-475b-97f9-7eba5cecb094", "value": "kkmk.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0523d158-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770307326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307326, "uuid": "c214eb65-b526-48b3-b9d0-c53b7d449a3f", "comment": "Malware payload (Gh0stRAT)", "value": "d0361898eae57b4e72e69a71b12e6453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307326, "uuid": "1af04ac0-1db2-4e2d-aecb-274ab39ac470", "comment": "Malware payload (Gh0stRAT)", "value": "9ceb3e4be5a31a892e9af744b4b8cd297c60b52c9b2793a1dfc486f484b9e38e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307326, "uuid": "a1b8b55a-8c1b-4506-8b41-ab85522604c1", "comment": "Malware payload (Gh0stRAT)", "value": "483665a7b52e4088f814dff46b8ec7a5ee53805f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307326, "uuid": "966e2098-319b-410d-b3d4-09e16c35038b", "comment": "Malware payload (Gh0stRAT)", "value": "46ae89ab50c736c3427e90dad803a3d5996efeb6d74b6f4a00414b7863dded2206af47b7fe3f899315599784bd672a03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307326, "uuid": "16ef8fdc-ad03-469c-8e93-bfe0fe627732", "value": "T1C2344B77F38986DAD02A44319495677BA5682E320B4F1167B3A4FE2E1CB41F46322F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307326, "uuid": "b69addf4-9de0-430b-93bb-3b3b42fae848", "value": "2a970e808d4db33b04a60a6da411cfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307326, "uuid": "97abee14-f1ed-41ab-8d99-d870b5d9c6a2", "value": "3072:CZiHYaR958cezUMybZmsLC03xw+N028IuUG6lh+VAwdofEtLYwSAlQNSV+ExNf14:CwHYaR95PYLm8v0B1OJIuUGfduGYG87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307326, "uuid": "bde78230-6ded-453d-b015-af4c0a5e07d0", "value": 241708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307326, "uuid": "ac3b93c2-01a7-4bdc-97eb-7308b00fb50e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307326, "uuid": "b8f5d12c-1d7e-4890-9cf7-f734d6d9faf7", "value": "9ceb3e4be5a31a892e9af744b4b8cd297c60b52c9b2793a1dfc486f484b9e38e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ed489a-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305267, "uuid": "6d7a829e-acd2-431b-81de-54ffa75a0051", "comment": "Malware payload (AgentTesla)", "value": "11c1678b30a3e6117c81e95921eb93b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305267, "uuid": "c6ae3ebb-9834-4e5a-a5df-88f9e20df185", "comment": "Malware payload (AgentTesla)", "value": "9db391a8c3733e5737cd410ccb2cdc9ff2d059983053a10c7f7cc64613a854c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305267, "uuid": "430545b2-4b66-42fa-9b40-72dd921ee0bf", "comment": "Malware payload (AgentTesla)", "value": "f9313631a35373e4fb186729fdcce138db944c68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305267, "uuid": "e2e45d75-ffa4-4ac2-bc37-93a4495b7201", "comment": "Malware payload (AgentTesla)", "value": "90791acf9902acfa517802323ee8df69605af215e086781f4bcc80be9f8f81a3da293289828f4ee57cdbfc05eea28c25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305267, "uuid": "a3bd4c45-6f6e-47e6-85d1-10f0d6a8e3b9", "value": "T1C735AE0273D1C062FFAB92334B5AF6115BBC79260123A62F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305267, "uuid": "640ad774-5f10-4947-a381-649ab4187c92", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305267, "uuid": "6901bccf-7d87-45a3-bb72-a36b5ca6da5e", "value": "24576:S5EmXFtKaL4/oFe5T9yyXYfP1ijXdafbfCzq9CfCn:SPVt/LZeJbInQRafzcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305267, "uuid": "4d31a83e-16b1-48a8-90b6-71aeef48edee", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305267, "uuid": "74a72243-f61a-4529-b708-6062c715eb6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305267, "uuid": "6574057a-5188-4d3d-b235-58c223f1a7b0", "value": "9db391a8c3733e5737cd410ccb2cdc9ff2d059983053a10c7f7cc64613a854c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09478445-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307333, "uuid": "e8a2c9ef-f30c-467a-a2db-f2def65aca43", "comment": "Malware payload", "value": "bf78d7658bfc8a79acbd6f0ff55c350a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307333, "uuid": "c6198386-1026-465a-a12f-0b613d962dcd", "comment": "Malware payload", "value": "9dffbf3a1477bcfc0a12c1cdfbeea8861c06dd5182240353efbc54ec8253603d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307333, "uuid": "06109786-02a5-4021-af12-59f613aef67c", "comment": "Malware payload", "value": "80e4ef68d40ceeab9ba3f5a4d44c66152d7fc9f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307333, "uuid": "7465e241-eb9d-42b8-8bcd-8294445a0416", "comment": "Malware payload", "value": "7342a68c316140e4173c00088b5b9a1fbbabdba2c2f3c2ccc754b1b400222152c82d60385d859c98c3ff3e882c3ed1dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307333, "uuid": "96264983-8759-41a1-8668-6e1df8b52759", "value": "T1BF247A67B42CA7AFDEDA2F32ADDE8A2353A65FC4C990103E0C44730E3C671095E39566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307333, "uuid": "5c6d8f3c-a8db-4c5c-992f-b8436c12b220", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307333, "uuid": "07326526-464c-4336-a718-cbed675938ce", "value": "6144:mynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g3z:FnO56dyO7Wc8oNrRHwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307333, "uuid": "440c236b-f2bc-4e6b-97c7-5e5485c80179", "value": 227926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307333, "uuid": "5bd3fed0-5d8d-47db-8f0b-6d906fc958e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307333, "uuid": "02397a43-3044-4abb-b28c-607f49669af3", "value": "9dffbf3a1477bcfc0a12c1cdfbeea8861c06dd5182240353efbc54ec8253603d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbae2a2-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770306881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306881, "uuid": "12eba7ad-df44-4293-99fa-7fd0672d1faa", "comment": "Malware payload (PhantomStealer)", "value": "5a94acb1947d7abe2daa0fbb5b90371a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306881, "uuid": "bd0321dc-d5ca-4f7f-9f56-4d29a93bdd73", "comment": "Malware payload (PhantomStealer)", "value": "9e57f2f14606901c01d6d1cb6d7ff78ae5615a765f5798887e666b7328cc739b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306881, "uuid": "a7e098c6-0cde-46a3-85e7-b46531df6fbf", "comment": "Malware payload (PhantomStealer)", "value": "4f2bdcecdf1c5e2fe834e74663841373bc899bc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306881, "uuid": "1ecf941b-2421-4df0-a478-515df970e6f6", "comment": "Malware payload (PhantomStealer)", "value": "01acbd72b271126749f1deb941c6f7496b85a1e83f3c682fe1f8d120f566c86a341f1b4b1ccdba23f8072b6803c05148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306881, "uuid": "e534826c-07e6-44a6-af61-3bad4746fbd8", "value": "T1DA75D0027391C062FFAB92334B5AF6115ABC79260123A61F13981DBEFD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306881, "uuid": "b3522777-687d-4b57-9db5-2f2affbea466", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306881, "uuid": "8cd8f4f6-1f96-45d8-8e85-12b426d9033e", "value": "24576:M5EmXFtKaL4/oFe5T9yyXYfP1ijXdalaPVIs1RURJ19VN/odIPe1PWU+Vo+ar:MPVt/LZeJbInQRalaPyys17NAtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306881, "uuid": "1db390fa-7f38-4f06-871c-5fed4729cb33", "value": 1691136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306881, "uuid": "5ba9a419-fb07-4f66-8ba4-bc0012b4a224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306881, "uuid": "431618c1-0f10-4729-9879-3417bb90f7dd", "value": "9e57f2f14606901c01d6d1cb6d7ff78ae5615a765f5798887e666b7328cc739b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5953fb6-028f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770295194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295194, "uuid": "791a6d39-64e8-440a-8911-351107eb6213", "comment": "Malware payload", "value": "97b3f5d523bdb226514675ea1c4a4962", "object_relation": "md5", "Tag": [ { "name": "CVE-2019-11580", "colour": "#894B61", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295194, "uuid": "c0821c24-c9d3-4211-b304-738d65c3eae1", "comment": "Malware payload", "value": "9ed487498235f289a960a5cc794fa0ad0f9ef5c074860fea650e88c525da0ab4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2019-11580", "colour": "#894B61", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295194, "uuid": "36ecd050-a8b0-4191-bde0-87f613e76589", "comment": "Malware payload", "value": "c926186e9c39ef9e522fed57f19aff80ef3eb904", "object_relation": "sha1", "Tag": [ { "name": "CVE-2019-11580", "colour": "#894B61", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770295194, "uuid": "c7055c41-59a9-4edb-9e86-7264e80b50b6", "comment": "Malware payload", "value": "099b512a1312970e2312f908b06f8e461bb0ef345685d09dbdb7ee19f36b1fbd334a69e859a1683222ae969377a6eaed", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2019-11580", "colour": "#894B61", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770295194, "uuid": "7ce2c969-2140-45e6-86fa-47676baa7eab", "value": "T1E3312265A20A6D1CDF4F6C36C29CD8C1D1D5C2584207D94F3BCAA3E0CEAA100A775F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770295194, "uuid": "2866882a-04d2-439c-8a89-84db67e474b0", "value": "48:9wbJ9LcEOLv4Vtsfn8xKLpXxs8/0pgZRLnLr:KpO7468UNqNC/z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770295194, "uuid": "8168fa0e-d5f4-4aa5-8ccd-e659e830c793", "value": 1757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770295194, "uuid": "4e1588c2-908a-4f9c-92e7-0a4f0573fda2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770295194, "uuid": "34714ddc-8a68-49aa-91fe-7168bc8ac0e5", "value": "rce.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1416e06-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770304206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304206, "uuid": "23094e98-0920-4c8a-bfc2-eaacd8ae95c5", "comment": "Malware payload (RemcosRAT)", "value": "bed965ab1c0fca67cab238ae8b4dc4bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304206, "uuid": "a97143a0-bffd-4924-96b3-1a7b8dc8aa80", "comment": "Malware payload (RemcosRAT)", "value": "9f1ad57fea9aada4083b99e984e33f2cbdc7668b031f815ae94fc8f7b7919e4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304206, "uuid": "49d9dd82-14e7-4c16-8d6f-daa4287c2bae", "comment": "Malware payload (RemcosRAT)", "value": "a3aa9e241a49c3df6ec4384bb561787477fc40f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304206, "uuid": "0d29653c-948f-455f-8e61-14fcc66c2d35", "comment": "Malware payload (RemcosRAT)", "value": "39fe201cc6e6dd6e59b04fbe9bea72527c9d504c640559e9a5511a3587b220ee273a49a1667e7b5612016cfe4ef7683d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304206, "uuid": "85d425b5-773c-4ba5-8dc0-0d1f69c514e1", "value": "T15C55C00273D1C066FFAB92334B56F6115BBC7A260123A61F13A81D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304206, "uuid": "0424310d-1e99-4ba3-99d9-a9da2ec0bcdd", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304206, "uuid": "229b0227-0773-4392-9c1b-6c03bfa4eba4", "value": "24576:G5EmXFtKaL4/oFe5T9yyXYfP1MAXDzGVgipT45hIeHFciTyLzOXEu9JslUO:GPVt/LZeJbInGizGVgiReJFizON9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304206, "uuid": "fe0bfc79-026c-49de-960b-93e1125e3d36", "value": 1393664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304206, "uuid": "64341327-f187-4680-9a1d-84ff958b3f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304206, "uuid": "1ccb8ece-02fa-4d31-bd5d-cfa2dd56a3b3", "value": "9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ac2f56-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770307027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307027, "uuid": "423dd117-403c-42a6-8ea9-66b09b926a00", "comment": "Malware payload (SnakeKeylogger)", "value": "3269707498a2c18a80096477086f89f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307027, "uuid": "6c914f21-e3de-4cbc-84c0-103ad29cd649", "comment": "Malware payload (SnakeKeylogger)", "value": "9f78cead1c1a44df037614f4d53bd5fa9a65c7f64434a1ead3f174f4f91d4bf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307027, "uuid": "c53df5df-3a33-468e-a65c-4a9b6d8aa561", "comment": "Malware payload (SnakeKeylogger)", "value": "63aa5f1f12ac1ffdc4d1e62e2afe3af6094e342c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307027, "uuid": "c6080651-94bd-4ea2-bbad-00fe91f0bff4", "comment": "Malware payload (SnakeKeylogger)", "value": "40d9132f817afdb302e14e3708db7c2192daaa41383561a30d80535a6fecc06bb2845de2e1c7768e0b7936b2863cfff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307027, "uuid": "7175df8b-178d-4254-82fa-8f5704d6383c", "value": "T16706120233D28062FFAB92734F56F61146BC79664123AA2F13681D7DBE705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307027, "uuid": "4c170033-76fa-4a60-b024-f8eda26ff6c7", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307027, "uuid": "e755cc72-de93-4c48-898a-94094513d8c2", "value": "98304:iTYbInQ2XuOsiJkDVh0kmesSGKS2qkREy6:icb2R5TkDVqkrxPqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307027, "uuid": "ca2f6b61-1780-4f99-bc70-75f498435dfb", "value": 3755520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307027, "uuid": "53f95819-e5b5-463d-89ca-1ceb53f7a376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307027, "uuid": "7cccfc8f-0394-44c5-b7b1-c75aad7ef996", "value": "9f78cead1c1a44df037614f4d53bd5fa9a65c7f64434a1ead3f174f4f91d4bf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f005b0bd-02c7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770319317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770319317, "uuid": "4c5a60a1-c44c-487c-bc88-fb93b5bebe6e", "comment": "Malware payload", "value": "2f7dbb40b432db8cbb9a479129db1bbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770319317, "uuid": "2adb4acd-8d63-4ece-9a63-5d7439a45daf", "comment": "Malware payload", "value": "9f7ccd553e132ff2dc25abc6d607165a8d44d35d8c6eb55fbf331bc1312e4fe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770319317, "uuid": "17a8d273-9343-45e7-9bb9-ff1dfa85cdff", "comment": "Malware payload", "value": "57e4158391f9ddbd971b2bb8746e0dde46cb068e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770319317, "uuid": "e95984dc-30e4-4d6b-8049-59271b3c11bc", "comment": "Malware payload", "value": "f56667d0bed75b415e4d3e2eda2219c1e237f2a66aa98dda487dc32fc2794812f2957e78394385a169e97f1dfd0cbe2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770319317, "uuid": "a097a856-78b1-43e4-8575-4f2e321a31ac", "value": "T1D9873315BED1A9BFEF2355FC9106C5C7AE9A88F601C1817317F049E78A200D58A1EFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770319317, "uuid": "3d17c544-66ce-46f9-b697-aedc13832e7f", "value": "ec3d55528df9b48ff8e5d2ff74321ad6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770319317, "uuid": "6b146d98-704d-43ef-8895-b22b2cf1caee", "value": "786432:6FRMs+NfBqnzM07m3DR9qd3z9JY8HKw6DyPteDeCOdeuKF1bvYB:6FKFNYg078DR9qd3xC8qwayFeDMnKTvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770319317, "uuid": "e38416fc-1da3-474a-9982-7b87532654d1", "value": 37194864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770319317, "uuid": "f71dab1d-0a9d-4b04-b7fb-4a9f72f9c6e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770319317, "uuid": "b8e2cdaa-941b-40b6-a6c3-3f2bd5dc22a5", "value": "9f7ccd553e132ff2dc25abc6d607165a8d44d35d8c6eb55fbf331bc1312e4fe4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b1d522-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770304160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304160, "uuid": "2a83d89c-9422-4876-8e75-5b3ab9b8637b", "comment": "Malware payload (RemcosRAT)", "value": "07cf9158e60e50a48541f588a19fd260", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304160, "uuid": "51ebec8c-771e-49f8-b1f0-d6a0db01ec2d", "comment": "Malware payload (RemcosRAT)", "value": "9fd1aad12a799ea404fb8f76c6ca86107cfb7fd61f5d262553c9b96e2892e21c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304160, "uuid": "807c09ce-2a31-4e20-9720-5f022aae37c7", "comment": "Malware payload (RemcosRAT)", "value": "4bc233be5d2dcbeb98f435bed7052b74daf56e8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304160, "uuid": "480d4848-c3e0-4fc3-9a6f-98d90265e2bc", "comment": "Malware payload (RemcosRAT)", "value": "a4b3b194788b52db619877a84c166f0498444ae0aba5b4c967cea93f3ca65c8c2e179b6edf2a6a5dda3a3c2a5269c7a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304160, "uuid": "6d7d25ce-b074-4f17-9671-13dd94626d32", "value": "T15CA40273A745DCEAE64104B188B2A7E026F47FD119504A4B7165FB3A2C362CBC91B9CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304160, "uuid": "5e49c19f-d781-44b0-a9b6-67a4d0ed1aa2", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304160, "uuid": "457a3c8a-d82f-49be-8096-1b7979c77e7c", "value": "6144:q6dQC6a5KqBFf/C9sEJRD19fan2ZK83T5X61okoobKn7saucs7t:9NBFfcHvfYQThFxobKnAaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304160, "uuid": "00883562-eda4-45d9-9f66-f6f26f9d3237", "value": 476048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304160, "uuid": "8e03d635-0599-4855-8221-3731ea11775f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304160, "uuid": "92e935fd-bdb6-466f-baaa-0a7d5337631e", "value": "9fd1aad12a799ea404fb8f76c6ca86107cfb7fd61f5d262553c9b96e2892e21c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581dbafd-02dd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770328511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328511, "uuid": "329954f5-a409-4e40-bbca-a74a25a716a3", "comment": "Malware payload", "value": "f36601482d6cde6328d750a2781f0996", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328511, "uuid": "cd4b5f83-907a-4c95-bacb-04f18bd90b9c", "comment": "Malware payload", "value": "9feaff1c818eb260cf4e11b8ce045b386a8fe29dbfa6f4e61668b50047e84a4b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328511, "uuid": "7bfad066-c1cf-42f0-8741-13c38c6ba066", "comment": "Malware payload", "value": "ea85e4e0c86357362bbc95f47caf456e59326155", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328511, "uuid": "df479003-b475-44c4-a4e0-648676c92a67", "comment": "Malware payload", "value": "a0d9ae8d83eddfd2fdf9c3c53e1021610d184d885f917fe99a8d55daaf217ef8141f8e9d72fad716710c90eeefaff5b9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328511, "uuid": "f5ab6e48-e33f-4ee9-a204-2fc89f5385d0", "value": "T18A31511DA80DD27901328BD44AF2D83CCBA54D0B9154E2DA7BD1C4411F761FC6AA02C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328511, "uuid": "e42b90eb-de47-4714-aae4-bce30c23f09e", "value": "24:c8C2LLPsOH0N2C2FMf4ru8h0L3DRYuao/VlECYu+Z18aGo99oc5UguJ0Yf3evpjQ:U2nknvLAJ03DX/TEhuSAoLoc9FYfeBbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770328511, "uuid": "71801743-236a-411d-9caf-25758bd91705", "value": 1638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770328511, "uuid": "ccb74ab4-bbbc-4e0b-9101-86c4f4ce0e31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328511, "uuid": "ac54d534-06a5-44ba-b3a3-2e366c17bc45", "value": "XML_05022026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbe4e53-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307475, "uuid": "46faefe9-4130-4e65-9159-4284b88b47a6", "comment": "Malware payload", "value": "bf9cb03c65dd9e4c886246a27b4d697f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307475, "uuid": "2f69961a-0f96-4901-90a8-6fabebc96c79", "comment": "Malware payload", "value": "a019df114747777ce0a98ea395beecd322c1e102089a0abe033286c1d7ec53da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307475, "uuid": "dabe46c6-c490-4316-b4e8-9f040fb08ca4", "comment": "Malware payload", "value": "1dd87e961bc8684282be88e1636facd9eacb7754", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307475, "uuid": "0feeecf7-9c83-485d-8aed-6cb0590db375", "comment": "Malware payload", "value": "8a2147dec2f13101130b614b344f78480e194c6ef182f74f14098a16dfff1586ddd0a78d9de603aaf3f46e8014af13fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307475, "uuid": "db3dc423-d05b-4a00-9da1-2d92e5aececf", "value": "T1A6247A67A42CA7AFDEDA2F32ADDE8A2353B65FC4C991103E0C44730E3C671095E39566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307475, "uuid": "5223a8fb-52ee-4538-aae6-2957e970b8c4", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307475, "uuid": "ee0ec068-0357-4f35-90e3-eb651545a34c", "value": "6144:NynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g3U:cnO56dyO7Wc8oNrRHwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307475, "uuid": "a5ba93c7-ad40-410d-96a0-8ea012a1921a", "value": 227169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307475, "uuid": "ee1d8e42-2df3-4197-9dd7-b5417fe36010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307475, "uuid": "80557a7c-32bb-412a-9fcd-0f2fcb8118b6", "value": "a019df114747777ce0a98ea395beecd322c1e102089a0abe033286c1d7ec53da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5609ecdd-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770306603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306603, "uuid": "6a6069dd-e2ac-4b21-ba01-6377c70c190e", "comment": "Malware payload (GuLoader)", "value": "90e1c0e20489688b2d95673d3382d7a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306603, "uuid": "6e5fdd4d-999a-4736-8296-cc6f8b01ce81", "comment": "Malware payload (GuLoader)", "value": "a0218475b35ac5a80bb3e4fc9ae77dfcb62dd338ed277e9fcaa700286dad3aed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306603, "uuid": "5645d443-8757-44bf-87ef-256c5e07656c", "comment": "Malware payload (GuLoader)", "value": "1c93cf53715ae2166cde90fbb13b90241545527a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306603, "uuid": "f37ce1e1-ac7f-4f35-83c8-f6912aa01d84", "comment": "Malware payload (GuLoader)", "value": "386d78b06519e5c9e95b62dbc4f770dc12b6a6655b411e22912fb144ca548cd56bc2cd0403768911b1490c7070ffc219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306603, "uuid": "2cfdc7a9-28e9-44c0-95f4-85a8c5f2926f", "value": "T172E423D32BB4C066CD5147F09A3A0A760EB89E7D65F8190F3772BF897E710C6861A712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306603, "uuid": "dfe94526-8cc6-4d00-b0e0-48f4285b730c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306603, "uuid": "d979d982-53c2-4e7e-b4fd-f88fa5b8803c", "value": "12288:uNBRGXL3AQ+mvmE0jjG+zbI9VLg7chG/PtBL+ftOcGDOdP:uNBRGXL35+muzW+XegNPPLEc4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306603, "uuid": "db48e012-1f5d-400a-a871-60df7d2637cc", "value": 689608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306603, "uuid": "24eb119b-fed9-47ad-a9ec-1951923d11db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306603, "uuid": "b516e43f-97cf-4a74-b1b5-36fdaad6af8c", "value": "a0218475b35ac5a80bb3e4fc9ae77dfcb62dd338ed277e9fcaa700286dad3aed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573468be-02ae-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770308323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308323, "uuid": "e208addd-fc9b-4c67-bd12-6db54a1635c8", "comment": "Malware payload (GCleaner)", "value": "6d11d0a768a07553b5dbdf76c514e0bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308323, "uuid": "e5be2db1-688e-460c-a37a-f5dc7cfc1307", "comment": "Malware payload (GCleaner)", "value": "a03339ae302fb3b7e563f363205a9771523f449cb0f98ee721bb342faba395e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308323, "uuid": "cc1a5931-e8f0-45bd-9e59-40bccbe800a9", "comment": "Malware payload (GCleaner)", "value": "eaaed56000c13b4dd27a6b0eb75a2f65cdb69f92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308323, "uuid": "444bec26-b04a-4624-8886-80f72cdb6073", "comment": "Malware payload (GCleaner)", "value": "397190a9ffb4e48dc121b6024156c58a374cfb811392dfa879ef92f809f33623bc8d45698771a8efa06802836a6b3663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308323, "uuid": "fe000156-8430-42ec-b7d4-b093e811c17c", "value": "T10FD48E21E2A04737D2221938DC8B5267D839BE902B25E8DA6BEC5DCD9F357C33525393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308323, "uuid": "20721b9f-bccd-4b63-ac4f-c92512dcb5cb", "value": "07f608b4818de60660a6d587f85c6c18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308323, "uuid": "a1c3b9a5-9186-4b0e-a5d4-d412302e8dd0", "value": "6144:f72TYcyTAyZT3IevKRPorH/kcYVhLIxdqvz3DbDDMt9eAA9wXdhCXBDVdv7ixhNA:iTYcy8yZ08zaVh6E3DXDQA8iDVdzMiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308323, "uuid": "3b366e2a-bfea-44ad-b878-887a7a78b772", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308323, "uuid": "fcc81b9b-8ca4-4afb-8010-7c096792403c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308323, "uuid": "ab7a5949-274d-4656-be0d-ecbde13fc687", "value": "a03339ae302fb3b7e563f363205a9771523f449cb0f98ee721bb342faba395e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2287efe8-02b0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770309094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309094, "uuid": "a842d8ee-1670-4318-a83d-fee2c3dbede4", "comment": "Malware payload", "value": "0401abbe6eb06be82eb117e6c294aab6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309094, "uuid": "ef89618a-376d-4e89-aa4d-64ed6c1893b6", "comment": "Malware payload", "value": "a04ee025d13c0be594ecc7d52bbb586b3003205091fd8234e7462431ee857615", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309094, "uuid": "3d22a302-b55f-43e9-ab27-779285730da5", "comment": "Malware payload", "value": "ee6d751937fb775d34e8abaada908fb959f5215f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770309094, "uuid": "9b974e74-1fdb-4e95-b1a2-3b569f39614d", "comment": "Malware payload", "value": "50aec9122f1216104336781511656f23310520bfe28a3cec90faecf56da73b3bf68d1a8cfee915d45d8af79134ac04ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309094, "uuid": "712ee259-cdc4-4cf6-b727-6ee603e4f3d5", "value": "T166F45C09B2C540A6CD9E4172461360F8AB2ABF348B7255E622DC7B7D4D337C54C6EB2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309094, "uuid": "3d35d3a8-36e3-44a2-95cb-8b42eb38184b", "value": "6144:BXU59wz4ZoeETEW1gbpJA3KpSL0pDkqpNwxISD9UlNW0D4GPSKLn8bO:O59ULePJA3KY0pnpNwxISBag0D7NLnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770309094, "uuid": "b3a78d70-9fc6-44dc-9791-7ec5052d2f8c", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770309094, "uuid": "8c4fbad1-b979-4a64-a632-91622992860f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770309094, "uuid": "a2d32eca-78a7-47e0-8275-1c8100564852", "value": "DiscordFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba80b412-026c-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770280143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280143, "uuid": "2c56db4b-5762-4629-85ca-0e2a7b6a9418", "comment": "Malware payload (PhantomStealer)", "value": "e0c797fe9610ee68c6107ce7741b0262", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "bot8462087005", "colour": "#5828D9", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280143, "uuid": "c0487914-9738-4a14-b1a3-909605707800", "comment": "Malware payload (PhantomStealer)", "value": "a08cde6bab4b2f683198287e9419f0e48918989c6000afb19f70ba0a0fab743b", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "bot8462087005", "colour": "#5828D9", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280143, "uuid": "6fb370cd-897d-4cf4-8125-a989837f81d2", "comment": "Malware payload (PhantomStealer)", "value": "587cfb5d79d1ee64101d56181356bba5f451b692", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "bot8462087005", "colour": "#5828D9", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280143, "uuid": "5cfd9fa7-cc0d-4dc0-a1a3-7837b0797b69", "comment": "Malware payload (PhantomStealer)", "value": "100c7c6e30ec21b2c590770a3c6bb4136b1cdf2e99eb030f7503d689a9a59c9633946c83eee01105a684f7978cd29082", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "bot8462087005", "colour": "#5828D9", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280143, "uuid": "8ba2e21a-e7f4-4107-b948-fc9f1a0b6b1f", "value": "T104060100D95ADD65026C822824691EC725910DB74D187BB63F8E8F8E1F4F64FA07A7FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280143, "uuid": "5329381f-53bc-4d78-bbb5-72a460c5ed7a", "value": "49152:8gmZMGDM3BlFWYJ/BK57oXadJVtBj42cCRuW2la+JtA:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280143, "uuid": "e68ee55c-8229-4398-95bb-b0a694f02c98", "value": 3725869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280143, "uuid": "998d219c-de2d-498b-b143-31d8e55e7c96", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280143, "uuid": "e29a7033-9822-4c06-a89c-afd69715a26e", "value": "YALLOWSISI.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b91111-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770306916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306916, "uuid": "1e400c48-0836-46d6-b218-e65d12a2c9ad", "comment": "Malware payload (DarkTortilla)", "value": "abc7d8be5e6bb3423579b5ea302b822e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306916, "uuid": "aa022b97-f1ae-4cd8-bd5a-8882d2ff8317", "comment": "Malware payload (DarkTortilla)", "value": "a0a642f5131f1d82cb91f1237deb6b0002b0e6f178d208295b5b7fe39cedb1d6", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306916, "uuid": "4fbf24f3-eee2-44ab-a130-c392189a819c", "comment": "Malware payload (DarkTortilla)", "value": "c9b5d2ad12ff938c9191ce20c72a6bd5a8633e9a", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306916, "uuid": "dbc55215-dedb-4104-a6d5-25975eee57bb", "comment": "Malware payload (DarkTortilla)", "value": "24467471ceb221dcc2910cf8098a3831bf427977e8af21939f40e9b5d65d1d6c460d80196e981ea93044497c91a9bfe9", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306916, "uuid": "5b7a915d-9de8-4423-b121-709d79a7ab7f", "value": "T14595010413D88A48F87C9B788537370157F0B41AE976EF9FA3C420AD1D397A99A97723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306916, "uuid": "79185c5c-6216-4b1a-8b1f-01bd0ed6bd13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306916, "uuid": "3adc080a-8cbe-4ac2-80a4-c4cfc638b4e8", "value": "24576:yyhfMs1hsAdBen2pqphKIcsjU6UsHMdrE6Jv3oqriYg1Ai4J+HZx8V:yyhfTfe5vjxUsHcJv3qb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306916, "uuid": "24cd18a8-392b-4efd-994a-76e04b809c0c", "value": 1896960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306916, "uuid": "d3522b72-d06b-42c0-a937-08f3a167ce9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306916, "uuid": "41cdb885-b3a9-41b5-be29-bf39a3bf4420", "value": "a0a642f5131f1d82cb91f1237deb6b0002b0e6f178d208295b5b7fe39cedb1d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a08527-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770307971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307971, "uuid": "a716d8a7-33ba-4518-8637-183aa134dc96", "comment": "Malware payload (DarkTortilla)", "value": "fe350da5b95c3d7b8c25806d7696fbeb", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307971, "uuid": "6f3cb704-a6c8-4f7b-8f2d-d67a7c3e15ea", "comment": "Malware payload (DarkTortilla)", "value": "a0b526925bb48806b6ea9abd3d7edae9097c315bd491c37ece9103b1471c1c5e", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307971, "uuid": "7fe21b8f-5be7-4781-a1a7-48d2c04b44b3", "comment": "Malware payload (DarkTortilla)", "value": "7cfed87f7497fa9ca03d010b312974174b1174be", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307971, "uuid": "05370db9-014c-41b4-b60c-574e9ebad27f", "comment": "Malware payload (DarkTortilla)", "value": "ab1f740e66498cf66903c15b95893379461809c49b5d6f741ba50ee16da64d182f81b6f47de618e0b2a76c1de2a7f342", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307971, "uuid": "be584e45-c064-4f78-a5b5-8fcc7aaee058", "value": "T15955010A17E542A8F4FECF74E2B8006593F0F59BC625EBAF694851F4DE21B45E602273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307971, "uuid": "75406c4e-c95a-4871-901b-2af37e3090da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307971, "uuid": "bddc3e1d-6aa0-438e-80fc-ee570f852f86", "value": "24576:8FknRHGAWq6/p3ojZPLCnRveYepqMKDmfC4KOSSn2s6vbr:J5GAmOdPuRveYkqM3fC41p2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307971, "uuid": "09860932-517a-484e-a97c-90e1d7c79a18", "value": 1378304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307971, "uuid": "419f866f-d4b2-47af-9a5f-4828a978272b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307971, "uuid": "46211862-25ff-46cd-9dc4-8ae70bf7cf9a", "value": "a0b526925bb48806b6ea9abd3d7edae9097c315bd491c37ece9103b1471c1c5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40391e03-0289-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770292393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292393, "uuid": "3565b493-2d9e-431b-97f0-d30533b73a1d", "comment": "Malware payload", "value": "5c4d76750905d637e7d6dae4dab58f4f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292393, "uuid": "7e78cf8f-bd9f-4ee1-9b45-022fa4deab6a", "comment": "Malware payload", "value": "a0de0e7334fecb11adf6edb2d680d8ab6a85b6c864ae687f42b6fd4b7e708eb9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292393, "uuid": "f9a65a25-0c4d-4102-a002-760a176c219f", "comment": "Malware payload", "value": "028901c6776e173f503d32578130b0e6cd53c0d7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770292393, "uuid": "c5cba6aa-6e8a-4a35-8674-e4853dec9fb0", "comment": "Malware payload", "value": "113839f20d5a3c1d1cd20ef4bf9a15708cb17f640cee94d77fb670cdb11d097a661fc68d32bd3155b91850b6b3a806e9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770292393, "uuid": "dc0eaaee-a0a1-441e-b24e-2c81e90299b8", "value": "T1BED185CAB1C6706D565BAC77211B9CC7A41B4E4AE42DD8B8F262FD62BCF43BC4063484", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770292393, "uuid": "7a0c10d4-6dd3-4ad8-902a-9eeb81630e3a", "value": "192:i5eRdR9fuSXgC5nirF6zFWpvxhNL6lAFowBF:1Rn9fN5vFyxhNeAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770292393, "uuid": "fc93f148-4439-4354-a080-d4de435c6f28", "value": 6191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770292393, "uuid": "b979341e-9b89-459d-81b0-45883c08bb9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770292393, "uuid": "15d4dbed-82fd-46a4-b43b-cb7b5ba86502", "value": "DOCUMENTS4U202602179pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82edf5b8-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304960, "uuid": "587d6a35-16f1-43e6-a738-4d8b64faafcf", "comment": "Malware payload (AgentTesla)", "value": "42afaadaf5b848fbddae21c586cab25e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304960, "uuid": "9fd6f659-2d29-4643-bdf2-66332bf85a10", "comment": "Malware payload (AgentTesla)", "value": "a11e6d421f5c5f3ce5a5d15aa2c88b74bee246094aa81a4e72a528bafad7256a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304960, "uuid": "53991f2c-c637-46f7-b690-54e61727afe1", "comment": "Malware payload (AgentTesla)", "value": "e1cf24d30a11251a0f6431d5da157391753dadc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304960, "uuid": "d6449502-bbd8-41e0-a2ca-285c0dd41f93", "comment": "Malware payload (AgentTesla)", "value": "85404307e2bc505abdd0199c44a07ddccf1f5c563684635fcd09e2f1bcdc5d155ea2c123a5786029e119207d4c914bac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304960, "uuid": "badd63d8-3c05-4f3e-96c7-8d73892a263f", "value": "T103F412017774C923EE370270ADF79B262A76FF9096D8530B7344760978B3A97850F26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304960, "uuid": "2f5a44ec-a8fd-4822-b405-d899f68e92c0", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304960, "uuid": "196799e3-eaf2-4cc8-a625-2a0e2a7195d8", "value": "12288:Me7btMBO3Drp6hXC4x29IayN/z/4byfHHRZEAJqB+Uq8B+dlwP:MetMInpDO2XyN/zhRxa2DdqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304960, "uuid": "59531ea2-9bce-467b-8090-8175d95fb793", "value": 732256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304960, "uuid": "e74dad7c-9cbd-4957-bcdb-b0f9277e293e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304960, "uuid": "8d71e589-eed7-47e8-9d85-d63f1638f54f", "value": "a11e6d421f5c5f3ce5a5d15aa2c88b74bee246094aa81a4e72a528bafad7256a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc28d2f-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303667, "uuid": "5bf417c3-7a75-4750-afd4-c953dcb4b1be", "comment": "Malware payload (AgentTesla)", "value": "3fde9821d1c369b26acdfb56ebf343f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303667, "uuid": "d70af27d-c00f-4eef-81c1-8ed7cf0acdfa", "comment": "Malware payload (AgentTesla)", "value": "a206ebb029fd442736f17f60d15352433c227d272fba3db4aaa901610db29877", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303667, "uuid": "2ed1474c-1d3f-4299-96e9-42c5c23f29dd", "comment": "Malware payload (AgentTesla)", "value": "888c2fc2009707de0cf0c84955dfc9bef261e898", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303667, "uuid": "666ff3eb-8ef4-4f8b-bb98-d2c8bfc4f36e", "comment": "Malware payload (AgentTesla)", "value": "922e13038d4a8d1dbf3648b7833e3fdcd99a0e5381b428ef02d41a73f5edd1c0341eed311f863aaf320be17a3fb6b72e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303667, "uuid": "329eff2a-d440-46d4-b5df-20d51376873b", "value": "T193D42392599059A1C1807331C836CC5199B83D719E46B37F9769FA7ABC703C3EE2368E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303667, "uuid": "b1286c75-248e-4b2a-81d6-8ba17f289d94", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303667, "uuid": "506fe480-51a4-44b4-9987-04c14421cf72", "value": "12288:oz7hU5I5yuNHIgzSFKxWltRohBfSTso93UnFVulAyG0Wu/xykdCiQH:of+iN57Gtene3CulAyG8yhiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303667, "uuid": "7270d8fc-59d6-41af-a6de-dce5897b69a0", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303667, "uuid": "f56c4c79-2d66-4fb4-8dd7-e2de1580f424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303667, "uuid": "01c7715e-9b98-4c93-b290-7de69bfbbf8f", "value": "a206ebb029fd442736f17f60d15352433c227d272fba3db4aaa901610db29877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b972d1-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770306814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306814, "uuid": "65ba4845-8285-446f-876c-bf3993998c44", "comment": "Malware payload (GuLoader)", "value": "57a97788127c2d9c61fedc13d52dc09c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306814, "uuid": "f74c64f5-59e2-43c3-b296-b3d018342a80", "comment": "Malware payload (GuLoader)", "value": "a2238a0f89af592106694a80c7388219a038b46ee3a8f4c241433d126b87befd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306814, "uuid": "bb47c064-8aba-410d-8e4e-6c2b22fca747", "comment": "Malware payload (GuLoader)", "value": "38d334756371ee57c3bc1de26b1b38714ca6010c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306814, "uuid": "2a00d88c-b3e3-476d-80d0-2e51921c35a6", "comment": "Malware payload (GuLoader)", "value": "147d8874620d619da2c18bce82ffa67be895a6127d950d5ed1a2ad1fe86811c3d74812c08030014005f90101c649a12b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306814, "uuid": "4daa8db1-6a30-4988-bfa6-8ccdcaddb625", "value": "T185F4010F7264C07DC9FD2EB0F5666CF5594DAC089CA8508E6AC577DE2AF62F1831A10B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306814, "uuid": "37a40d0d-5f28-4ec3-8bbd-5b800f396391", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306814, "uuid": "72eb7c62-a8e8-4030-b17d-b9e2000c57cc", "value": "24576:WbEbaup5VEHRC0MmtuP1ABHH6HWWswhD2XCEbau:zbaupHEcYBHH6HWWsBhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306814, "uuid": "077d3c25-af90-439c-80e8-7dc4aa630b72", "value": 792232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306814, "uuid": "4e9a8e9e-5c1c-4171-8ca4-ee549708a00b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306814, "uuid": "b8fc36ff-fa54-40ee-9924-03c4c97e9623", "value": "a2238a0f89af592106694a80c7388219a038b46ee3a8f4c241433d126b87befd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a920ca-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770307789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307789, "uuid": "c328983d-b8ca-4e1c-9b73-10c907865894", "comment": "Malware payload (GCleaner)", "value": "4f1d91bf7d54a9fb0076a8715c21f9a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307789, "uuid": "be6f3eb4-d95e-4b11-9c43-5d56bd737b16", "comment": "Malware payload (GCleaner)", "value": "a2290f0a4c4c0281972f95ae695eaf25383d476dabc34783a4c21d6ac314048d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307789, "uuid": "e6749aac-2e27-4102-949e-fdf6def2bc66", "comment": "Malware payload (GCleaner)", "value": "9ee5875f649d9b26574c4a2ec0ba0c0459e5466e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307789, "uuid": "fbfe755f-5d84-488e-a846-478856ac55eb", "comment": "Malware payload (GCleaner)", "value": "63de94e11416a82dd94e5c1c85c02eade4785ead9de86818136c9ec657ff60d2829a4857afcadb0423f3c536453c5bc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307789, "uuid": "eba8c592-eb16-4f96-9ccf-0ae2cb532017", "value": "T137057D12E2B7C037E0371F799DBB866C54EABD102938994A36D9ADC8DF76B413416383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307789, "uuid": "8a33ecd2-eb6a-4716-9c47-e91521aaf633", "value": "421f57ebeade5946b16f0c3c541d2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307789, "uuid": "281f0d73-def5-42dc-81c6-a48911492061", "value": "12288:j9eONBtJzhKJd6EPXNQyxbLSoyZ1gJ0PHD35ddIG:Tnzz04EGOzQ1gJ8z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307789, "uuid": "d5162bd9-81a6-4924-9b00-bd9b4ddcb3ae", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307789, "uuid": "eeb7771e-cc32-4315-87cb-41d750c59274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307789, "uuid": "8e0dd77d-f0a8-4e6d-9a62-aa4cad2258f6", "value": "a2290f0a4c4c0281972f95ae695eaf25383d476dabc34783a4c21d6ac314048d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb690ab-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770304601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304601, "uuid": "eb09f072-bd3e-4fba-a501-ec90731f129c", "comment": "Malware payload (Formbook)", "value": "1b892436b97f1ca2661c030b2c8aa329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304601, "uuid": "9204e7b8-a666-4ca5-a0c4-65731567a5aa", "comment": "Malware payload (Formbook)", "value": "a237da4064c03357e53ea31c606c3d23291b1c476cdb5ed1c72ce29af7ccc2b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304601, "uuid": "8321625c-70c2-4be3-b791-aa1da4b5ce59", "comment": "Malware payload (Formbook)", "value": "32d686e1d9129f23917bfb301d9ad0d4796be4f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304601, "uuid": "8e18dc17-ebeb-4238-9b3d-e0b535b23c95", "comment": "Malware payload (Formbook)", "value": "7ed02a7f5e245080904b10897c6307d94968b586490d234503c9725627a7a3f5df8d7147106d68c0ec2dad5d07d0978b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304601, "uuid": "bfc17cd0-c24a-47b7-84de-9dd8eb513167", "value": "T16B35F144274AD607CA11D7B81AB1F2B8076C6EEBB900E3175FD9BEEB78BAB154D40143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304601, "uuid": "0132bd7a-77e6-4b36-a51a-5181ec29db0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304601, "uuid": "0b2761c5-322c-4d7d-93f7-876689c1bc82", "value": "24576:Zaztp3T+0J2Rp/9JppD7tBEIn4qne9CDs:oz73lJ239/pD7DE2LeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304601, "uuid": "21d85b0a-3f78-4b30-afae-b0d8d148925c", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304601, "uuid": "c18db22b-78d2-4081-b459-c59037ed8dfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304601, "uuid": "8021a85c-c095-4c35-ad5b-815a17e63a30", "value": "a237da4064c03357e53ea31c606c3d23291b1c476cdb5ed1c72ce29af7ccc2b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f52397-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306041, "uuid": "da4f3ba6-3046-41e9-a47c-2a12839ac21a", "comment": "Malware payload", "value": "10c37c2b40cd3034f1e1c7686cf53cc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306041, "uuid": "11a20d01-1f01-4906-b217-70292ddd2e79", "comment": "Malware payload", "value": "a24a485f5c77493587657261f8e07b8475fc6c9b3adb5b84c86bb08b1423e5f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306041, "uuid": "a8e314e0-6f46-4f5b-bd9f-b0388af74f08", "comment": "Malware payload", "value": "e2ab2373be9673cd2f96d8a717771da1b8e5e56d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306041, "uuid": "ed683a8b-2d69-4d05-83b4-26d848a3eb56", "comment": "Malware payload", "value": "a6f840e6298dec7aa218d21115474efd27f6f4a052f3706595e5e032a7b7a8d728839b76c2c17dd1ae0316049ddbb514", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306041, "uuid": "59d9cdf2-e4d9-46c3-8587-cffe43a0b9a0", "value": "T143742916E7607426F81385B02DB9A25B35293D3A0581DD4BB78DAF4A3771A83B0F532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306041, "uuid": "715db5dc-8747-462e-beef-0e53883b1abe", "value": "88f87c01abbf9a5f23629c0933d05a9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306041, "uuid": "86f737e3-2c59-4cc1-a7d9-689b68a1d26e", "value": "6144:4nKyB1K6yRV375Grwwn8JIPB60711aDYqY2iUuZyClCH2ys47L:4nd1FykwlJIPB60711aXkZyCl824", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306041, "uuid": "cb6eef1d-1148-4def-b8bb-ac561de75da3", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306041, "uuid": "e46737e9-9e8a-46d0-b673-183bf2d869d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306041, "uuid": "12b4f6a5-ca06-47c2-a09b-b64bd5c88018", "value": "a24a485f5c77493587657261f8e07b8475fc6c9b3adb5b84c86bb08b1423e5f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b71458-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770306034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306034, "uuid": "4144f1e8-aa23-4cd7-9064-d78bd9043a83", "comment": "Malware payload (SnakeKeylogger)", "value": "c97b0059dc6d687ef22a590e5e6f20d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306034, "uuid": "80001fea-8904-4994-9d34-b3392a8aeb59", "comment": "Malware payload (SnakeKeylogger)", "value": "a26018fa571c95f994b40c6ff3c5eb99d8f5e35b4ec819819ff559b5fc5ca1ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306034, "uuid": "db6dd89e-603e-4594-971f-3ac4a559afa0", "comment": "Malware payload (SnakeKeylogger)", "value": "226540b1abbe459c61507fa870f4c6ecaeeab669", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306034, "uuid": "f6ef035d-6c8c-4661-bf02-a2cedf7ea82a", "comment": "Malware payload (SnakeKeylogger)", "value": "86a75918c3d30df34a227f119552f2d20420f99ea0d417d2b12d4cc905cc681dcf847fa79737e7c7a86fafabaf74e2cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306034, "uuid": "698a82cf-a2ee-4aab-8609-3b3ddd7a4496", "value": "T11F050164330ADA07C4524FB80D72D2B81B69AFD9F911D2138FDABEEFB9367505948243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306034, "uuid": "26174951-d5c6-4c72-b009-781a1e6e5f95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306034, "uuid": "1109b7b8-9676-450d-97b1-ebc90f9c0d49", "value": "24576:GZyBSXiMqn7eQWXvj5ZJPaEmheZVs40v:qo2QWrfdahGa40v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306034, "uuid": "812aa987-cd1e-4099-bc7a-972c4c4c0a55", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306034, "uuid": "bd51bee6-5315-4474-b95d-8b758577597f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306034, "uuid": "f19bb1c6-b6ac-4eff-8f2c-a264c80a1f0b", "value": "a26018fa571c95f994b40c6ff3c5eb99d8f5e35b4ec819819ff559b5fc5ca1ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a36a0a-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770303296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303296, "uuid": "a89415f1-3c67-4517-b6f6-5e6d97666a5e", "comment": "Malware payload (GCleaner)", "value": "a63e14e8189749711793b1143b3d8168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303296, "uuid": "3bd19424-2551-4f3b-96e7-4565308553ce", "comment": "Malware payload (GCleaner)", "value": "a271823add5f7b972ad437025f0c0fc422aa90b71909f4ef9de6294be8bbb389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303296, "uuid": "e51b95de-7ce2-44a1-b3a9-c45421afb2b7", "comment": "Malware payload (GCleaner)", "value": "1d627a537f8b290a04cc99957baaf8d8a8cc2787", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303296, "uuid": "87d21710-2f68-4def-89e6-829a32c02e7a", "comment": "Malware payload (GCleaner)", "value": "ac6316ef503211ce9fc04b9cb672a3526a4e8afb2ad21788f35c2e1751a5d53f558981e2a4f2aaae49d86313e0667b75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303296, "uuid": "78efab1e-1a67-4518-b669-c0f68e9e8b83", "value": "T1A806DFC1AB623599DD635333AF0E801189DEFB4401E9278B29DAF5C2DA3D113AF79163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303296, "uuid": "0458fc3f-1557-4862-9d01-8feabefd860a", "value": "47a71adfa27f235be83d38d946a32453", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303296, "uuid": "e0ae5ccf-537b-4739-ad4e-5bfe4f6075b2", "value": "49152:d69vL7lD7+UWYCaTa/etxDjS8K8ivA0ujjulcp86J3jlTsW7:d6dL7h7gau/etxK8/ylq3htL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303296, "uuid": "d8a35a8e-221f-4241-aaca-f03c1cd7b9d6", "value": 3833616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303296, "uuid": "a5438c93-3b6d-47de-990d-6d1847c12323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303296, "uuid": "90cb509e-9d1f-477f-9dd2-6ca829e14a78", "value": "a271823add5f7b972ad437025f0c0fc422aa90b71909f4ef9de6294be8bbb389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa746aa-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770307881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307881, "uuid": "c5e01f94-f75d-41b3-ad53-cc5652022a76", "comment": "Malware payload (GuLoader)", "value": "250a0e9920515ae8f4564fc0150b96f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307881, "uuid": "24cdfbb9-8c2c-4043-bd65-8364e4a21844", "comment": "Malware payload (GuLoader)", "value": "a288d9fa1c625d11f3c273891ee2a09be58450e2479d21b912691b82a8b37fbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307881, "uuid": "bb86e8f1-cee2-4a28-9894-1ded8af1b488", "comment": "Malware payload (GuLoader)", "value": "e7344718b1fd86bb8ca689cf88b7dc90f61af48b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307881, "uuid": "96f17bc3-96e8-4bf6-ba2e-0eda0aeecb35", "comment": "Malware payload (GuLoader)", "value": "ba8134e3623934c60c80fead6001104cf3f5d7231698c0c472976ab55c6f2439ac72090b834536c45815f98b18696cc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307881, "uuid": "ba54d05d-e9c2-4626-b90b-40899eeb1e3e", "value": "T1D994AEBDFE18E4D1D01653753836A835FB29DF16A0B8422FB9B9721919322CB6427D0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307881, "uuid": "c864b476-0057-4a95-8210-8bece41e4472", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307881, "uuid": "4bae97af-f760-457b-8fe5-24432bdcba5e", "value": "6144:zMm4CCOkXvVPZCvwriTDqSyAmOsSOp70MxIkddq8q0UEwhkw+:zMwtn9TxyM/QmJu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307881, "uuid": "51aa9902-8859-4b71-9ae0-4db007b1b2c3", "value": 408776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307881, "uuid": "c231d985-3c5e-4f56-a626-bb33a863393a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307881, "uuid": "611ed77d-273e-431c-9bef-5f62cd54f2c8", "value": "a288d9fa1c625d11f3c273891ee2a09be58450e2479d21b912691b82a8b37fbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad01ec4-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304088, "uuid": "1504ec5c-d2e6-4222-98b4-69502d4a9154", "comment": "Malware payload (AgentTesla)", "value": "e49346735116f8fbc5033091612364db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304088, "uuid": "c5cf5d09-e0ca-4ea3-8470-ab8b6a6a92fd", "comment": "Malware payload (AgentTesla)", "value": "a393af04b058f4fead2a0b08394407510445808c02ed8ae7f80c25b756137d78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304088, "uuid": "78d6a246-d549-48dc-a847-0b2e4bea9a5d", "comment": "Malware payload (AgentTesla)", "value": "831406c99c7f0fc1f6f7521a35df90e2e8a4f435", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304088, "uuid": "16a91e7e-2af3-423d-a7ab-82110e516c68", "comment": "Malware payload (AgentTesla)", "value": "9aac7d402e8817f97856af0df738b61567411a702fe98ade5d257ca6e90059f58ba828ac4052f076a34d29b0515db449", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304088, "uuid": "9fed95fc-7a64-442e-a2c1-1445eec8475f", "value": "T1F835126DFE016E16CA7D0F77D013151843B08523AA72FAE9AACD44E10EFAB98CD4D653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304088, "uuid": "3560cc7f-db5e-4238-8a05-be3d35780636", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304088, "uuid": "52a79c0f-1584-4121-85bc-f3d47731ade0", "value": "24576:qstarDPVyMrJZtN3mN9okCtvTiwZD14t9Up7ajmPdKi:0rTBrJZtN3AMOw3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304088, "uuid": "97c2662e-7fa2-406c-af35-c94bd6ab7610", "value": 1061896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304088, "uuid": "944aab7e-18ce-4e7b-a34d-cbcca63bbb63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304088, "uuid": "39c19e3c-4a25-4a57-b761-f8530b670db0", "value": "a393af04b058f4fead2a0b08394407510445808c02ed8ae7f80c25b756137d78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea160a2c-02bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770314582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770314582, "uuid": "be4a3e9b-7872-4e26-85d6-f7b652649312", "comment": "Malware payload (Mirai)", "value": "834ce7986a5cd2a4a503151bb541bf38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770314582, "uuid": "7bbe5eb9-858c-404e-817a-234625020f5d", "comment": "Malware payload (Mirai)", "value": "a3bc99f6227f5e84c06d260eff0b7c4f1b28b23aba7837415e2f6a20925a6cb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770314582, "uuid": "c862ac8c-91dd-4bfd-85f9-a9f8182027f1", "comment": "Malware payload (Mirai)", "value": "b2f03d1cfb5f31f0c10bf86303ac2a987a37e2a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770314582, "uuid": "5e442706-3254-4890-9663-fb8e563b3ae6", "comment": "Malware payload (Mirai)", "value": "972ad664edfb7226ccbac7df7362f2912513bfa46ae3266fb03f0247c5880d35681b4131585174b26dc58f7cc9840f03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770314582, "uuid": "c15b5e2b-469a-4e5b-94e4-d9eb1a3b23fa", "value": "T12EE3121D5D3610FBF15B5539C0116A9F561ED23C109CEAB2284BBECA237A381893F5DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770314582, "uuid": "21a529b3-9097-475a-bf4c-cd16d2f82d91", "value": "3072:DN8kXjDSpdWsZ9MQXHOz214iDKmmU+kGA0cZSo3jsx008Rdud6:akXj2nWO1vDGzkGA0cZD3Yh8zR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770314582, "uuid": "418862fc-111d-400a-abff-09ec42206f6c", "value": 148396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770314582, "uuid": "f730bc2e-fbe8-4c51-bbbd-c867b0e265c7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770314582, "uuid": "70cc1ac1-b556-4541-b67d-c2814524c52b", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f702b108-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770306444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306444, "uuid": "a5ca4697-b172-46a6-9b52-377f327d0a91", "comment": "Malware payload (njrat)", "value": "1ccf1c7fe2aeb79ce6fec37b86f66df0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306444, "uuid": "33b63733-e300-46d4-b7e6-8063f26c3386", "comment": "Malware payload (njrat)", "value": "a3c0bd4521bd9b06b7b6400f7a7f701041e5179c4970ed95717d23f5446438fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306444, "uuid": "942cab21-0b39-4f36-8169-73645266c32b", "comment": "Malware payload (njrat)", "value": "c1a68b96ccb9b45649c6dbb76ac249c09615a83e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306444, "uuid": "b902f52a-46b9-4da0-9fe7-4b87a8c6dcc3", "comment": "Malware payload (njrat)", "value": "45465e4bd87632f4034159d5213eaa37e4b4b0242baecae2f6ccfa5af514dce7d6a8d3c9a7e6e9b18c290f35a0ac40d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306444, "uuid": "d665bd8a-41f9-4a70-a23a-4a0ef02ffe1b", "value": "T14AA3498EB7A18E15C56D8DB7D4E7610881F8D873B563F67724C85BE18E26988CA4FCC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306444, "uuid": "5eada8b9-3f05-47a8-b443-aabe26beaf31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306444, "uuid": "b40d46bd-71c0-4565-baa7-861345a19547", "value": "1536:hWaFjNTR4n/BKZk8oL3zWwqqjGz1fZitrOUlPpayEDbQIor2:pFFO/BbKwqRjirOUbayEDbQIoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306444, "uuid": "232aa2b9-a99c-4cb8-a168-92dabde5fb98", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306444, "uuid": "3e9939cb-9073-4ed7-a01e-b078a9c856e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306444, "uuid": "882f9fd1-9b2c-4824-a7cb-3355977ac80e", "value": "a3c0bd4521bd9b06b7b6400f7a7f701041e5179c4970ed95717d23f5446438fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6439751-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770305583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305583, "uuid": "f2f2e6de-b327-4aa5-b1d1-384b08b1cf61", "comment": "Malware payload (AgentTesla)", "value": "183cc578935f6e6fa09567ca77788c1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305583, "uuid": "c4b435e0-a538-4dda-ab7f-1ded53da39fc", "comment": "Malware payload (AgentTesla)", "value": "a46d2c7d7389353f070eea4c1f5e45030d64d32e555db18f78ef9fd9426b1fcd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305583, "uuid": "c476a5f5-ed18-47c4-b9f8-4aba3a7916ec", "comment": "Malware payload (AgentTesla)", "value": "301a797ca24d439fd0f04f7bb3a57db6fb654b09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305583, "uuid": "b74f40f3-0239-410d-bb9f-acb5f9479463", "comment": "Malware payload (AgentTesla)", "value": "85355c764838b1852639ab3f9f4de33acb93ad5cec18f78d8073c5fb90610b32e593d52fd4d391c82f405f1c9aaeadc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305583, "uuid": "192c564f-c5af-434e-a0be-7bdb079856ad", "value": "T1C1D41296A6C15942C5906370C836CDA4453D3D70DF1A732EC72EE1AB6C703D7AAAB31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305583, "uuid": "da9f1f5b-0789-459f-8312-f6569ec11714", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305583, "uuid": "003df777-e906-473f-8fc9-3faef50beffe", "value": "12288:2z7hU5I5yuNHIgzSFKxWltRohBfSTso93UOTYerFH77Pbj3OzB:2f+iN57Gtene37fbvj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305583, "uuid": "7949d6e3-7d66-4b17-b0ad-fb16d7535f24", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305583, "uuid": "9e1fc8d4-99e9-44f3-b7e6-76e4be951ccd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305583, "uuid": "f0dbd850-9caf-4c6c-ba3d-7971f7c6a330", "value": "a46d2c7d7389353f070eea4c1f5e45030d64d32e555db18f78ef9fd9426b1fcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbf5c59-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305970, "uuid": "f1f80820-d45a-482f-af53-6c1ffa130677", "comment": "Malware payload", "value": "7f4eab6be3fd9fb1f99675f1d167e47e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305970, "uuid": "b4423c85-1855-4c1d-b786-8cf0d15e6435", "comment": "Malware payload", "value": "a46f15c051a5040f5a1ebde94bcae6469b86b76dd81b6e6b71fed5960465b1ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305970, "uuid": "410d7997-19a9-42fa-bd45-9f389c3bc9ed", "comment": "Malware payload", "value": "4727c62bcf27d2dd95805a68e2db62c92e65ba85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305970, "uuid": "171ca727-5b5d-427b-82e6-76f6b0a75a7b", "comment": "Malware payload", "value": "4c9f1ef0f73e4f95d7fa92b0da593a04191d324053c9080f5f4db0a1fe4e4a5aef933afda340c3260117d78516e8617a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305970, "uuid": "1bd6a88d-5230-42a1-b12d-f11ccee44705", "value": "T19B941912E6507525E9934AB02D7AD65B281D3C3A2680EC0BBB8DDF4A37B198770F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305970, "uuid": "6150d29c-ede9-464b-b526-b76a598ccad6", "value": "f88b6f5fc33166c82364b0fa0f982a99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305970, "uuid": "86b0849b-f092-457c-9988-9665dd7fb341", "value": "6144:wUOWLcf55gN3dqtD4OCPHlLdEzrjpd+HyaY6GNkZLpEq3+umb6twbH:vY28N4OCPHlLdkrjaHDGN63L6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305970, "uuid": "42d532f2-f12a-4ee6-a062-97271869ac71", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305970, "uuid": "a700ea18-7b1a-4e5e-b74e-3eeb4f58c83c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305970, "uuid": "66d143d4-cc7a-43c2-b833-8d7262626ad9", "value": "a46f15c051a5040f5a1ebde94bcae6469b86b76dd81b6e6b71fed5960465b1ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afa4200-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304759, "uuid": "a4d79ba2-8879-4c83-97d7-d91537282319", "comment": "Malware payload", "value": "2b64bcbd5e132e43502efaf74021674b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304759, "uuid": "8f9bee1e-b71f-45d2-a71e-2638802dcd3c", "comment": "Malware payload", "value": "a4b242670e817cc3ef2f3e3d8b477fac8da69cc4a3a432f6e27cebb910782027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304759, "uuid": "3fb880a1-6ff8-42b2-a059-9118fb3355b9", "comment": "Malware payload", "value": "84940e87da4d4b10c4f39dff8444b2ae930a9e85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304759, "uuid": "3015cbcd-f047-4d0d-9acf-9e13fa30dab5", "comment": "Malware payload", "value": "fb4c0d2248469dddb505c5d68933fb1421242a353d84db238809cd980138844e34e510d41c5168edae2686db7cb65df9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304759, "uuid": "e4ec22a5-bfb1-40a5-87b3-ad49ad87810d", "value": "T12F94E512E650B526F88349B02D78A226742D3D3A2A40ED0BF78AEF59377168374F571F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304759, "uuid": "01828ec5-9ff6-4996-a647-70bf060f785c", "value": "9c1ba818e4b533652cebcbd04f916899", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304759, "uuid": "10102084-ee14-4982-9033-219bb571d701", "value": "12288:qj1Pqs1XCa3MHuWMuRqxazYm4ecu/0jgGk:qj1PpDxO/0sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304759, "uuid": "f969e18f-9092-47b8-8230-b15a2634f077", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304759, "uuid": "5ac0b0b6-915e-4406-a0fe-08a433612269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304759, "uuid": "671bd022-f5e4-40f7-a53d-904fcc138efa", "value": "a4b242670e817cc3ef2f3e3d8b477fac8da69cc4a3a432f6e27cebb910782027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8660f1c-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307735, "uuid": "7a1e7940-8d3a-47db-9400-87b2ef7a1384", "comment": "Malware payload", "value": "76df1d9fb634200fc68e1c7ac97e218d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307735, "uuid": "a427621b-f1ba-4d4b-a6a5-8040bf949c29", "comment": "Malware payload", "value": "a4c8e99f2f4ef35d6bfa11b809ea2f66869070907e780e5993a445b27da6e83e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307735, "uuid": "4bdf7f2c-61be-4963-b17f-08695113237a", "comment": "Malware payload", "value": "93e30f7963c2484ea7b8b52f3466146ef0091c92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307735, "uuid": "ff3ca220-8da4-4610-8f2a-d103482d8e59", "comment": "Malware payload", "value": "d1341132ab656b49e503ede7375b687f2a467171d65c9450752538e88c5a86ff9621b98bfe34f294d6a5d317a8fccf53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307735, "uuid": "8779d8de-1084-46b2-8898-568727c5fc86", "value": "T109F47C22F691C436F07A3A39DC1BD564546AFE902D38B94A36E83DC98F7634134E6387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307735, "uuid": "8f2b7935-7d29-4a44-a574-b538d6b6adc0", "value": "07f608b4818de60660a6d587f85c6c18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307735, "uuid": "77b2cfb0-6d00-45a9-9616-bc723c6d8462", "value": "12288:dTYcy8yZ08zaVh6E3DXDubSR0ybsmaEA6yG:dspV/Ydmbly1NA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307735, "uuid": "71461d0b-249c-446c-97eb-d54db806fc8a", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307735, "uuid": "65e303bf-ee45-430e-b596-328dd19f26db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307735, "uuid": "6b9a5ccd-13a3-43b5-9111-e0cb3f5b49ef", "value": "a4c8e99f2f4ef35d6bfa11b809ea2f66869070907e780e5993a445b27da6e83e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf4ced3-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770305086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305086, "uuid": "d1e0a888-3384-4542-bc23-3c8756afd5af", "comment": "Malware payload (a310Logger)", "value": "c550dddbb863fa7502ba845a52dafa17", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305086, "uuid": "522a0ed4-479b-4f7e-bdd4-77af78874a41", "comment": "Malware payload (a310Logger)", "value": "a4cc08c235fc6ed79eaa40b1b3bca829ce704411e299fe9f0c844345a7ff7117", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305086, "uuid": "08dddbc2-048d-4d05-86c0-8f6d930ae6b5", "comment": "Malware payload (a310Logger)", "value": "a21daf118878ebf68fef0704052c96465afedbf2", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305086, "uuid": "6a7eec5b-86ed-4e6f-9f77-f65a1ef7b29b", "comment": "Malware payload (a310Logger)", "value": "96918e484f68e39fe0bb1c12ff1341ced0c98fba5153c878dfc769f4ac4143e1f546f938fc0f3eeff237708801548108", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305086, "uuid": "e8c58063-548f-49a0-8eaa-b4531e8883ec", "value": "T18D845B13EA50A11EF1A3C9F1A9B4925668693D351AE8ECABB7415F5834301E3ECF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305086, "uuid": "4e17ebc9-ef7e-4697-b1df-afa4208f2926", "value": "4e88637d5094cca5de1556f3666ec73c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305086, "uuid": "8ae9c83e-02e0-450e-982e-bf337d6ac54f", "value": "6144:28d1/w5KA81IJ8GpF6nuTmOOUWTQnPFD5W7mISVADsBE30hyfXuHqD4XthdN7FhY:ljYKkJj6GmZUWaPFRIo5hyGHQiJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305086, "uuid": "2284d88c-05be-4d8d-93c8-af6a0fae9722", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305086, "uuid": "67dbc2c7-f416-43c0-8173-971b9efc163b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305086, "uuid": "3dd46d1a-c2e3-478d-9e7d-749f972c1171", "value": "a4cc08c235fc6ed79eaa40b1b3bca829ce704411e299fe9f0c844345a7ff7117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b652ed0-0249-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770264924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770264924, "uuid": "0b17235d-18d6-4294-8e82-c6eb2366906e", "comment": "Malware payload (Stealc)", "value": "7d4d743193f700431557a99da4024407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770264924, "uuid": "167e9972-8fb4-4c9f-a190-8f9b6ac10445", "comment": "Malware payload (Stealc)", "value": "a4d438b665dbf9214f7099436fcd86af803ac45674e96691917d4f3537f41b91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770264924, "uuid": "429aebf4-cbce-4179-9c86-ce7ce50bd1a1", "comment": "Malware payload (Stealc)", "value": "17acbc5ecbaf521198eeea56270772a32bd9bbfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770264924, "uuid": "bf1e4612-0605-461e-b134-eca33cc6cd55", "comment": "Malware payload (Stealc)", "value": "140d1c8d2f84092b9b5a85e7b7641dce4a920915f8de93bdae9e2b842b8d36ba40b56ce156cd8971afd9005688fdbc3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770264924, "uuid": "d04fdf69-243b-493d-adc2-1ea52cbd041e", "value": "T187F48D5AE7A502F8D0BBC178CE424553EBB2B8155770978F03E14AA61F376A06F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770264924, "uuid": "7f0c439f-9f92-4675-8d9d-234480dc5148", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770264924, "uuid": "9ae83814-d8dd-42ce-ba7e-26d75c012832", "value": "12288:lU8VHX4ZPBuvzkOkW7UE+YTRqwJ4W26ALSQTbAK4lVA:VVH6BuvbkW7xXVVmW2zQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770264924, "uuid": "63d77c92-98d9-4fec-84a9-bee8ac96e76b", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770264924, "uuid": "9ffce608-ed3f-4ce6-9d85-7e5380f67225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770264924, "uuid": "ca9c8f6d-17d8-4615-b70c-2b3991b222f0", "value": "xa4d438b665dbf9214f7099436fcd86af803ac45674e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2304c579-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303511, "uuid": "883e1830-695b-4da9-8475-77e528c27646", "comment": "Malware payload (AgentTesla)", "value": "d0714a2cad6a4ea21a08459629fc869b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303511, "uuid": "a0d810a7-cc74-4140-82ea-5d238a28021e", "comment": "Malware payload (AgentTesla)", "value": "a4e316896cd7e3cef47c5dca6681813b151d34cc16e9807c62db27c0f2c6508e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303511, "uuid": "b4c2452e-0f68-486b-8d6d-9cd8682f5502", "comment": "Malware payload (AgentTesla)", "value": "08feeed36dce6c4d4f1154efd3144929a432e170", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303511, "uuid": "e0b289d6-a458-44aa-acd3-d8b1e704c4a1", "comment": "Malware payload (AgentTesla)", "value": "b034b04b328dfaa4623b0fecc1e2d4d58ac56431232f1785c0cd167662260201a130d087b3d04e7709122ef2d91d8c12", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303511, "uuid": "8d8feda2-e5d9-49ac-a403-bb64626f37f6", "value": "T1A245BF0273D1D062FFAB91334B5AF6115BBC79260123E62F13981DBAB9701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303511, "uuid": "2971853f-e5c7-4e93-8bca-67f6f7ad37fb", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303511, "uuid": "d7c45fb9-bd9f-404e-a1bd-9de4fa979ad8", "value": "24576:/5EmXFtKaL4/oFe5T9yyXYfP1MAXDzegfbHFu6mbD/9I+:/PVt/LZeJbInGizegfbHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303511, "uuid": "d9a7f1c5-acc9-4cdb-9197-b41f765df954", "value": 1234944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303511, "uuid": "600f39f8-d8ca-45c5-9fa4-b9ef1444ee43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303511, "uuid": "0efb431d-4f6d-4b55-8c37-3d9006d535e8", "value": "4f3ec11e21c51ccba5632b9dc1cf5b6da6d5eedbc5cdada85de4d1788effc6ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fda897-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770307185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307185, "uuid": "1d4ee411-8c21-4c58-839f-4d4caf6bc0be", "comment": "Malware payload (GCleaner)", "value": "ad21809180c5ecf27a0c25abd3d6de8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307185, "uuid": "52360f4e-9d3c-4453-a63f-553c2f8f221c", "comment": "Malware payload (GCleaner)", "value": "a56d680876b7a0956db8fe39b1cfb96705e0a28ec655437e7556b20a4f636bbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307185, "uuid": "ea40a5f2-14bb-452e-bce6-d89f29928697", "comment": "Malware payload (GCleaner)", "value": "aaefeaed24202af165c8e4cbec9db618f5b91424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307185, "uuid": "c8d33896-aa01-4ee9-9dac-80e3684dc820", "comment": "Malware payload (GCleaner)", "value": "dce9a45a2ad18b2abafbed96eb53335de6cccb7a363cda50cc6798cb9ef281be9f02c3e505f55443a6bbcc775a5608ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307185, "uuid": "821b7875-e8a4-41cc-8727-daec19885ed3", "value": "T198F47E22E2B5807BE0271F799C6BC66C543A7E102B39984A37E92D8C4F77747341A787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307185, "uuid": "8cf31bae-28df-4451-98f0-f9611e4fcc85", "value": "421f57ebeade5946b16f0c3c541d2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307185, "uuid": "09afcca6-e243-45e4-9b51-f0dfe349e760", "value": "12288:Q9eONBtJzhKJd6EPXNQyxbLSonZcYZxB6yH+DW9BK3WmCG:Knzz04EGOzZcYjB6K9Hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307185, "uuid": "1a0309a8-39eb-4553-af45-1a63664ed579", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307185, "uuid": "bc0dbfe8-7d6a-4b10-bd0b-3182c6117aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307185, "uuid": "8918b069-0165-464d-a5b2-16d200ab4f98", "value": "a56d680876b7a0956db8fe39b1cfb96705e0a28ec655437e7556b20a4f636bbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04588fb-0231-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770254812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254812, "uuid": "14593bd5-5348-4ffa-bbe3-96f23f6b6578", "comment": "Malware payload", "value": "a9291b2337a246fd829d228c9db53fe6", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Dropper!MSR", "colour": "#C70CB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254812, "uuid": "bc63ef83-b384-4055-9613-965b1afa0ab8", "comment": "Malware payload", "value": "a5e8494d6df69947380c86e1d9661125397885a9251f9ee3b1459e1d0e0dbc01", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Dropper!MSR", "colour": "#C70CB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254812, "uuid": "eca6009f-92be-485c-b32f-79f8fa950e2f", "comment": "Malware payload", "value": "a6f5845a64f6c239b9451a81d76fb469f87a6b6d", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Dropper!MSR", "colour": "#C70CB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254812, "uuid": "01777254-aebf-4841-a92a-cdf23f099eb2", "comment": "Malware payload", "value": "63d2b985a01408f27f0a18d74c2913ee1516f823ffdbe9536d7eff6222e18b78b3f3cfb72b65466073159e53011587ea", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Dropper!MSR", "colour": "#C70CB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254812, "uuid": "2ace356f-5391-4621-9db2-83be1675cda6", "value": "T16E673327B2CBA03AF52B0B3A0572625494FB7A306527BE5796E484ECCF691101D3FB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254812, "uuid": "531b9dd1-c05c-45d4-bc62-414ccea960ca", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254812, "uuid": "31a3b94e-64ec-42a1-9070-fd302c38837c", "value": "786432:8cjXjSZEGi2DLZDoZJasJidKa1gE3Li6dw:8cjORDbyCg+26dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770254812, "uuid": "212fba8a-41f5-4425-bf9a-880bfe05909f", "value": 32562130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770254812, "uuid": "f500e60e-6d14-44df-a565-9cf8af31d7f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254812, "uuid": "bad091ca-584e-44d8-bea0-dd50fcc48d58", "value": "deep\u5927\u6a21\u578b\u5b89\u88c5\u52a9\u624b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f312d317-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770305149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305149, "uuid": "19cde765-485e-456c-91b5-76a1fca35844", "comment": "Malware payload (Formbook)", "value": "9bc2aeb5926d89c8f1d14fd647353b1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305149, "uuid": "5799d2d0-326c-4bfc-a8b9-b5b710b100f3", "comment": "Malware payload (Formbook)", "value": "a645aaf0e366733a5596a6d86d7163f3fac212c14111f0afaaeaf974b60bd962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305149, "uuid": "346a58a1-3d3d-4c7f-bf24-5a913c511c33", "comment": "Malware payload (Formbook)", "value": "a122300edd872d6dd4a437b35846dc74557c3186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305149, "uuid": "045df021-1ef4-4c00-bbb5-b4e1ff93a22f", "comment": "Malware payload (Formbook)", "value": "25134b7e395b071a0f61fc45dacaab8a48ea83488bf9b79d7d328742723bd7c8fa99dd2c00fa0027841a8bd7b5b2a125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305149, "uuid": "6ebb5ba6-55b8-4f3d-9452-7cb1475e94ca", "value": "T11945CF0273C1D062FFABA2334F5AF6115BBC69260123A61F13A81D79BD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305149, "uuid": "7d95e024-434a-4c42-8900-a17621f5829a", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305149, "uuid": "c971493f-15ed-425f-aebd-3978e0a81650", "value": "24576:EqDEvCTbMWu7rQYlBQcBiT6rprG8a6HWCNhj0XUWd+dj:ETvC/MTQYxsWR7a67hj0kX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305149, "uuid": "2fa3f661-dbb3-4de4-b314-4875f67eea06", "value": 1213952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305149, "uuid": "e29cf954-5175-4ad6-a35c-ba14afa27743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305149, "uuid": "ca01a6f8-c3ee-4510-85ea-2364d2dbf494", "value": "a645aaf0e366733a5596a6d86d7163f3fac212c14111f0afaaeaf974b60bd962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1e4beb-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307821, "uuid": "42498908-c1f0-4d3b-a60a-befdef3280bf", "comment": "Malware payload", "value": "1a1490f906652cbd88e522b22ad88a52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307821, "uuid": "87a62ffb-ddfd-4dea-bae6-306d0f08a96e", "comment": "Malware payload", "value": "a68f65367afd1d00fe1a9e530d161540df1ab26771ae24cd678ed48447fbd881", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307821, "uuid": "395f30a4-ab27-4193-a467-f54b4bff761c", "comment": "Malware payload", "value": "5099df33ac1332eca9a29033eebab9f3e73a341d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307821, "uuid": "c196dd89-aa1f-44bd-89b1-cc06368f242d", "comment": "Malware payload", "value": "95bf02375c2349261e2b6c3c81b565c4dea1293148aadac284e3235ba7408307657eb7abbdd32a935aac4d91168a0a34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307821, "uuid": "cb4c5091-9b9e-4df1-bf29-df2f03a5bdb7", "value": "T10C84ADBDFE18E4D1D01542753836A831FB29DF02E4B8422EB9F9721919726CB642BD4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307821, "uuid": "30350629-881d-4e56-b156-bf59bdbb89ab", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307821, "uuid": "a388765a-0db0-4932-822b-25726fabda40", "value": "6144:xMm4CCOkXvVPZCvwriAhaKXIRrJKGeC3mEipPioxBvsfNejt:xMwtn9Ahaou0GeC9ApkfNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307821, "uuid": "c888edd8-e5c4-47f8-9498-d1413ffc6c00", "value": 405088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307821, "uuid": "75cd969d-fa03-465a-87cf-bcde5ea58220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307821, "uuid": "11257247-ae80-4646-a6d2-c942e66d76a3", "value": "a68f65367afd1d00fe1a9e530d161540df1ab26771ae24cd678ed48447fbd881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2271cb2-028e-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770294759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770294759, "uuid": "e6fa9948-0f2f-4c7d-89a3-67f75e59f885", "comment": "Malware payload (njrat)", "value": "c0eaaa030932734938b58efb5d8fb8f7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770294759, "uuid": "2602abb8-2f45-4fab-acab-3509335eceff", "comment": "Malware payload (njrat)", "value": "a722adb3a911a3a03f67459a2ea180e8d2c44345309a3710b59abb21b59fbbda", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770294759, "uuid": "af0682c1-ccc4-4ee9-bb97-a5cb901bc7ce", "comment": "Malware payload (njrat)", "value": "4e40f6dc055c9488b5b3b6ba01a62f3063722b2e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770294759, "uuid": "8e56be7f-0502-48f6-8fcb-9361a1391dc4", "comment": "Malware payload (njrat)", "value": "554834136109fde9d9242c86e07571197cfebc1eff822d46e1549913cd713ae7a725d4085da493ca6ad73c5570ede96c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770294759, "uuid": "960b4eec-4321-4a7a-b2d8-e1f5aacdcae3", "value": "T12B535B002798C965E2AD4AF4ACF2950106B5D6772012DB5E7CC414DBAB9FFCA4A133FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770294759, "uuid": "d659ce9e-8f13-488f-be2a-55db70fbb03b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770294759, "uuid": "03c97f48-7908-426b-ac2e-ad5bea8a03a7", "value": "1536:IJOrwILNhdEwDEgGbbEwRRV0PG2yVclN:IJ3ILNhdpDBGbbEsmhQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770294759, "uuid": "2469236a-eef7-41cd-9dd6-16fb37038204", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770294759, "uuid": "c81f10a9-33f1-4dec-b51a-05f63fe626ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770294759, "uuid": "6ea8a43a-801d-47ad-816c-ab4413e991a1", "value": "vlxx88.is.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a672117d-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1770303302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303302, "uuid": "609b84b4-5bce-4f8f-85d2-4b6f0a3298b9", "comment": "Malware payload (RustyStealer)", "value": "1d1f71936db05f67765f442feb95f3fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303302, "uuid": "c5226039-1ad4-4ed0-8c85-d1974ee6dcd0", "comment": "Malware payload (RustyStealer)", "value": "a79f98bcead6efc9a1b71556e83cac7b0924544f11ff5ceedf80b0cc2f778d02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303302, "uuid": "38aa7e53-470f-41eb-bc2d-1e2bd6e82243", "comment": "Malware payload (RustyStealer)", "value": "b5fbfac459479246010d77dcdbe4ef3dce807ea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303302, "uuid": "1ed6b74b-7e49-4487-b603-05ee6d7332b8", "comment": "Malware payload (RustyStealer)", "value": "2297aada2532c23be86bc2c5639063ae11aa383696c71d4e8ccc35414939f29d4daf7995b96ec2041b67c07b5a0b1cf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303302, "uuid": "f85d8b49-2a30-4179-91c2-c15f30887ade", "value": "T1C074AF02F9D261B2C69B0071A76DA33A963EB6001F1CEEE7C3A25B64DD703E1967075D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303302, "uuid": "dd7e256a-ed32-4085-96a9-81dee6e41f01", "value": "cade7f4ddb0799050accdfa76b5c1f32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303302, "uuid": "1367ac16-ffa9-42c2-9e9f-e0782e23bf7c", "value": "6144:9GmubZRaap9lWlUvdhewgu7KOeB2p6sOmxl08cFAjpP9o0cMlYbc57Tes:9HubvaaUlUvdvlesp6sOmx91Jl2bcNKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303302, "uuid": "8807d5ec-73e3-48a7-9200-128d83642d84", "value": 357304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303302, "uuid": "3f4f0ccc-c14a-4c6a-be8c-f63d56cd3d90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303302, "uuid": "e580909e-a1f0-493f-836e-cf0e26a535cd", "value": "a79f98bcead6efc9a1b71556e83cac7b0924544f11ff5ceedf80b0cc2f778d02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cc3144-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770307213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307213, "uuid": "b57c7a87-24be-4dd5-9861-cf0c02ae1da4", "comment": "Malware payload (Formbook)", "value": "cae7518821ea562905d1708054d7f2e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307213, "uuid": "654f2ac8-3b64-4577-809b-76606156960a", "comment": "Malware payload (Formbook)", "value": "a81328a2a2c26eddcfb42220d96f91ab0a7f56daf5b94539cb8d43555b6989f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307213, "uuid": "79b4d92e-9cf9-4e38-acde-d0e2f3cc1280", "comment": "Malware payload (Formbook)", "value": "048f7b0f3b954579fc51a8d495cc6545052ea74f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307213, "uuid": "be5456fb-66a5-4bb0-a1ed-2b0b5f3a0518", "comment": "Malware payload (Formbook)", "value": "4fd7a6fb245076e5ed19a69a194c94d9729bb6eaa8ba47d149e03ba345af07a120f3a8a909a89feecfb888cb48e89c3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307213, "uuid": "c648d66d-c25e-45b0-a524-bfc277ce4445", "value": "T19845BF027391D062FFAB92334F5AF6115ABC79260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307213, "uuid": "7256e0bf-86bb-49fd-a31d-a8bbeebe5728", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307213, "uuid": "faab428a-c0aa-480a-b1ee-c0b3a0d0aa9a", "value": "24576:n5EmXFtKaL4/oFe5T9yyXYfP1ijXdaQYZeyBWYa+AEQu1Ht3i2:nPVt/LZeJbInQRaQCeYW3mN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307213, "uuid": "6297ef3c-b15e-460e-bd1e-591016e94570", "value": 1261056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307213, "uuid": "24569f49-c541-4eb2-9c8a-3fc089b250f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307213, "uuid": "39146400-ae8f-4156-92e8-0c5144e3cda7", "value": "a81328a2a2c26eddcfb42220d96f91ab0a7f56daf5b94539cb8d43555b6989f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183c619a-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305640, "uuid": "ed40c0b8-a322-4747-bd28-42bb19b6c216", "comment": "Malware payload", "value": "dc61c475513e9302f930ac551deb0f49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305640, "uuid": "ef8f153b-8c5d-4c45-befd-5f877db6a129", "comment": "Malware payload", "value": "a81652d1db7025180ad3d260255e9e19603a32a5a55982e9e3e9fc281035116d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305640, "uuid": "f61a0a00-c48c-4457-80a6-c37ebdd5a996", "comment": "Malware payload", "value": "4cd3fc4fdf569827e18684bb8d9660239afef43a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305640, "uuid": "4ed3544e-8dfa-4e4d-84aa-6bc30ac5b656", "comment": "Malware payload", "value": "65a2da6c0a073983634b0e39db67b3279b2858c7f24c03d01dcc4674e68b85d60efdc79f62c54961a35fc93cf5cc41ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305640, "uuid": "bbd5f0c6-240d-45e4-a5f1-8e79aabab1fd", "value": "T156642A12E6607415F86349B02EB8925768293E362680EC0FB68DDF5A37716C7B1F931F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305640, "uuid": "5346d5d2-4eba-4c86-81c6-c0dbb993a90a", "value": "16dcc3a49e7a56f90ef4d8608cb9f2de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305640, "uuid": "c37fedb5-33f2-411e-bd53-12c7fa2a8665", "value": "6144:Znq8yzw1X74MwEgAwdpHrx9aR2NioJhmlx3+CbmjRP+mKsvL7OJjG:U8yzREgAwdpHrx9aR2qn+CbmNGmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305640, "uuid": "a41eab8e-afd4-495a-aed8-4cb07681d2a9", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305640, "uuid": "576fa988-7819-48f8-8171-c1c817311829", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305640, "uuid": "e4f2a9e2-67d7-49de-9031-a32b7feeba3c", "value": "a81652d1db7025180ad3d260255e9e19603a32a5a55982e9e3e9fc281035116d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d203fb8-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770307796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307796, "uuid": "9bc0991e-c961-483a-ac61-4141a534e7e3", "comment": "Malware payload (GCleaner)", "value": "bd85d673c28ffe5d7401c72bbb4ce1b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307796, "uuid": "4c8ed3b2-f7ca-4666-93c8-7b7c90364693", "comment": "Malware payload (GCleaner)", "value": "a81fc469e7c44f9401c019cb0563b6eff4e0f63ecf165318af7562c2b9700e75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307796, "uuid": "cd3587f6-6202-410b-98de-3479cc9deec6", "comment": "Malware payload (GCleaner)", "value": "cc9bcdb96c6cb6ee50a39ee90934518812819a11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307796, "uuid": "08598fcb-a2f9-45e3-a8df-6fd26524307b", "comment": "Malware payload (GCleaner)", "value": "094dc1f7623c7c40d54fc0d501f8aa72377b7671d8b398fda03cc98704badeaca7898263cbe2f3b97fd3af2cb388365a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307796, "uuid": "1f183dea-7402-4769-9a24-f8e5ae778b81", "value": "T1B3058E12E1E38537F063167A9C6B966C64267F10E939A44A37EB2EC84F77341B436387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307796, "uuid": "72aee1ff-1185-45d5-be26-faef34be5694", "value": "421f57ebeade5946b16f0c3c541d2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307796, "uuid": "9c061ddf-7cc8-44fd-8cdc-f331ccab6e29", "value": "12288:39eONBtJzhKJd6EPXNQyxbLSouZWcObAdNob9c6Jk4n5G:Xnzz04EGOzkWpumbu4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307796, "uuid": "dc0f1812-aebf-4b85-90dc-d20494d817dd", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307796, "uuid": "279d377f-4b7d-4d81-99df-a52b08bacae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307796, "uuid": "0c4fa776-cf8b-46e8-b6db-95133e06f92e", "value": "a81fc469e7c44f9401c019cb0563b6eff4e0f63ecf165318af7562c2b9700e75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca00255-029b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770300252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300252, "uuid": "d48dc1af-1a82-4eb4-8b08-0d86303d39a5", "comment": "Malware payload (Mirai)", "value": "33c40b694eb9fdf243cd788ce47a75df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300252, "uuid": "de306f4f-ae73-45c1-add4-99826e74d51a", "comment": "Malware payload (Mirai)", "value": "a899f49b13048eed80f78427d0ddc356f298f8dbada776cbbb3fb2b6a42a7c5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300252, "uuid": "82e24014-7e56-495d-a2b5-20725fe7f78b", "comment": "Malware payload (Mirai)", "value": "9a809e25a933d7dd802e6ceeed8c3274da183c4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770300252, "uuid": "8db7d27c-0185-4222-b735-9bb00d1af73f", "comment": "Malware payload (Mirai)", "value": "d280264490cf6e02181a2d31579ad6c5e35a5962fc4b38a1b51c3e3a1834993106b3de4f1ce1eab83778ecfa45cd8642", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300252, "uuid": "b5847b83-dbbc-4eff-97cb-11ffab262f72", "value": "T1F9C3F185BB636991D0A242FDA4C00AC387912E318BE217480699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300252, "uuid": "d5ad7984-d3b0-4c38-82c8-25c999dd4564", "value": "3072:SBdQK+TG2nIjnRdZaUXUSgkLCCVwHWiEiBtbMMTnA:eMQRtXU9kLCP8ifbxTnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770300252, "uuid": "791bc806-3a2e-4182-90db-c405bdd858d9", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770300252, "uuid": "7d598c09-7585-414f-94d7-3c7efdf8855d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770300252, "uuid": "12b3569f-c739-4a86-b281-64b183763af5", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4645843d-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770306577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306577, "uuid": "b8e4aadf-09c4-4156-975d-5e662e9baead", "comment": "Malware payload (Formbook)", "value": "ddea7ce0eb115eeecee66a307c5bb192", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306577, "uuid": "056ce9b7-4e16-4e46-835c-2a6dd50678f4", "comment": "Malware payload (Formbook)", "value": "a8e1debb9e44279a6e450fe6c16c9227007ee3f642d6688bc40770af9c838052", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306577, "uuid": "644df929-0f79-4179-9845-38dc60c3cb0c", "comment": "Malware payload (Formbook)", "value": "d24e50bc299e010d1c3b7fd37154263c1d1ea25d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306577, "uuid": "69be988a-2ce5-4403-8685-1b6ded39c9be", "comment": "Malware payload (Formbook)", "value": "837cef1ca61c6efdd62440bd0f7c525dda6f2754a122150e5683df70889c506d4c1d86247442073ffec761760f80879c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306577, "uuid": "e5f87956-a2ea-4ca8-a1d4-5c7927dc8584", "value": "T1D02512983769E802C4564B764DA1E3B41274EF8CA542C3438FFABDEBBC646C278152D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306577, "uuid": "27c10474-436b-4f27-bf57-482bdb8f74c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306577, "uuid": "5940b662-8863-495e-a4c4-428f0f1895a3", "value": "24576:mQTifxibz+mt6jGWtqLS1txq6fk7O3LZB+J:mIvWjGG7k7GLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306577, "uuid": "9f737fff-b237-48d2-87ff-3dad5407a04e", "value": 994304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306577, "uuid": "fa5bdd78-b7a9-4629-ba30-55f0a762a4cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306577, "uuid": "925bc971-0de3-485b-97d1-eb64e5c92f08", "value": "a8e1debb9e44279a6e450fe6c16c9227007ee3f642d6688bc40770af9c838052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0ee6ae-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770307256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307256, "uuid": "6e2bad6f-27ab-42ab-a6e1-6e179c208d6f", "comment": "Malware payload (AsyncRAT)", "value": "ac1e85396ac5fc0e73a458f8be7c2ae3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307256, "uuid": "b6a90ebc-1ad8-42a1-acd6-14aa23c7c8b7", "comment": "Malware payload (AsyncRAT)", "value": "a947961c5aa37505a52b16b0f6b0fdaacc405e982029ad8d3e360857192222a1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307256, "uuid": "591cf7e4-c767-4896-8b35-c55ebe7ff8f7", "comment": "Malware payload (AsyncRAT)", "value": "dad0b1a6bce7bf3566620efa46b203d1af5dc899", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307256, "uuid": "5f6f2f62-c5e3-4f7d-ae76-2b515d157590", "comment": "Malware payload (AsyncRAT)", "value": "e3a614913c9eaef3c56ac23628a6514e970969565b6c001ff8fd85a103d83f74c785ff969811447f9ca7738ab29e449d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307256, "uuid": "586c3afa-4a4a-4a7e-8fad-0e5eb6b2f6df", "value": "T19393AE4AF29324FDDA47D1B4429B5B72FA32FD720020AF3B6254D6352D31E91AF1CA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307256, "uuid": "7367f0ec-5c3d-46f1-9696-ffd0a2a059a7", "value": "5c47aedb772f18ea2ac2bca0242771b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307256, "uuid": "a66c4fcd-a286-43d3-b672-a110df2bc422", "value": "1536:Ffn34x7OFmCmN4Mkwx/YQlbCMbZmm/ikkk8VaGMAYoARTr4EjrHdMcIgqWQ8MXxB:Ffn34x7OFWrkwx/YiBmmqkkk0awYoARi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307256, "uuid": "c5a22f13-8d90-4185-8c43-71586c487fbf", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307256, "uuid": "8c940d99-4908-4be8-8bec-e775672354d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307256, "uuid": "a1a90707-d985-4b9e-9e37-9e0f520ccd44", "value": "a947961c5aa37505a52b16b0f6b0fdaacc405e982029ad8d3e360857192222a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b38471a-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770307873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307873, "uuid": "d16a4aad-da77-40c9-a2a7-97ac9a718a45", "comment": "Malware payload (Formbook)", "value": "86eab3733f0c442de0217049982a2598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307873, "uuid": "69ee3dce-7256-452d-9fb2-4370374239bb", "comment": "Malware payload (Formbook)", "value": "a968e33c469495447d6ba7455958b390baad4e2f5b8ecce72a049e2d08f4ff4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307873, "uuid": "786d5fcf-b47c-424f-84f3-723499d10d1b", "comment": "Malware payload (Formbook)", "value": "26db0a3c47e769c3f0cfbdf21668fbc893ce3681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307873, "uuid": "68c6129d-f1ad-4a29-9192-07d621cb1f3d", "comment": "Malware payload (Formbook)", "value": "cc9c0ca3bc4ddf68b9e0d9210c9dcd2b2fdfd354c4c05f179611085620e1b42246ea915869894a196c6ae628f8e1d9f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307873, "uuid": "47465e5c-5483-427b-a73b-e8f9a09d4ea3", "value": "T1A835020832A9D413E0A61FF855B0D1B51B797E9AA932D78E0FD52CDF39F6B005A107A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307873, "uuid": "20fc92a6-eb3a-4eb2-be10-8da0c0d545a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307873, "uuid": "b2619171-abc4-48fe-b422-72c5bb06aeb2", "value": "24576:cvjcose0cM2ZDDDe0kLq46ElhvGyBk7jEFJ0T3yzY:be0c7Je0kLF6ChSEbNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307873, "uuid": "4a04696f-af3b-4974-a904-11b5a196f78b", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307873, "uuid": "b68e979e-97f4-4c3a-b4d5-c5c67cb8620a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307873, "uuid": "7d938a4e-7eb6-4159-9584-54ba52252dbd", "value": "a968e33c469495447d6ba7455958b390baad4e2f5b8ecce72a049e2d08f4ff4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc200310-026c-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770280253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280253, "uuid": "77b4c256-ad7a-4c8b-a873-46b4a1267dbc", "comment": "Malware payload (AgentTesla)", "value": "0a5fe0c8a8d47fa652e7017faa39d5fd", "object_relation": "md5", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8512555116", "colour": "#1DC460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280253, "uuid": "52654273-fa65-4bc1-abb2-034cd7140737", "comment": "Malware payload (AgentTesla)", "value": "a9707d2b6808a2b42efae1293055ca6bee67f41dc475286e782cd9dd4212a3e6", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8512555116", "colour": "#1DC460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280253, "uuid": "5c007ebf-8699-4a9c-a9fd-dfeb49754743", "comment": "Malware payload (AgentTesla)", "value": "7f3395cd27c24ca72e470d18cbd0f2ffe35a213f", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8512555116", "colour": "#1DC460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770280253, "uuid": "4d3d88a1-d3d6-4f23-8f16-4985abb4527a", "comment": "Malware payload (AgentTesla)", "value": "d1cf50f2401c96bebca25294f8a6fe42bd157d993a9b583c549bf11631f4548fdaab9965fd49c47507fc19e899495e76", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-90", "colour": "#A8AC57", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8512555116", "colour": "#1DC460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280253, "uuid": "bd3f8e5d-1295-4462-88da-4cdc5f693567", "value": "T1A0350110EA42DC65062C822064A51ECA05404EB71D44B77A7F8F4B9EAF5F90FC57ABFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280253, "uuid": "d3ef0eed-b201-4404-9c8c-13a2b60548f7", "value": "24576:h/A6OyNJgFSP3KEsrImDtzDkBoOFFctTHFl:pdtPv+Dt+bGll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770280253, "uuid": "1a538166-cc86-456a-a630-4f2cdb82fd28", "value": 1068685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770280253, "uuid": "4833ae13-3148-4c83-95c5-6a32246395d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770280253, "uuid": "01725e8e-15e5-4659-99d2-5c62732f9adc", "value": "AIRFORCEEEEEEEE(1).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab78433-02ae-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770308436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308436, "uuid": "8c02f13c-c84a-48ba-90d3-6055b24ec19f", "comment": "Malware payload (Mirai)", "value": "9c8722019404d4ee6412b2a888229443", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308436, "uuid": "2b2fbf36-b815-407c-be8a-69ae48f27aad", "comment": "Malware payload (Mirai)", "value": "a98b74a6626cca342bb439fd0a3c36552374dbfea08dbfbc1436ca8abb3a81a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308436, "uuid": "8f970294-984d-4b6c-9a02-abf8c9aca8ea", "comment": "Malware payload (Mirai)", "value": "80e4a47bd4e7ab9cf7fc36cddfddd5efde968f2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770308436, "uuid": "de56548a-5b71-4d69-9f05-7d81d19efd59", "comment": "Malware payload (Mirai)", "value": "36142d659405cab9ff330d393822ffbecb750e2e4233098979587943db47ee9090d42a7ed306c55d96d8b5532358c6aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308436, "uuid": "b663975d-129e-4ce3-84cd-1afc1d07f387", "value": "T18BE323B077418250FDE979F23B4F2206F421221D3EB4A4B8DA9C48D35A5F9694E1323F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308436, "uuid": "2fa87884-3aab-4ad2-9ebc-5d9687b95e64", "value": "3072:mBKkE/ILjP+Pc0ce/9W/JRO8wqiQ209/9Z5+Zy0u:mBKkE/aP+pbgjO81209/Hqy0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770308436, "uuid": "b40b8f24-cdc8-459b-9ce4-66edda530c0b", "value": 145196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770308436, "uuid": "09c3b13e-3039-4613-b59e-1278aa8b07c4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770308436, "uuid": "2b933425-ce3c-4ec6-acc9-1b702362c27f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdcfc9c-0271-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770282187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282187, "uuid": "519d1e0e-5750-4a97-a498-6c99b1db1e7e", "comment": "Malware payload (Mirai)", "value": "f715ee5bc77afac249ab02c22c969192", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282187, "uuid": "7fd39022-e8f1-42c8-b882-1d41d5114006", "comment": "Malware payload (Mirai)", "value": "a9c759ea5c27d6cb01a2bb9577eef1e0e412f2ffbc1543e9a7a69795b830c42c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282187, "uuid": "c29b6819-1227-49ba-9e84-79fe1085e2fa", "comment": "Malware payload (Mirai)", "value": "7e6c14e9f7223cdfe254b657be13b6a888eae3ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770282187, "uuid": "cf16a2c3-f975-470d-a085-2664b1efd5cd", "comment": "Malware payload (Mirai)", "value": "1a25aa03155cf51fa2fceea714f3d7f9ad2c1359f9be4ad8002da4f15be40bc2cfc205b5cbbe90837263e9ddbd90888f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282187, "uuid": "c3b17392-615a-45c1-9925-bd15df643d46", "value": "T107230231850E9EB124703C36DBD593937AE12AB1C6673023DA290A3C2F797531E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282187, "uuid": "a8c9e5c0-383b-4403-b966-081911040304", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3eC9q3UELbUXfi6nVMQHI4vcGpvW:gECFd+A6YHAxALRQZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770282187, "uuid": "0c5a8408-2d7b-4407-9b6a-7bf203236c2c", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770282187, "uuid": "2b4dd0ba-f86e-4c37-a82a-d61cd8140cf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770282187, "uuid": "a414097b-9026-4ef8-8a96-7b6558a9ea02", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf1970c-0230-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770254188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254188, "uuid": "e426f63b-c4d7-4d17-88e5-8317637bac66", "comment": "Malware payload (Mirai)", "value": "4dd702b297d14567bb3ea69004cb8eee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254188, "uuid": "2b8a2796-5571-4c5c-905a-b411b66eb063", "comment": "Malware payload (Mirai)", "value": "a9d2cce6c0bb9b5b47a64c905a51219d8965eea2484d4c62a999288a31f548ab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254188, "uuid": "9822e513-87ed-432c-9816-03d1e0364462", "comment": "Malware payload (Mirai)", "value": "d45d6ed0c26f97d9ccbf9603ff2e3fc9eed7f5ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770254188, "uuid": "eff72479-7a52-4d89-a2cd-6cea62c0fbfc", "comment": "Malware payload (Mirai)", "value": "39bb7eacff16d0e5c8c1a8597ef35e87a4e3a92d5dbfae86f38169968216c852b03f74d423eee3fa913582b04fb682ad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254188, "uuid": "1fcfa5b4-5b88-4aba-88ea-185d44e3374c", "value": "T140734A07B58180FDC599C1784B6F723AD973B06D223AB2EA63D0FA237D89D215F1E614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254188, "uuid": "fd93bc6f-3c84-4b80-90c6-d01a95a42fab", "value": "1536:CNyoPVSMA178o948VfIvAz+XASh+jGCFrF50++g+0RPo1F1RB+YVWQZq2ytfJw:qyGVby78V+6A6Xz+jGC5F5F+g+R1F1R7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770254188, "uuid": "ebf4415e-171d-49b9-9dae-ee932956ff55", "value": 79152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770254188, "uuid": "c21d0fdf-5221-44e3-9307-56fa9d730c91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770254188, "uuid": "1cbae1a6-40e1-4382-b033-a8fe69f716af", "value": "manji.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9d980e-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304812, "uuid": "4c016c03-7b06-4517-b8d0-a257488abb8a", "comment": "Malware payload", "value": "1d7af8e9f6cdf7b3fb903e3e5fa3e84f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304812, "uuid": "b6e98685-39db-484e-9bcd-2fe1348d474a", "comment": "Malware payload", "value": "aa0bfc8e084a089d59fb8469c193931ed83623beecf4f206b612f07f315186a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304812, "uuid": "9bdf920f-f049-4158-be74-c07429534a35", "comment": "Malware payload", "value": "88eb91a86202537af0afbd3e0dfc3d279561b6e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304812, "uuid": "40c21d0f-e9dc-4772-9dcd-d6c5deaa34a7", "comment": "Malware payload", "value": "57dfb81c4ae87c363dafccb354b65528bc6bc622add2bebf010024bd35203f8c58d9677ad4d572dec535c4ffdbd033e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304812, "uuid": "e27dc1ea-4610-4b69-adb1-343e5a2d1bba", "value": "T15794E616E750B425F89349712D78A257782D3C3A2A80ED0BB78C9F5A3671683B4F532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304812, "uuid": "e7125e80-719e-424c-a1cb-7b4e1c9a44a6", "value": "6b6388e99b4696a4d1c08aed6c1d5636", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304812, "uuid": "67734915-3a16-4f51-b9a4-2e202ba8e396", "value": "12288:MpPaolMK5MkSPx9SnITC19dxMYGkyCHqa5QkSRv8kVxV:YNnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304812, "uuid": "e2b5df8a-fe34-4b9f-ab12-ef08ad557598", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304812, "uuid": "a15af941-f12f-49ae-8609-e19a44bd2e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304812, "uuid": "d521d76b-5993-4241-a610-fe9ddc8f1b1e", "value": "aa0bfc8e084a089d59fb8469c193931ed83623beecf4f206b612f07f315186a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c70c32-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304299, "uuid": "179a92c4-0aeb-4c98-a8f0-ecb15aca47de", "comment": "Malware payload", "value": "d8db6e216af2d3a507adc0a78709aa3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304299, "uuid": "c2832354-cdc3-4a7e-872e-70f3d8836886", "comment": "Malware payload", "value": "aaeeb4c747c0b0437e466fdcdf57f01202410ccceb1241cc790b9fab63ee23c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304299, "uuid": "d4379402-4605-47cc-85a2-1ada9f631cfd", "comment": "Malware payload", "value": "de45534ba1965b60b6f9fb2f2deaff5dc2b83606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304299, "uuid": "1ff6ff8b-5bf2-412c-bb52-1f31a1df8b27", "comment": "Malware payload", "value": "51bb8cf40362ad801f1a2451524e6097de4b3cf6d58976304cbca86cba49ae6df83415c373c28ae722c69ce558177580", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304299, "uuid": "eba37b68-c7b8-4249-8b89-42eb9fd364f5", "value": "T10394E616EA60B525F88345702D799246682D3C3A3681ED0BBB4ECF863771A83B5F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304299, "uuid": "86d089c4-ff55-460a-8f99-978e3a5a2da8", "value": "9d5d39a8ebc1c90a9cb2a0164da5eb48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304299, "uuid": "8ff482ee-99ad-4697-b25b-247eb269cd3e", "value": "6144:ttejlbyX1Enr1UjERDveQFMBz9+3zRC6fOOZacS2FqJFxt9I6g5s1SR:LkbMaDveQFMBz9+3zo6a2Fq5t9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304299, "uuid": "69bad56d-f637-4276-bacd-a1863b980c04", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304299, "uuid": "c2af4474-39a7-48dd-bf52-ba405d512e79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304299, "uuid": "7282647e-8b9a-452f-a91d-8747195631c5", "value": "aaeeb4c747c0b0437e466fdcdf57f01202410ccceb1241cc790b9fab63ee23c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938178ab-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload (Ponmocup)", "timestamp": 1770306277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306277, "uuid": "aae19f2f-8390-4853-a99a-9cc6d81656a5", "comment": "Malware payload (Ponmocup)", "value": "ce5642eccc2bb52d98efb3c336fae48b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ponmocup", "colour": "#4CDDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306277, "uuid": "7dd64439-6bc3-402a-9412-f8fad1d7baba", "comment": "Malware payload (Ponmocup)", "value": "ab7d7418877cd84e61af952f95e67183524c7124ae7cee35a31705c40d2a4a23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ponmocup", "colour": "#4CDDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306277, "uuid": "9fc05253-8b12-482c-ab2d-6f11c3ab9684", "comment": "Malware payload (Ponmocup)", "value": "4821a4ef15228702c116bc7db87ab34278585507", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ponmocup", "colour": "#4CDDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306277, "uuid": "3587bd8e-945e-47ab-b850-aab58bff84d1", "comment": "Malware payload (Ponmocup)", "value": "62381de16c64221fc2573e342123559347bee405401194ca68e223299681fdcef547d3ded8b05a37d7490688a3b7b29a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ponmocup", "colour": "#4CDDBE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306277, "uuid": "0b792975-2a8d-4180-8ccc-d06541356a36", "value": "T1E964120172C1B477EEC283B889A61F59CBB3B54565A0685B1BE8194DEF277D8CC36383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306277, "uuid": "b5ee4966-53e8-4301-b50f-8f634a555e2b", "value": "57f81c0a55c7192a240efdf0e71f9f9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306277, "uuid": "eab22129-c3e9-46fb-8911-68879c11a0ff", "value": "6144:AHr0Z4DQEuInbENKjMBOqi7UgVaJkPe+lvM4RRvGaIz6aacifK8:AHr0Z2VPoNrBOqQeEde4aVifv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306277, "uuid": "6b215311-8d4d-4d4b-a595-3c4f470de21f", "value": 330256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306277, "uuid": "6656a647-0a9a-42d0-b406-83fe01e3ca6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306277, "uuid": "62300422-684e-4b69-a655-be43fb3c364c", "value": "ab7d7418877cd84e61af952f95e67183524c7124ae7cee35a31705c40d2a4a23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f14dbf8-02bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770315557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315557, "uuid": "0f96fbf2-5c19-463e-aba4-1ef61a34616a", "comment": "Malware payload (Mirai)", "value": "3ee92a1bc2c5bb56fa534aad256a0ac6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315557, "uuid": "b95eaa89-1f81-4eee-8a67-08bb66d59f47", "comment": "Malware payload (Mirai)", "value": "abc59043ce9e56a70ab5e5c0a3d44a088e09fb163a10dbea8e785ba24a177ab1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315557, "uuid": "9454b603-6189-4fbc-bcdd-535b8799fbff", "comment": "Malware payload (Mirai)", "value": "a9227eb7e35cbea1017239e3fafd009209c21d2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770315557, "uuid": "96eb2bf3-2400-4bc9-b690-f136a633a9c3", "comment": "Malware payload (Mirai)", "value": "10a4fa415da550b93ba2cc01ee1b2d86805975c085286b5614661c5bced8b7d441fe48018a1d547d6050939982b690da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315557, "uuid": "5e84fd48-fe56-4830-aaf3-cd0435df5e42", "value": "T1F2556C2AB2B2F66CD007C03497DBC6A18521F0756A323D7F37849B352EB6DE45359B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315557, "uuid": "3f314f4c-be44-451b-b5d2-c0337fc3c458", "value": "24576:1hipjNGjFWNgQixvl0yB3ZtqczU+x1uDIIRmplQ68aZY:1mJGZWNgH2mtqczSItplQEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770315557, "uuid": "22308b36-cae6-4fa3-b2d2-bb8de9a3f327", "value": 1353296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770315557, "uuid": "aa2d4b15-0537-40b5-bf9b-32efdc56dc6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770315557, "uuid": "4ec8a0c2-e761-4b93-ac31-2105c2959034", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3a0e03-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1770305328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305328, "uuid": "b5e701af-6756-4602-8824-a24a1492f04b", "comment": "Malware payload (a310Logger)", "value": "90647c2bf743b1d4d99df9dd344e89ce", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305328, "uuid": "d4f036bf-60fc-4189-8fdb-f4bd2234d9e9", "comment": "Malware payload (a310Logger)", "value": "ac410c5d9a850d589afdd5316f4e463dbf55cd0e798f7f4c0189a5cb193945f2", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305328, "uuid": "a076bce3-9667-403f-9917-486a0cf00c85", "comment": "Malware payload (a310Logger)", "value": "245938a3293c81ded404ae36be779fe10a0da206", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305328, "uuid": "8f234d51-ede4-4c26-8f69-752d417275a7", "comment": "Malware payload (a310Logger)", "value": "a0b89dda37fe0c5b2c2780f57d7464e288e360e35bc8fce15383d2ea818ccdb41c07ea10f9bc7c0f2c68a1acb07949ea", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305328, "uuid": "894a0c77-2f4f-41b1-ad57-7646e83a4023", "value": "T19155E034EB3EA705D0627670C829D6F51B28FEC8A904C30ABFE9BDAFB8355510766345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305328, "uuid": "8b6c0968-66dd-4ab8-82a5-dbb1dcd51c94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305328, "uuid": "0523198f-0658-4ab1-8429-8bc978fa9904", "value": "24576:Us40KjODCV7dVe9TMejJ5qpVsN+tXzZ635j9RpmOePLvZmcz:/40KtRYTMejJADsN+RzZat9Rstsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305328, "uuid": "ceff2505-779a-4cb0-98d9-127c3394bac4", "value": 1308672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305328, "uuid": "abe5c0a2-0109-4f23-8eb5-0e52ae85e68f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305328, "uuid": "7f98aea3-68ea-4dc8-b561-72de8eaf167d", "value": "ac410c5d9a850d589afdd5316f4e463dbf55cd0e798f7f4c0189a5cb193945f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcc8c83-0261-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770275129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275129, "uuid": "74cdaf7d-e595-4720-aa18-13d3f6097b1b", "comment": "Malware payload (CoinMiner)", "value": "c9cd419f39577624ad01f31c1f0a7222", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275129, "uuid": "fba956d9-58ef-4c23-9be2-9dcf6ebd4391", "comment": "Malware payload (CoinMiner)", "value": "acc3ae2bbd373453eb849c22e2acc4e14bc9ae2c0b3464d8215c5eb3935f863c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275129, "uuid": "c792e18e-c462-4b05-8afd-688adb9fd605", "comment": "Malware payload (CoinMiner)", "value": "010b494abc14f572572405e0fac5681606442c31", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770275129, "uuid": "afcd23da-a7d2-4bca-a950-8d46b41c6ccb", "comment": "Malware payload (CoinMiner)", "value": "17568055bc8b3f98a73c9bd699a4901c627f58940f878c235670fba5c02cd99207e3dd83fee6f16fb528ffa1ed754deb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275129, "uuid": "f7f1683b-2b6b-4834-a851-c859dad32da1", "value": "T1ACC312BDC938B83BEE88E57F634C18FB7788D8886D48A13492C2DD4C76A3203565D56D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275129, "uuid": "e89583c9-23ba-4796-877a-0e356bb9d6b2", "value": "3072:IeXo9oN7/RlC53GO+2RflOnyDFr+WaouIGTUNL5vD:xdplC5/ph5vxGuL5vD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770275129, "uuid": "84ff3788-0c49-41ef-a706-532170086494", "value": 123072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770275129, "uuid": "d0abd77d-6a40-4bbb-87ea-ff15ccd39cbe", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770275129, "uuid": "1150cb3c-aa83-4ecb-9a39-871538d97cc4", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e6e159-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770303355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303355, "uuid": "355fe740-91af-43ee-bf7d-51857394e8d4", "comment": "Malware payload (PureLogsStealer)", "value": "bc94605986c84327b054d3201e355c1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303355, "uuid": "7de6c12b-b3c3-4a96-891e-d1950a15c862", "comment": "Malware payload (PureLogsStealer)", "value": "ad4bc81d9a1b11e92b1f7f355d11e6aa87a44722a17fa86e148b318cf939a702", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303355, "uuid": "044ddd6c-c9bc-4548-b8b2-78f824df9747", "comment": "Malware payload (PureLogsStealer)", "value": "8d61124cf9dc3869f6f5fc523a5ec96941f8805d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303355, "uuid": "7700d8d2-1f50-4935-b7da-2cfe1d239188", "comment": "Malware payload (PureLogsStealer)", "value": "478e4eeb50c50c3736e154c010e088c85df5b2e7a83372dafe8deebd476b3a75d410f690f983ec48df7711b7ba1a317e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303355, "uuid": "a77716e5-0d8d-4947-b894-2e1ac137222c", "value": "T1953523720F68CF36E8A765793001D05EEE51A5D3D1EB7A82C57ACA0F4DF63A28932531", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303355, "uuid": "1ca6fe5a-8b8e-4dfa-9099-2ad5de333faf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303355, "uuid": "ebd2e10f-109f-49ed-bf2b-4667382f7bc4", "value": "24576:54ism0n0j16ACPLuyOiyvkdNaFm7LtO8jml1pdIP8r5RBBocB/E9hOv:5Cm0n0j19CPHysdNNOcmJdIkXBB/BOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303355, "uuid": "1e5afe90-655f-4974-b8cb-ddad2d6c7485", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303355, "uuid": "33697e36-8818-49c1-bbe3-addd4361b35a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303355, "uuid": "6bc58b95-57f3-40bb-9f80-79371c9d5de0", "value": "ad4bc81d9a1b11e92b1f7f355d11e6aa87a44722a17fa86e148b318cf939a702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40be5402-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307426, "uuid": "83e59813-7a50-4b63-99a0-d212f1d2f9f7", "comment": "Malware payload", "value": "64d9ffb82613d2674c8429c44d0cf815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307426, "uuid": "aef02d7d-eb38-4109-8720-cfb811a7b9e3", "comment": "Malware payload", "value": "adb3319a667dfe7de299947c19bd0b45ef0179f213ba2fc2198301929cb32712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307426, "uuid": "bf032d67-481c-4ec5-8fb0-f53da83aef7f", "comment": "Malware payload", "value": "4e1e0c93c49ea0278397f139413845e5f1de2409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307426, "uuid": "73beb1e9-a42a-4e45-98b0-6d3b71078ee0", "comment": "Malware payload", "value": "a876b8f6a27ca9adf0557d6c02781c91b3aecfacf1677859aa742a9eb0042875b54553ab24b0d484b84c5ea7f50df2fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307426, "uuid": "cca2abd5-d149-4d8a-bad1-f7dff3485c92", "value": "T1A8247A67A42CA79FDEDA2F32ADDE8A3353A65FC4CA91103E0C14730E3C671095E39656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307426, "uuid": "798f8f7a-8391-4c08-a2b2-45f0bcb4709d", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307426, "uuid": "b9efc94a-5cd2-460b-97eb-308660eee6a8", "value": "6144:6ynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g3H:5nO56dyO7Wc8oNrRHwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307426, "uuid": "7b1c3224-2733-4076-bc5d-5cad2d0e32ae", "value": 226018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307426, "uuid": "34c0767d-05b7-413b-b9c3-5a7505c27a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307426, "uuid": "e9ee9ce9-df98-4a69-b94d-be27c16a4a88", "value": "adb3319a667dfe7de299947c19bd0b45ef0179f213ba2fc2198301929cb32712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0983e514-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770303898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303898, "uuid": "de06ac6d-5022-4a7e-adfd-a153efff8b0e", "comment": "Malware payload", "value": "9edc5c81dc60d89dcde0183bef6948e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303898, "uuid": "15cfade5-9c8f-4f82-8743-38b0a3b8fe54", "comment": "Malware payload", "value": "ae135de78b7e9841526b0dd92e2f8ec6de6a5943bda72b4461c5cc9aac71572a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303898, "uuid": "63549472-a89e-4bff-82c1-b62ef246dcba", "comment": "Malware payload", "value": "9f98ebd6647812903273f5874965b5b6c6ee9796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303898, "uuid": "5b32651d-3535-4035-98d2-16b45fd14aa9", "comment": "Malware payload", "value": "cd33e0b2b2d8e2c37b77306be5335fdf275a759e17576b7d819da2a170644905ce56705c8c34917a45102e64a5d4f3e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303898, "uuid": "e7b32381-ca1e-430b-9bed-787c60a30289", "value": "T1D794E622EB50B0A9F89389702C799256391D3D3A2680ED4BB789DF463771993B4F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303898, "uuid": "1798dff4-9143-49ae-a25c-2badfabee40b", "value": "258fa525e0464e2d2ba035f92f9a20e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303898, "uuid": "4f5b7c06-fb8b-48e1-9581-b2d4d2c2f21a", "value": "6144:YSDOpdmJL0mnZaVwCg+TE/idIiYvTH8HQ+c0B+T0WESugrSvZ5bpzWgg4d8vvFHG:YdsJxN+TE/idIiYv4pkvv61Og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303898, "uuid": "99ca40af-84d5-45de-9769-c14abf3ce2eb", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303898, "uuid": "ed1d3265-62da-41fd-b4e9-be92c8b974fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303898, "uuid": "6f9b3a3c-0d9a-4a75-8e09-6bc8484d859c", "value": "ae135de78b7e9841526b0dd92e2f8ec6de6a5943bda72b4461c5cc9aac71572a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab8378a-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770307363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307363, "uuid": "fb21502c-5118-489d-ba48-55792c4409ae", "comment": "Malware payload (Formbook)", "value": "911a71628add0fa633a55abb0ad033e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307363, "uuid": "cb4ea58f-b589-461b-95eb-c6ea59fa31c4", "comment": "Malware payload (Formbook)", "value": "ae49015e074d54faf2cb9315ed66c810d79f634aee69cdaa0e889ceae8bf0cc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307363, "uuid": "0604fffb-b55e-4a49-b988-85761ed92594", "comment": "Malware payload (Formbook)", "value": "ef65a2d4c193d4baaca93362f24c26bd5d695135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307363, "uuid": "522bdf89-6750-40ef-9048-e7a2cde87c1b", "comment": "Malware payload (Formbook)", "value": "aef30bc6d96d259e17af9a5beb72630aac3c9c075f648837cfe69ce1bb935366734103fff2de728567435ee78a8e44dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307363, "uuid": "d56b14d6-cb86-4ab0-b09b-48d85bc8c781", "value": "T12845BF0273D1C062FF9B95334B56F6215ABC79260123AA2F13981DB9FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307363, "uuid": "77f3ab27-b6fa-4085-b2e4-1164c7779e3c", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307363, "uuid": "dce3616c-bd6c-4f1a-8a31-1ea6a91cfc18", "value": "24576:J5EmXFtKaL4/oFe5T9yyXYfP1ijXdaGJPJM2Dqeugo5B:JPVt/LZeJbInQRaGJPJMtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307363, "uuid": "d9d7ec14-710d-496f-8760-71b707086b46", "value": 1265152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307363, "uuid": "f7fd6be5-e15a-4c80-925f-ddbc6adea6be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307363, "uuid": "de8ef0b2-c62b-42ff-ae85-fdb543f732be", "value": "ae49015e074d54faf2cb9315ed66c810d79f634aee69cdaa0e889ceae8bf0cc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1385983-02a6-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770305038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305038, "uuid": "190814ef-be9c-4da0-beba-a630160c25ce", "comment": "Malware payload (RemcosRAT)", "value": "18e53b12c7316e2468510e84dc2cb1b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305038, "uuid": "8d6ac36f-472f-423d-bf02-3faa34c4d581", "comment": "Malware payload (RemcosRAT)", "value": "ae7ed5d4188ca36ea5710c5a47082c450d9d174b6d5cda500976f4058be4e9f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305038, "uuid": "72306012-24ab-4f58-93d6-c977a9ddcfc0", "comment": "Malware payload (RemcosRAT)", "value": "bf019228108b76c1a7e93f7e9fef721f63ad8478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305038, "uuid": "e648b198-4929-4ace-a95b-4212dd5f371b", "comment": "Malware payload (RemcosRAT)", "value": "d8587fd2c73c6c9259dc5a2772873c1cb0cc3c9b99066dd7d472e1cebd299db6aa473d91e70a2d03d8e3ff2caa580a8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305038, "uuid": "aa032f0f-04de-4cda-960f-31a5b67d7754", "value": "T1BF452394B718D483C95957B00DE1F37223B88F8DAD26C2B2CDFABCC778887613944699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305038, "uuid": "2751210f-13d0-4abf-857a-92d803d4466b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305038, "uuid": "bb7d5cca-f9ff-4669-a7bf-fd106badfcb3", "value": "12288:zpQ9y7hq5aM9nFr8pPEJ6BeoKZhaIw7tpiU6AKPZznUKDEX+1AnjqJa4e5Sffv62:immyKZhi6TUKnK2a4ySffvsyTmD/lU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305038, "uuid": "91499a66-7acf-4b3f-8431-bef058d5503b", "value": 1199624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305038, "uuid": "282bf63f-9430-4716-bc1d-52b4045d6312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305038, "uuid": "b1f50a95-bbb2-43ff-87db-2746cfa52d4b", "value": "ae7ed5d4188ca36ea5710c5a47082c450d9d174b6d5cda500976f4058be4e9f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ce6e96-02a4-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303972, "uuid": "b96ce541-c58e-4506-840e-7aa45ac4e532", "comment": "Malware payload (AgentTesla)", "value": "429a3014e3ed672a9d0f8ae5797871b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303972, "uuid": "e5bb72f2-2e68-43e4-8c8e-6e5c402dffe7", "comment": "Malware payload (AgentTesla)", "value": "afec44d79f6413b292533cccc181fe4d07d5a94b94db5c33fad935fccb017566", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303972, "uuid": "eaa9a808-cbc8-4c2e-9fd2-77189be664a2", "comment": "Malware payload (AgentTesla)", "value": "0ad8c57bb2a7c542150793e6865c13771d52490d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303972, "uuid": "e0cff241-7d28-47ac-9e32-d5871ad461e2", "comment": "Malware payload (AgentTesla)", "value": "7b17e3cd2668f3e367672fc210d84252cc3d60ab150af9db5070fec6b152e2efa469d34274c6fae50d26c3af8f8f306a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303972, "uuid": "37e13bb7-4554-42f7-a48a-0c5e0b58c354", "value": "T19A74F166FA35544FE934DCB16E626ABE67B81D34303792573F52FB2B94702610B0E20E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303972, "uuid": "99634552-0d04-47f2-bc77-b4c5376c5423", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303972, "uuid": "6600682a-914a-4fc3-9dd6-831312219cb5", "value": "6144:zDf4hQtpW2Kevab1zKHp27kFqnuWXV6o0PUnFNkkp7rm:f4y7W2/ixzKJgkWpV1nFNk0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303972, "uuid": "f163a89f-4e77-4a93-9771-7bdebe2aaada", "value": 359776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303972, "uuid": "da1a71d8-4eef-4c24-b93d-df72b6dd29a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303972, "uuid": "6751964a-8fbf-4716-9813-c592fb88e65c", "value": "afec44d79f6413b292533cccc181fe4d07d5a94b94db5c33fad935fccb017566", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f280b60b-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770303859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303859, "uuid": "c4b4fd2e-9858-433a-a43b-cab1211c3ace", "comment": "Malware payload (RemcosRAT)", "value": "dd26edfba440af3cea42516c11eb2bb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303859, "uuid": "a25fb372-a2d1-489a-876a-190f0bd7892a", "comment": "Malware payload (RemcosRAT)", "value": "b0732f555a9f8446abad02610f03927a4e5b6947452dcea765d6a48051714dc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303859, "uuid": "3833d335-6d92-4667-bdbe-55adb5d5f626", "comment": "Malware payload (RemcosRAT)", "value": "5fca81ff40753b4eba440d95b76ad19833eb99ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303859, "uuid": "24d6b49a-30c9-4344-a5c5-4c645d5026e1", "comment": "Malware payload (RemcosRAT)", "value": "860870c6a130739b08eef675eb1454132b7cf1c77e7f1e19dd08b5b10d7ec18a20dd987ad767d1c213e2e47b0656e8fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303859, "uuid": "e87fcf91-f413-4fa9-a531-76bc28ae9297", "value": "T1ED45D02373DDC361C3B25273BA25B741AEBB782506B5F56B2FD8093DA820122525E773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303859, "uuid": "e3dd3c3c-92d0-4f32-928a-49f1fbff4d5e", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303859, "uuid": "f5f26019-b213-462d-b262-0a8478f38d18", "value": "24576:ttb20pkaCqT5TBWgNQ7aQsQxFx7VRMYuxvYEza6A:eVg5tQ7aQsQF7VKYu6EW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303859, "uuid": "4af14962-c69a-4e26-ab43-baf108e7226f", "value": 1278976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303859, "uuid": "b2754a80-4816-41c6-b26b-2b1b4a0c32ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303859, "uuid": "4b792a81-b34d-4bad-a679-d569576c4d69", "value": "b0732f555a9f8446abad02610f03927a4e5b6947452dcea765d6a48051714dc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1221ada-02ac-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770307695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307695, "uuid": "5754ad49-3ade-43ca-85f9-f7bb13c9d1ac", "comment": "Malware payload (AsyncRAT)", "value": "18238b896004f624a01c089cc673faf1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307695, "uuid": "87830a3b-cc43-45e3-bf74-c5edd6690151", "comment": "Malware payload (AsyncRAT)", "value": "b07b9082bfe11919da0905e9b95611817efbc293618ec42cefb82e2ad0d7450d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307695, "uuid": "e1796275-a670-44b5-a8b6-72b0b9088967", "comment": "Malware payload (AsyncRAT)", "value": "d2a2b5be611d3ce2c0669e816d6173f45450b2d6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307695, "uuid": "6cc20260-b7ef-482f-a91f-fba75f585e77", "comment": "Malware payload (AsyncRAT)", "value": "ac40ac86b2e948d065f026b893fb9d708269be18c5fbfac9fd045ecd873841c3b54c329ba9061b406f6b1e46567cc3bd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307695, "uuid": "5116ea26-5e67-4320-912a-89f5fdc16842", "value": "T15AE402482269D617E1EA5FF08C75D1B517B89CAEE901C35BAFCA7CCBB479B0481053A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307695, "uuid": "f132231f-feff-4f3c-9360-528a1416fc65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307695, "uuid": "653fe02a-2ff0-4747-ba15-4151bad5b676", "value": "12288:ApjiE9lCYn+DJ4Sf2MqhVWz0vxW9fJWdLvRDPuHuyEjjvRP9xBh6vV:GjiE7CfOthVaOQhejuOyA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307695, "uuid": "6744dbfd-abd8-4637-8dc0-9ce20044c7e2", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307695, "uuid": "a03e3ef2-47d0-4da9-81c4-07c543e68cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307695, "uuid": "40213fe0-d500-482a-a6d5-d7eafb07198f", "value": "b07b9082bfe11919da0905e9b95611817efbc293618ec42cefb82e2ad0d7450d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480269b0-02da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770327195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327195, "uuid": "f2698234-018f-4bda-919c-115f735c3ca6", "comment": "Malware payload (Mirai)", "value": "597211a0503d9de4e25ae81e5599bc10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327195, "uuid": "48e10d40-d559-44ea-9035-bb6c5dda2d4e", "comment": "Malware payload (Mirai)", "value": "b07dab2024d1276af88972520f37ce73b5b2923359f8d58879813746813d23fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327195, "uuid": "40fcf36d-5f7a-4bc7-96ad-b34a25cb3416", "comment": "Malware payload (Mirai)", "value": "58290aaad459011e0a2107a4a5d05648ab845ea6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770327195, "uuid": "76ce3fa0-02ac-41e2-8e85-c97686de41c4", "comment": "Malware payload (Mirai)", "value": "0887d348658c4dfea654d7a002f7f36375385ad4dfd82254c0480982cb29276c708d4cdcbb7f589ecb865a8108eb3eee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327195, "uuid": "1a9b0098-11d4-4f3d-b8ec-72fc7f9527b4", "value": "T105F2E0703645B8A1CA605677F9B2CB47F72AA3A891FE70B915010918ECF1A1364F63CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327195, "uuid": "6770abe3-58ee-414a-bcb3-49a3c2f9e12b", "value": "768:hJTKmOVP3WWkPgb7lPBIqxwQEECBah3zGK8JugGC1s3Uozo:hAmO4POPN5Evo3FIT4zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770327195, "uuid": "a26b4dd8-6839-4b44-8469-f631e13e8bb9", "value": 36832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770327195, "uuid": "bc2dd207-8a06-417e-a8c4-6514b2db4d1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770327195, "uuid": "6acc4cf4-0a80-4618-8a00-1cce7deed683", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fcb1aa-02a8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770305939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305939, "uuid": "ce45d57f-4d9f-4852-8cb8-7fb67e7e7d12", "comment": "Malware payload", "value": "5cd6bd3fc7837ef011f265a13b978def", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305939, "uuid": "3f4a6653-3c71-46b0-aeec-7f446c89bca0", "comment": "Malware payload", "value": "b0ac1cdd64c905054e9a4defe5cce5cd612e20493f8e2789abad5431bf2cf23c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305939, "uuid": "2ae544d5-9c82-4c1f-8e67-8cf05ca7762e", "comment": "Malware payload", "value": "19553ca54594f6d189cf698cc64a8145231f90f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305939, "uuid": "3ea5d8c5-63a9-492f-8f9c-f3c5f34f7104", "comment": "Malware payload", "value": "5ac97748e53f40529c1be465d1162f846631c0df256829152d0ab138d47de5753d519f2d4e051d7ea85dca97c240c2fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305939, "uuid": "ad8a65c6-3e06-4ba5-84b5-036fce01c495", "value": "T1ABF423191624C14BE7B64E305526E9B9A370FC3E1DB5D11BF3C02FAA7A7A272180FB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305939, "uuid": "e04d36a9-1b8c-4d31-85cf-da9c4ed271f4", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305939, "uuid": "dc82e8bf-afc2-4f35-a756-7b000137bd63", "value": "12288:5gNCrVb3L8b/S28Q3ToqgAODV0JgWK+rtBMqsX730rPky41dv/sQNHPyLR4BsYoB:5gNChTL8gQ9Oag7+r8HorYXPNqdMsYoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305939, "uuid": "6f2ae4e5-389b-4447-accc-5d69ee4a5551", "value": 742464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305939, "uuid": "d348e389-c5c0-4e4c-b8c5-9eae6b8a8828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305939, "uuid": "98e50122-d82d-4101-8aee-96c934124dec", "value": "b0ac1cdd64c905054e9a4defe5cce5cd612e20493f8e2789abad5431bf2cf23c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882cea05-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770303681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303681, "uuid": "63722da9-3225-40ad-aa87-377f9b4ce2fc", "comment": "Malware payload (SnakeKeylogger)", "value": "ed90bd06d0dbc9b1b36d83c432f2f908", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303681, "uuid": "72df04d8-5a94-434c-8140-67f7ea24673b", "comment": "Malware payload (SnakeKeylogger)", "value": "b0ec2badc57e34aac8c5d11b84572bafd77695355f504e581711a7c8137ed46c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303681, "uuid": "f4c9c164-144b-493e-ab0f-6ea5470de358", "comment": "Malware payload (SnakeKeylogger)", "value": "e06f0ab5049dde85876e4e2858a22a9130bc54bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303681, "uuid": "9a631ef1-f930-4768-990d-77a0389d5616", "comment": "Malware payload (SnakeKeylogger)", "value": "b5a155f038f86ab6411c387a6b9964e58bc30b7cc9b05dc04aa81b95c9f4381d1b9fe77f0f8feb44b2f8f14ea1aef075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303681, "uuid": "dfaee898-c9b9-4a9b-aa17-be59b9292047", "value": "T1AB85BF15E3D815A8E56BDB34CB615332D6B178160771E9CF0A99C21A2F73EE0AB3B311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303681, "uuid": "bcd9d32d-9d6a-43e6-b7d8-e3caffa60b12", "value": "f273dec38e278cd1477e83d6dab08a05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303681, "uuid": "601aa1b6-b7ba-40eb-a203-2a2d634ac12f", "value": "24576:2py4i1/EhoXCtQ8bCHG8Da9X8jLuz5gGirHqEYkwkSlljt1X4yDuM:284iyyf1a9KLuWGirKFklS3t1/uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303681, "uuid": "3c3f2b82-8011-47c2-90a5-a6f8ee9601e0", "value": 1707520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303681, "uuid": "08f29a23-447b-455b-af3d-acca97947d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303681, "uuid": "2cb5f18f-eaca-4869-b0d0-ef193b6088f8", "value": "b0ec2badc57e34aac8c5d11b84572bafd77695355f504e581711a7c8137ed46c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac472381-02a7-11f1-a129-42010a9c0007", "comment": "Malware payload (Expiro)", "timestamp": 1770305459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305459, "uuid": "597a13af-152e-4225-989d-19aa8fc09165", "comment": "Malware payload (Expiro)", "value": "915cbb6cf52c22620cf564ec102d0cfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305459, "uuid": "f4b86c2f-a55b-44cd-8625-aa506fe04d58", "comment": "Malware payload (Expiro)", "value": "b108b5266539de7b10eaf3999ae3be915fa72e369c1aa207eab26adad61bea0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305459, "uuid": "27cd9de1-1a74-476f-9e66-2ec80daf84dd", "comment": "Malware payload (Expiro)", "value": "fd5ee120addb7805d2db006c9f5b5378af74baae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770305459, "uuid": "8cc8d0bb-9d23-416d-ac7d-770e9b86d1a8", "comment": "Malware payload (Expiro)", "value": "40dda3765a705ba364a6e1bd11e7779521c9df09095c737b101cd114f58892e0aacc6367cb8667a96115f8cc4abd655d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305459, "uuid": "549d5b80-c663-4840-9f26-95b60eb14890", "value": "T1CD95BE26EA20B066F85345703D78A246792D3D7A2680EC0BF7899F5A37B069375F530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305459, "uuid": "2605997c-7226-4522-b7e5-df774cb53f47", "value": "cfd2594de4405aaa7cfd1069684e9880", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305459, "uuid": "61881263-57fc-49fa-aa2a-77fa4732bd4d", "value": "24576:nmQkcvgjVg9N9JMlDlfjRiVuVsWt5MJMs:nmQkcvgRgFIDRRAubt5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770305459, "uuid": "e51882ec-3cbb-4b05-bc06-eed75185438e", "value": 1912832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770305459, "uuid": "e1e80abd-80a8-451e-bb01-9226e1c786a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770305459, "uuid": "2c1865b9-a344-46dd-995e-3ae39f79498b", "value": "b108b5266539de7b10eaf3999ae3be915fa72e369c1aa207eab26adad61bea0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7dbe63-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303769, "uuid": "ad72354b-443f-40db-90e3-8316babf8328", "comment": "Malware payload (AgentTesla)", "value": "8dcc4eedebaf3037f5d86738adf8e4a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303769, "uuid": "fefee4d8-d7eb-48a9-bfe5-34d0278da0af", "comment": "Malware payload (AgentTesla)", "value": "b16ab8dc1f81d06c74e75c73d1083370ac6c473d6030cf266f5c90ccec10acb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303769, "uuid": "1dd98d4b-b3cc-4520-8c55-f7a78ee767dd", "comment": "Malware payload (AgentTesla)", "value": "537bc251d4a2147862b4275eea51bda1b79c1654", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303769, "uuid": "61e5914c-242c-473c-b336-f075d144844a", "comment": "Malware payload (AgentTesla)", "value": "ea0c4df455220cb58e508ef4a1ae7f46785075aaa12f4f1cddb8ece709af3a4e3c12b361ef60761fc60c4e733ca3a4a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303769, "uuid": "e78ecf40-1b14-48d7-915a-abf596750936", "value": "T10135AE027381D062FFAB95334F5AF6115BBC79260123A62F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303769, "uuid": "5fbfc100-edeb-4484-b726-761a2db4d2a4", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303769, "uuid": "09adb37e-8994-44d5-bedb-adc2df385c9a", "value": "24576:J5EmXFtKaL4/oFe5T9yyXYfP1MAXDz6e8obHgW9e:JPVt/LZeJbInGiz6e84V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303769, "uuid": "2c1cb903-5ef4-4646-8e49-0e45169e70b0", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303769, "uuid": "57a12b87-5a7d-4137-9ec7-1c064cfb8406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303769, "uuid": "dfffd312-7fe9-44a6-ba45-8cefa7618cb3", "value": "524caed8da7e4b466a5806d5ad78dc4c586f7a84d4cbed6fed3bf6897ed300a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757d21cf-02a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770306226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306226, "uuid": "938c9194-1a8d-4bd8-ac7b-6cee3b3a4b91", "comment": "Malware payload", "value": "d4ce8d2eabb2f12421f8646f00c2799b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306226, "uuid": "b6f60c41-d15d-44e5-941a-eb453d3ffc15", "comment": "Malware payload", "value": "b1d10928d73accfd7a0fdec7e62d22c91d5de3e62e26409d14c6e7b202328656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306226, "uuid": "3f7f0450-b293-41ee-9da4-dfede79c9c7e", "comment": "Malware payload", "value": "545acee8e953fbe4fba517a6a3e94d91db371d41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306226, "uuid": "ee9aa1ff-e86f-4824-9cf9-cfa3ca0f98de", "comment": "Malware payload", "value": "6ce893a12d3e3c14c2a3caab6f4243b1b0bba36ef7e24d23059ecab2a8654adf97faaf94191ccee0d3290a371bd49e31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306226, "uuid": "4d14e824-9af3-44dd-a9f7-a9fccd23ebcd", "value": "T145937C183BE54429E1FFAFB11DE57663C67AF6632903D21F20C9039A1623989CE506F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306226, "uuid": "2db2844d-a9ab-4549-98b1-b335ced89e07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306226, "uuid": "d49f5fa0-3906-4c12-8c4c-39329a7ceabc", "value": "1536:VgSTW2GX5qMWbXZXmBZwXgt6fuC3OpIUB7bq9n:VgNXVWbptOGUBXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306226, "uuid": "3aa170ec-d78d-44ba-9745-d315741ceb9a", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306226, "uuid": "828800c2-382f-4be2-a772-0e414b8817c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306226, "uuid": "2d9dcbd9-6269-41e7-a944-a4f08511e970", "value": "b1d10928d73accfd7a0fdec7e62d22c91d5de3e62e26409d14c6e7b202328656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04c7e64-02a3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770303775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303775, "uuid": "1500caf9-1c27-4a37-b8f1-fa7291bd5920", "comment": "Malware payload (AgentTesla)", "value": "b5ab4bbc257f27987593d558996e7004", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303775, "uuid": "ee496c43-8b31-47f5-8cb0-151383f65a1e", "comment": "Malware payload (AgentTesla)", "value": "b20c1983024b6fc695fa952f8f938a76b2954bc27ee2519b41a4426c00547c41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303775, "uuid": "23dfe9f1-f5e3-48b4-8b78-a00b3ae2c1ea", "comment": "Malware payload (AgentTesla)", "value": "b3d5c76d1012bee512810e60f65770f8683d9af3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303775, "uuid": "e56ce867-2f70-4c81-815c-c228c8f4ae96", "comment": "Malware payload (AgentTesla)", "value": "98f54aea39def0c5eff86e778ced3b60695bc1289423571611b72e1e09757ecdf0b29a974ce5a3da6606fd1392c1dc2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303775, "uuid": "a5544e46-1126-4bdc-8fcc-70b804b49d77", "value": "T17735AE027391C062FFAB91734F5AF6115ABC7A260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303775, "uuid": "6e0715d5-1c8c-44a5-a4fc-f92b586f2c59", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303775, "uuid": "33575bd9-acb8-419a-9a3d-676ab2dc994d", "value": "24576:J5EmXFtKaL4/oFe5T9yyXYfP1MAXDzhMulAyG8yhiIO:JPVt/LZeJbInGizhjA31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303775, "uuid": "f20c8120-0096-4bea-95d5-f8efa9193a46", "value": 1117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303775, "uuid": "33d97262-e986-4103-a877-ca3558c70210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303775, "uuid": "db94774b-4f40-492d-bfa7-e5d62b3c4e55", "value": "a206ebb029fd442736f17f60d15352433c227d272fba3db4aaa901610db29877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4ad201-02c0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770316336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770316336, "uuid": "b92f29e4-ad62-4a3b-99a9-1c71fb3e4b49", "comment": "Malware payload", "value": "c1c727d5c542203e88338e990708a98a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770316336, "uuid": "9ca15c62-dabf-4df7-a37c-0715b713f225", "comment": "Malware payload", "value": "b23ba73cde951380a6059872b574957e70a792c90088c8f37e3fe5e7887f70e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770316336, "uuid": "23028594-52ee-409b-a1b5-4011f69ff81f", "comment": "Malware payload", "value": "9e8b05ad58c5bdc1dad20a57be29b682c500e910", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770316336, "uuid": "db5fc5ba-cdd7-4b55-baa3-dd2c975a7188", "comment": "Malware payload", "value": "f581da19626ad3c0cfbc79c7101ddad83055df7d7f6dcad648d2f124406ca56f8c4ba989d83ab297ecedf2be92b8832c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770316336, "uuid": "8d241cbe-66ec-440e-8ce2-0e771964fde4", "value": "T171564B4BB6E314FCC5AAC474875BD563BD7178A80221B97B7684EA302F27E205B1DF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770316336, "uuid": "7a2aebde-3d76-485d-a0df-d9e8c053b770", "value": "98304:RX/hrJh8Jie950XkAXVw5mURaavNu6Y9KeG6G7g/SKzxOv9FcZ22PfjThHjpVcZ:lSywCL90822PbTZd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770316336, "uuid": "0092e829-eb82-4444-a7ac-a1c3231ac3d7", "value": 5970960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770316336, "uuid": "3a9f8de7-bcd5-4044-8a88-5780eeeb4fdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770316336, "uuid": "596867a1-259d-400a-aa4b-547c346d37b4", "value": "sample2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec431013-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770303419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303419, "uuid": "c664868f-a7f9-4343-9a69-094256c5efd9", "comment": "Malware payload (Formbook)", "value": "a2adb1dd874f8f3e395be49b71b525d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303419, "uuid": "ea0b3223-892b-4e50-b3ca-98ec3fff1c2d", "comment": "Malware payload (Formbook)", "value": "b34e1fcd62987fa5f5ee20e475ea1439cf841470a32f6ffc5a5fa49c6f5dac7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303419, "uuid": "9505abb9-6671-405b-950e-021ae7577cbc", "comment": "Malware payload (Formbook)", "value": "4bf28ac459926bbfc5f1e23a1c898445b0702396", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303419, "uuid": "f01db810-550c-4a53-af57-e07e4ac2429c", "comment": "Malware payload (Formbook)", "value": "9f101ec174401668625d630a01c7bb5cb742b86703c400322c8f8efbd02215d1454bcb1b73cf25ab9d771eee2ac9cc20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303419, "uuid": "67b800f3-8163-4d13-bcee-c7ef3c01596a", "value": "T1D1E40114135AC903D0D24FB6B871E2B43B685EDFB8A1E2579FD53EEFB06B6450950382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303419, "uuid": "e2aa6f1f-4c9e-4107-9534-a5f274ee8be6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303419, "uuid": "0a8de63c-2ca5-401e-b3d4-c784690000a7", "value": "12288:sEn4ctN7IBWXWWIdFnHgkf0di2N5DHBsQnm1vCYwIFdhR8qcoAgNLtBjDO:fTrIdDoYqdBsfcY3FfxugNLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770303419, "uuid": "41b8dbe0-0b73-4d96-82da-2319aaa6713e", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770303419, "uuid": "19a4915d-ce92-406c-bbf6-efad88fac78c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770303419, "uuid": "cfc6e678-d1c8-4938-b262-84aa7b4d6ec7", "value": "b34e1fcd62987fa5f5ee20e475ea1439cf841470a32f6ffc5a5fa49c6f5dac7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2742d7fb-02ad-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770307813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307813, "uuid": "46f08ce2-3144-4ca7-b7a8-92856b669e6d", "comment": "Malware payload (GuLoader)", "value": "c69c78c1073331cca5588d439334d3d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307813, "uuid": "ba53b9a7-e2bb-4fd4-941a-65f67e11832e", "comment": "Malware payload (GuLoader)", "value": "b3743ec6dfa4324b03a7242031123cb5ef4533d2df8910b311ee058c4f35e104", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307813, "uuid": "00057365-e3af-4769-9e6f-653b52dd8e36", "comment": "Malware payload (GuLoader)", "value": "a06ba6f95e7043ecbd1ee514a11e42c6a6b10a30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307813, "uuid": "73415774-fa9e-4dbf-bb04-937227b14b8d", "comment": "Malware payload (GuLoader)", "value": "869d8b70fe36a4f83185bcbdae66d5d37a6d8b6fef69b21676643daed29c2ed6b9d335cd3eea3502a4efa63bb0775a31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307813, "uuid": "2821caad-c2bd-4696-b28e-c9f213f0b192", "value": "T1D2E423A133B38833E9651BB08552D97F2996CD92146876372340B25ABCF7BB2DC3D247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307813, "uuid": "15c3c06f-0985-4ac8-a3dc-76926f957121", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307813, "uuid": "4d1d59d7-7bcb-4ec2-93e5-538028566bb9", "value": "12288:NBNUqroqIoKsO63S14008HN0TdGRiuh4OobvoE5j4RcWaKIyOiy3l:dBrDVe600o0TIRiubGoG421ey3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307813, "uuid": "f2ea0e32-61b2-4802-b5b5-9a794ff2f492", "value": 686968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307813, "uuid": "0f933ed5-84f6-4591-9a4e-f7e94cf71889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307813, "uuid": "e1716de2-eb82-4661-bd4c-9d86943c1abd", "value": "b3743ec6dfa4324b03a7242031123cb5ef4533d2df8910b311ee058c4f35e104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cde637b-0293-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770296844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770296844, "uuid": "726aee87-3010-400b-8a74-aa709b15bbcc", "comment": "Malware payload", "value": "b8c6a538b69811c37af929b31ce0b07d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Fake app", "colour": "#48D8EC", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy-Agent", "colour": "#5ECDDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770296844, "uuid": "f888c50d-e543-4cb2-aba1-430c57282503", "comment": "Malware payload", "value": "b3c86606b1410cc558acef06d55c2a03d41ad85cb2b04e904640f58b23185db3", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Fake app", "colour": "#48D8EC", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy-Agent", "colour": "#5ECDDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770296844, "uuid": "09b6ef5c-1a61-4565-9c88-6d231d7a442b", "comment": "Malware payload", "value": "b38378d4c8082eded156a6814d564b6d04747a8f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Fake app", "colour": "#48D8EC", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy-Agent", "colour": "#5ECDDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770296844, "uuid": "67ca3b01-0d26-43ab-a2de-6c37080945c1", "comment": "Malware payload", "value": "1549cc162c06f5d9ba134e15870c1ba0c7cd298be223ca135bcaeccca017bf7ad8d8d15fada7cc63adbf896aacfc9be7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Fake app", "colour": "#48D8EC", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spy-Agent", "colour": "#5ECDDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770296844, "uuid": "20d25d7f-9117-4fad-aeee-7a1a364ce119", "value": "T1E6C5CF8AF705D8ABC0E7C636827646A65517DC258B53D2874A69F23C0CB7DC08B87EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770296844, "uuid": "3a07932a-2b17-41b6-857e-1c181a0a4540", "value": "49152:+59Btc9ZCWXCmDJiUnFwRGu11CX0AJ7kdSEjEos:aBtqZ7Ca0UneRGth7kYEjEos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770296844, "uuid": "5e41890b-69ab-4a88-9b1b-9d552a59a712", "value": 2723829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770296844, "uuid": "7257a4da-0143-4d88-bb87-9bb0d7d49425", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770296844, "uuid": "414ae3d5-5adb-4038-9c4f-38fd71a95299", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96af51e4-02ab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770307141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307141, "uuid": "1f0efbdf-8c36-4b3c-a87a-8e8f2731f2ee", "comment": "Malware payload", "value": "14544234d1f1115923ca5bf67237117a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307141, "uuid": "9b75ff29-bfe7-4ed5-9650-e8698c90ccf8", "comment": "Malware payload", "value": "b3ccf1fe3cc828ca3f943a1f8399cdd7b859c1d6a2d3acc0a23569d5211f58f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307141, "uuid": "0dc94253-6685-4e3b-84e4-b74e6218cd69", "comment": "Malware payload", "value": "d022faea63222913a0f5a34f5e3247acbf13cbdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770307141, "uuid": "2dea3557-e6be-446a-9757-034c798caf30", "comment": "Malware payload", "value": "9ede4eb975cfd37ea97f29bd3ccf3bcdb2bfcdb16f6c84c46f02d15abc7e0f5dea9c7165b748408cf2392033fabcc9b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307141, "uuid": "a46aee41-1a08-487a-8e3e-62908404637a", "value": "T1D5641816E7607426F45349B02EB8A25A75283D391580ED0BB78D8F5A3772AC3B4F532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307141, "uuid": "655cbb5a-3f79-4112-8bd2-32866233235f", "value": "2fa47d04066ccd0c19c86131119cf669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307141, "uuid": "d212e2ec-a364-491f-9f44-15643243a5d2", "value": "6144:fDRcrnXBbQ0ECstZMOd+6Nfgz3YFBv8h7WvzDiksKxp:7RIJ4ZMOd+6Nfgz2pDik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770307141, "uuid": "7aa6ed12-2373-4dfa-b7d6-4d88603e0d87", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770307141, "uuid": "d8cdd004-aaec-4e15-a2a4-7e89992ecc0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770307141, "uuid": "7b92787f-2c02-49c8-bc9f-3085a06eadef", "value": "b3ccf1fe3cc828ca3f943a1f8399cdd7b859c1d6a2d3acc0a23569d5211f58f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8322a0b-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770304593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304593, "uuid": "b5d2f5eb-71a2-4ef9-b781-b6fa9de29cb7", "comment": "Malware payload (AgentTesla)", "value": "cecf0961ccdf65a94e3517d9c843303b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304593, "uuid": "9998a60a-69c6-4ca7-97e2-66f95906a258", "comment": "Malware payload (AgentTesla)", "value": "b475c6d5e806b588dee0dc1dccfd3c1acd833c31937c45839c862b059f3d1667", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304593, "uuid": "bec61502-3aa4-4255-bb66-914fd65ae0cf", "comment": "Malware payload (AgentTesla)", "value": "e9a0bd618a7b210f1ff51afd74a119f4139efbf8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304593, "uuid": "cfe127c8-7037-4917-8897-3bca9c9a995d", "comment": "Malware payload (AgentTesla)", "value": "441299d103db19e376bbcb1413619748085cced25d842b32619f80a5a2bf470a39a6c6e48e090907f12199241c34109e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304593, "uuid": "c23f1414-8f92-4212-9569-115c87c4fa35", "value": "T1A6D423534AD0E855C150A3798436CC5184383971DE463B6F8B6EE47BB8B03C3AE93B6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304593, "uuid": "7f8f16da-10de-42ac-8268-dd1865835e4a", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304593, "uuid": "e5ac09b5-f8fc-45da-a505-908510b85ccf", "value": "12288:Sz7hU5I5yuNHIgzSFKxWltRohBfSTso93UwD5vutOr/tQYt6phD:Sf+iN57Gtene3ZucTtQjph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304593, "uuid": "3427e483-9e39-4390-afb0-605ac669b0d9", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304593, "uuid": "29e56bb9-9abd-40cc-b639-7e8babc9bf44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304593, "uuid": "38cf8535-4177-4d9b-9ec1-bfc51707dc1e", "value": "b475c6d5e806b588dee0dc1dccfd3c1acd833c31937c45839c862b059f3d1667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f1a365-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304328, "uuid": "28e32820-352c-487b-96b6-622a24b6db55", "comment": "Malware payload", "value": "ce89ad7efb2d6292e5d5b734e2c04d4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304328, "uuid": "0e7ac7e9-bf85-4fc1-911d-14cad5444456", "comment": "Malware payload", "value": "b4acf600749fd248b52b386bc4bab5cae761df27f81f1c0ca28c6fc46504b650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304328, "uuid": "67f57b29-3449-49e8-ac3d-2add34ad31d2", "comment": "Malware payload", "value": "22e4f3c7997a3dc433e2aaa5823f6e50c1b4efe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304328, "uuid": "50064ad9-7e68-4a0f-a05a-0b6e8259b5cc", "comment": "Malware payload", "value": "b6bd3ade3754496c73ec8aedef8bff62eb41cda8b7f4cb8a72559254dd41f1635aed2e988a6cc7532b0a560c470e06ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304328, "uuid": "33a84da4-8b77-4152-9d72-1c41c629f748", "value": "T1AE94E616E660B526F89345703E78A256782E2C3A3641ED0BBB8DCF5A3A7158375F430F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304328, "uuid": "22a62ced-3719-41e9-877c-845b3849a143", "value": "1ccf6aab2fed3772396c55c987a959e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304328, "uuid": "5a5518b6-886d-4776-b9c6-e1842bbb4f4a", "value": "6144:w21Ezkl5LOsCg1l2arNsTElhr129Rii1LG1ycmbc0ZmFlftpOe5G8kKTJR/a:Rakj2arNsTElhr12jPcmzZmFX5jRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304328, "uuid": "c682c8b9-9bb8-4c59-8a5e-bc994a567c92", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304328, "uuid": "48339f21-ea85-4819-add5-e19e81b99831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304328, "uuid": "5373475e-980e-468f-ab61-3dad6452a052", "value": "b4acf600749fd248b52b386bc4bab5cae761df27f81f1c0ca28c6fc46504b650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c2f12f-02aa-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770306596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306596, "uuid": "03cc1915-dede-4819-aa15-12b64412636a", "comment": "Malware payload (GCleaner)", "value": "0f958317ba231a9e25d464269a7f41e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306596, "uuid": "6e5f5ec6-4ec6-4212-80de-bf2f9d9b317a", "comment": "Malware payload (GCleaner)", "value": "b4c18e27fa206378c56ad684713562f58e7e4bb1ac0acc020546fd4dc8fb08b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306596, "uuid": "5ee500e3-784c-43aa-ab22-50d4f145c65b", "comment": "Malware payload (GCleaner)", "value": "70659184d51696b4954b6330a8fbdddbdfcca3db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770306596, "uuid": "9faee6ee-cf1b-49b2-b90b-eb346f992739", "comment": "Malware payload (GCleaner)", "value": "39981d4cdc830903fcb337c84ecc593243e624107f716240b8d3cd5a65c5335bb85a959d2b35fda9fee0faf367258256", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306596, "uuid": "193c3e47-943b-492c-ad2f-f100570de203", "value": "T18846E1E799909672C2AF0F7D9822301CDDE3AB402534518BD5A8D5CC876BF81EA33F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306596, "uuid": "26b95310-5eb1-428e-af88-ab4590b02420", "value": "90d3d45c4128e324bab07310ba2c236a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306596, "uuid": "7ff6623d-c3df-438c-a20d-4a3f642ab7e9", "value": "49152:vjdW0VqYyqw64Vx3Q35PoiufPMTNHVVqvN3vSqljrPX7AmfqVtehd/GF3ssw4DZl:rdW0/vkg4fqgvIg3fmi3l4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770306596, "uuid": "312a849c-dcef-4cb1-bb0a-e995922943c1", "value": 5535232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770306596, "uuid": "7b502d60-5f4d-4b64-9073-a70f100be0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770306596, "uuid": "da52b482-d007-4220-aaeb-42134639fb60", "value": "b4c18e27fa206378c56ad684713562f58e7e4bb1ac0acc020546fd4dc8fb08b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a16f17-02a5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770304339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304339, "uuid": "206c9444-6641-4e60-bca3-bcb84dbe1a57", "comment": "Malware payload", "value": "194bb1d96b8cebf5105a29978a5770c1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304339, "uuid": "2487dd3d-827f-42cf-aeb8-8d6f86c7d05d", "comment": "Malware payload", "value": "b4df2a01354e8128c6e6b9d91995efc93481baf7e9eb9fe2f2d549fd08732e2f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304339, "uuid": "7c1fc06c-86b5-4ab3-82a4-9c39288b1654", "comment": "Malware payload", "value": "d905be9418ff8a6f16325e0bb3aca781740b1410", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770304339, "uuid": "7d6ded62-998b-4354-906a-d761986c6e7f", "comment": "Malware payload", "value": "cb6984aecdbe6d9da3c65413cff32c8cf5adf8ae47457cfe74bed18e630f7b4b66059594b19530cb4c27d47f7381f3e8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304339, "uuid": "fbd9ba61-a227-4bb7-bc6e-5b809a4dd31a", "value": "T174952313A24DCBADDC62B5B732E30F8A742B843CB158A19B46CB58DC2154EBF0398DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304339, "uuid": "ecaf89f0-d421-4b19-a5da-2b46bfdd8ea3", "value": "49152:JWBmMehQOTAEOLoCx/cCB5Dpkm/f1g0XI9oRUczqUe6Q4w:JWBmMeGaAXLoiP3N9XI9kUczq76Qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770304339, "uuid": "b6d2f8a9-e56d-4c4c-9b09-fa4693e58938", "value": 1967190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770304339, "uuid": "17d9856f-f290-4e0d-8894-9c1288428db2", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770304339, "uuid": "c83e11ca-fe4f-4fa6-95a4-666cf5bc4479", "value": "jdk.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c35fdb6-02dd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770328518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328518, "uuid": "de246056-e7db-4ba3-8bf9-d9f74765ce7c", "comment": "Malware payload", "value": "c7258116b44e75409381e61027274ad9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328518, "uuid": "2e181eae-648a-43c7-a098-ea39679af8d7", "comment": "Malware payload", "value": "b518e08c64309ac8a6d1f74ea8f0ca33072205679d7be99b35d927394c664cff", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328518, "uuid": "c9861791-c497-4c9f-a508-4a9a091cc3f6", "comment": "Malware payload", "value": "4bff7bce31f46f931df1e83ae01a3692663a0b3e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770328518, "uuid": "9321011d-1ecf-43f8-bc9b-ed4a237bc08a", "comment": "Malware payload", "value": "03781bd560d24645d1068187ddcea504a443e05eca121962585171b8ed6d0dca9ce57de6f55ddc1c4316a236a0084d65", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328518, "uuid": "2d518d88-82b8-4caa-9358-0a5cfdfca87e", "value": "T151F633E3A8DA2F12DD1F6C386227CFB498040CE94A91C285D5ACFB5F197B7B28B47055", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328518, "uuid": "5e16b9d4-ac0d-4150-8865-4fb405f5b64e", "value": "393216:Vr4m56MawBjp8SGrs9T6kHP1RK+qj1zO:Vj56sBzGrs9THHPDKhJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770328518, "uuid": "4643d25d-d0a9-4a8e-9adb-229de0ff1ce7", "value": 16609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770328518, "uuid": "583e86d2-c14e-4c0e-98f1-b59e311c7110", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770328518, "uuid": "b1872bc1-4007-4484-b829-8f7e2e914e0b", "value": "getscreen.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891fbbb8-02a2-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770303253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303253, "uuid": "3ebc6a08-c2e9-4b20-b985-e2a500b9f0e4", "comment": "Malware payload (Vidar)", "value": "99b9cc84f94cb812a5792e4267bd4ab7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303253, "uuid": "b3a40a37-0132-4ca2-bdae-be332b5437a7", "comment": "Malware payload (Vidar)", "value": "b51f20fe8aa0efcec3351467d432253ccda22e8094d7fc9a4d1167e41e8a3592", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770303253, "uuid": "07414a2d-ef67-4575-b1c3-d9030504cdd2", "comment": "Malware payload (Vidar)", "value": "9d387d139a6b51ce4c240b3d594f22c180cce413", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40